Analysis Report receipt145.htm

Overview

General Information

Sample Name: receipt145.htm
Analysis ID: 356265
MD5: b7581c1c3a2bdee565cdfe6b3e8a37ca
SHA1: 495182556b37cb96d1825ae10d3772b1c1df2c75
SHA256: 9bd8d84ffd6b03973ad90b022c9a1b1efb7e6f1a3bed838cb84b6a15ab96b725

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Phishing site detected (based on favicon image match)
Yara detected HtmlPhish_10
JA3 SSL client fingerprint seen in connection with other malware

Classification

Phishing:

barindex
Phishing site detected (based on favicon image match)
Source: https://kupitesla.ru/.,/authorize_client_id:rbjev5ld-ter8-nrba-rviq-g1okelty80v5_mscx13gp7ov0zb89htqlfej5yni2wdkru4a69hf24uc5knyilzr10o6v7bam8qwe3stjxdgpwjuvzb73sptoa14dkn0il2mc68qyh59egfrx?data=am1pbGxlckBjdXN0b21lcnNiYW5rLmNvbQ== Matcher: Template: microsoft matched with high similarity
Yara detected HtmlPhish_10
Source: Yara match File source: 760639.pages.csv, type: HTML
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\authorize_client_id_rbjev5ld-ter8-nrba-rviq-g1okelty80v5_mscx13gp7ov0zb89htqlfej5yni2wdkru4a69hf24uc5knyilzr10o6v7bam8qwe3stjxdgpwjuvzb73sptoa14dkn0il2mc68qyh59egfrx[1].htm, type: DROPPED

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 188.127.230.6:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.127.230.6:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.127.230.6:443 -> 192.168.2.5:49723 version: TLS 1.2

Networking:

barindex
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKdate: Mon, 22 Feb 2021 19:27:48 GMTserver: Apachex-powered-by: PHP/7.2.34vary: Accept-Encodingcontent-encoding: gzipcontent-length: 195content-type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 35 8f c1 0a c2 30 10 44 ef f9 8a 25 1e aa 58 12 bc 6a da 2f f0 20 82 78 10 91 45 57 12 8d 6d 68 b6 ad fe bd 69 ab 7b d9 65 98 7d cc 18 cb 2f 5f 82 30 96 f0 96 36 a4 31 ec d8 53 b9 f3 84 91 e0 88 8e 95 52 46 4f 6a b2 c6 6b e3 02 03 7f 02 15 92 e9 cd fa 81 1d 4e aa 2c 47 44 87 0d 58 8c 16 0a e8 5d 75 ab 7b e5 eb 2b b2 ab 2b 35 c8 1b 31 3a 0e fb 6d 32 80 b4 cc 21 ae b5 7e b6 c1 31 45 8f aa 69 b5 ca b5 84 e5 48 51 31 78 c7 f3 6c 96 2d 4e ab 73 7a fe 43 eb 40 d5 3c 51 72 90 97 48 fe 2e 17 02 8c 9e 92 94 42 18 fd 6b 95 8e a1 e6 17 8c 15 a3 32 ed 00 00 00 Data Ascii: 50D%Xj/ xEWmhi{e}/_061SRFOjkN,GDX]u{++51:m2!~1EiHQ1xl-NszC@<QrH.Bk2
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: jmiller.dearfibromyalgia.comConnection: Keep-Alive
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5176fc91,0x01d7099c</date><accdate>0x5176fc91,0x01d7099c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5176fc91,0x01d7099c</date><accdate>0x5176fc91,0x01d7099c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x517bc152,0x01d7099c</date><accdate>0x517bc152,0x01d7099c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x517bc152,0x01d7099c</date><accdate>0x517bc152,0x01d7099c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x517bc152,0x01d7099c</date><accdate>0x517bc152,0x01d7099c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x517bc152,0x01d7099c</date><accdate>0x517e23ad,0x01d7099c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: jmiller.dearfibromyalgia.com
Source: receipt145.htm, ~DFA8B2F17F0A132309.TMP.1.dr String found in binary or memory: http://jmiller.dearfibromyalgia.com/#am1pbGxlckBjdXN0b21lcnNiYW5rLmNvbQ==
Source: {7A07C4B1-758F-11EB-90E5-ECF4BB570DC9}.dat.1.dr String found in binary or memory: http://jmiller.dearfibs/Desktop/receipt145.htmromyalgia.com/#am1pbGxlckBjdXN0b21lcnNiYW5rLmNvbQ==Roo
Source: msapplication.xml.1.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr String found in binary or memory: http://www.youtube.com/
Source: authorize_client_id_rbjev5ld-ter8-nrba-rviq-g1okelty80v5_mscx13gp7ov0zb89htqlfej5yni2wdkru4a69hf24uc5knyilzr10o6v7bam8qwe3stjxdgpwjuvzb73sptoa14dkn0il2mc68qyh59egfrx[1].htm.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN_r8OUuhs.ttf)
Source: imagestore.dat.2.dr, ~DFA8B2F17F0A132309.TMP.1.dr, EJ6HO1WF.htm.2.dr String found in binary or memory: https://kupitesla.ru/.
Source: {7A07C4B1-758F-11EB-90E5-ECF4BB570DC9}.dat.1.dr String found in binary or memory: https://kupitesla.ru/.romyalgia.com/#am1pbGxlckBjdXN0b21lcnNiYW5rLmNvbQ==
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown HTTPS traffic detected: 188.127.230.6:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.127.230.6:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.127.230.6:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: classification engine Classification label: mal56.phis.winHTM@3/29@3/2
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7A07C4AF-758F-11EB-90E5-ECF4BB570DC9}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF31CA591828887135.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6408 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6408 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Confirm
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 356265 Sample: receipt145.htm Startdate: 22/02/2021 Architecture: WINDOWS Score: 56 15 kupitesla.ru 2->15 21 Phishing site detected (based on favicon image match) 2->21 23 Yara detected HtmlPhish_10 2->23 7 iexplore.exe 1 75 2->7         started        signatures3 process4 process5 9 iexplore.exe 2 47 7->9         started        dnsIp6 17 jmiller.dearfibromyalgia.com 198.54.115.226, 49715, 49716, 80 NAMECHEAP-NETUS United States 9->17 19 kupitesla.ru 188.127.230.6, 443, 49717, 49718 DHUBRU Russian Federation 9->19 13 authorize_client_i...68qyh59egfrx[1].htm, data 9->13 dropped file7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.54.115.226
 unknown United States
22612 NAMECHEAP-NETUS false
188.127.230.6
 unknown Russian Federation
56694 DHUBRU false

Contacted Domains

Name IP Active
jmiller.dearfibromyalgia.com 198.54.115.226 true
kupitesla.ru 188.127.230.6 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://jmiller.dearfibromyalgia.com/ false
  • Avira URL Cloud: safe
 unknown
https://kupitesla.ru/.,/authorize_client_id:rbjev5ld-ter8-nrba-rviq-g1okelty80v5_mscx13gp7ov0zb89htqlfej5yni2wdkru4a69hf24uc5knyilzr10o6v7bam8qwe3stjxdgpwjuvzb73sptoa14dkn0il2mc68qyh59egfrx?data=am1pbGxlckBjdXN0b21lcnNiYW5rLmNvbQ== true
    		unknown