Analysis Report https://bms.kaseya.com/Common/GetFile.ashx?enc=v0v3iBf9dJHRtCPkoYKg5wsihzS8jK%2bxLf5aFov4PDai02rukxWdluULr23lV4sTLzOvtuRnCV1xqi7E%2biXfpNb%2b6uvighFcWCFFIQBB8Xk%3d

Overview

General Information

Sample URL: https://bms.kaseya.com/Common/GetFile.ashx?enc=v0v3iBf9dJHRtCPkoYKg5wsihzS8jK%2bxLf5aFov4PDai02rukxWdluULr23lV4sTLzOvtuRnCV1xqi7E%2biXfpNb%2b6uvighFcWCFFIQBB8Xk%3d
Analysis ID: 356753
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish_10

Classification

Phishing:

barindex
Yara detected HtmlPhish_10
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\46f3fddd-165c-4cd8-9412-436cd19deef5[1].html, type: DROPPED
Source: Yara match File source: C:\Users\user\Downloads\46f3fddd-165c-4cd8-9412-436cd19deef5.html.a41uhm1.partial, type: DROPPED

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: bms.kaseya.com
Source: actions[1].js.6.dr String found in binary or memory: http://logo.clearbit.com/
Source: popper.min[1].js.6.dr String found in binary or memory: http://opensource.org/licenses/MIT).
Source: style[1].css.6.dr String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.s
Source: style[1].css.6.dr String found in binary or memory: https://aadcdn.msftauthimg.net/dbd5a2dd-2ivja-xubozxczt8hkuyvxiwoa4vmtaxu-16djdwpc4/logintenantbrand
Source: style[1].css.6.dr String found in binary or memory: https://aadcdn.msftauthimg.net/dbd5a2dd-bo8shd6svfocawg-d1lkuqyily-ch6cw-n5c0rmtwbq/logintenantbrand
Source: style[1].css.6.dr String found in binary or memory: https://aadcdn.msftauthimg.net/dbd5a2dd-mg0l7zcxfhbgphoiomweiqgq-z4rxnrzczncff4igy/logintenantbrandi
Source: style[1].css.6.dr String found in binary or memory: https://aadcdn.msftauthimg.net/dbd5a2dd-pd-rbmzbvqe7c-fjbigunke9t2gf5jszgqrgsatxfkk/logintenantbrand
Source: style[1].css.6.dr String found in binary or memory: https://aadcdn.msftauthimg.net/dbd5a2dd-pglwtvfgjxd-jsxdxcu-ixstqem6dnqipplqonbe8ro/logintenantbrand
Source: style[1].css.6.dr String found in binary or memory: https://aadcdn.msftauthimg.net/dbd5a2dd-uhsmbqxf0i-fc4inz9zgqi96xh-agvghl3xbkxk-y7c/logintenantbrand
Source: style[1].css.6.dr String found in binary or memory: https://aadcdn.msftauthimg.net/dbd5a2dd-xs-ly6aik51q1xmokwuzg7cgil517bv-ngigbudd-ua/logintenantbrand
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
Source: GetFile[1].htm.3.dr String found in binary or memory: https://bms.kaseya.com/media/GetFile.ashx?enc=v0v3iBf9dJHRtCPkoYKg5wsihzS8jK%2bxLf5aFov4PDai02rukxWd
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://code.jquery.com/jquery-3.3.1.slim.min.js
Source: bootstrap.min[1].js.6.dr String found in binary or memory: https://getbootstrap.com/)
Source: bootstrap.min[1].js.6.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.6.dr String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: actions[1].js.6.dr String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://manmedia.org/offic/n.page/actions.js
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://manmedia.org/offic/n.page/jqueryLib.js
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://manmedia.org/offic/n.page/style.css
Source: style[1].css.6.dr String found in binary or memory: https://my.navyfederal.org/NFOAA_Auth/resources/img/css/img-billboard-BG.svg);
Source: style[1].css.6.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-daldttgld72orokijcgtjn9zgk-dhdwrgaphu-0dqka/log
Source: style[1].css.6.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-mg0l7zcxfhbgphoiomweiqgq-z4rxnrzczncff4igy/logi
Source: style[1].css.6.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-pd-rbmzbvqe7c-fjbigunke9t2gf5jszgqrgsatxfkk/log
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/cdnbundles/converged.v2.login.m
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/images/favicon_a_eupayfgghqiai7
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://tuicura.com/offic/next2.php
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://tuicura.com/offic/nexxt.php
Source: 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://www.google.com/s2/favicons?sz=16&domain_url=
Source: actions[1].js.6.dr, 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://www.google.com/s2/favicons?sz=32&domain_url=
Source: actions[1].js.6.dr, 46f3fddd-165c-4cd8-9412-436cd19deef5[1].html.3.dr String found in binary or memory: https://www.google.com/s2/favicons?sz=64&domain_url=
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: classification engine Classification label: mal48.phis.win@11/32@9/5
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{835A355E-7633-11EB-90E5-ECF4BB2D2496}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF08A6A974461167F6.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5116 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' C:\Users\user\Downloads\46f3fddd-165c-4cd8-9412-436cd19deef5.html
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6480 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6480 CREDAT:17412 /prefetch:2
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6480 CREDAT:17414 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5116 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' C:\Users\user\Downloads\46f3fddd-165c-4cd8-9412-436cd19deef5.html Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6480 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6480 CREDAT:17412 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6480 CREDAT:17414 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 356753 URL: https://bms.kaseya.com/Comm... Startdate: 23/02/2021 Architecture: WINDOWS Score: 48 36 Yara detected HtmlPhish_10 2->36 7 iexplore.exe 5 59 2->7         started        process3 process4 9 iexplore.exe 28 7->9         started        13 iexplore.exe 1 58 7->13         started        dnsIp5 26 origin-bms.kaseya.com 52.144.52.222, 443, 49719, 49720 STRATOGENGB United States 9->26 28 bms.kaseya.com 9->28 22 46f3fddd-165c-4cd8...tml.a41uhm1.partial, HTML 9->22 dropped 24 46f3fddd-165c-4cd8...36cd19deef5[1].html, HTML 9->24 dropped 15 iexplore.exe 40 13->15         started        18 iexplore.exe 27 13->18         started        20 iexplore.exe 27 13->20         started        file6 process7 dnsIp8 30 manmedia.org 204.93.216.87, 443, 49737, 49738 SERVERCENTRALUS United States 15->30 32 cs1100.wpc.omegacdn.net 152.199.23.37, 443, 49744, 49745 EDGECASTUS United States 15->32 34 6 other IPs or domains 15->34
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
204.93.216.87
 unknown United States
23352 SERVERCENTRALUS false
152.199.23.37
 unknown United States
15133 EDGECASTUS false
52.144.52.222
 unknown United States
50292 STRATOGENGB false
104.16.19.94
 unknown United States
13335 CLOUDFLARENETUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
cs1100.wpc.omegacdn.net 152.199.23.37 true
cdnjs.cloudflare.com 104.16.19.94 true
origin-bms.kaseya.com 52.144.52.222 true
manmedia.org 204.93.216.87 true
stackpath.bootstrapcdn.com unknown unknown
bms.kaseya.com unknown unknown
code.jquery.com unknown unknown
aadcdn.msftauth.net unknown unknown
ajax.aspnetcdn.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
0 true
    		low