Analysis Report https://csmcapitalccorp.com/

Overview

General Information

Sample URL:	https://csmcapitalccorp.com/
Analysis ID:	383655
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected HtmlPhish6

Phishing site detected (based on image similarity)

Phishing site detected (based on logo template match)

HTML body contains low number of good links

HTML title does not match URL

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://csmcapitalccorp.com/	Avira URL Cloud: detection malicious, Label: phishing
Source: https://csmcapitalccorp.com/	SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering
Source: https://csmcapitalccorp.com/	UrlScan: detection malicious, Label: phishing brand: sharepoint microsoft	Perma Link

Antivirus detection for URL or domain

Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cf	Avira URL Cloud: Label: phishing

Phishing:

Yara detected HtmlPhish6

Source: Yara match	File source: 035347.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\s[1].htm, type: DROPPED

Phishing site detected (based on image similarity)

Source: https://csmcapitalccorp.com/s/files/logo.png

Matcher: Found strong image similarity, brand: Microsoft

Jump to dropped file

Phishing site detected (based on logo template match)

Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f

Matcher: Template: microsoft matched

HTML body contains low number of good links

Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	HTTP Parser: Number of links: 0
Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	HTTP Parser: Title: Validation does not match URL
Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	HTTP Parser: Title: Validation does not match URL

Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	HTTP Parser: No <meta name="author".. found
Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	HTTP Parser: No <meta name="author".. found

Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	HTTP Parser: No <meta name="copyright".. found
Source: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xf08fa6e5,0x01d72c28</date><accdate>0xf08fa6e5,0x01d72c28</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xf08fa6e5,0x01d72c28</date><accdate>0xf08fa6e5,0x01d72c28</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xf0a05737,0x01d72c28</date><accdate>0xf0a05737,0x01d72c28</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xf0a05737,0x01d72c28</date><accdate>0xf0a05737,0x01d72c28</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xf0a77eab,0x01d72c28</date><accdate>0xf0a77eab,0x01d72c28</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xf0a77eab,0x01d72c28</date><accdate>0xf0a77eab,0x01d72c28</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: csmcapitalccorp.com

Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: {1A95955A-981C-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DF8F64FE653A1BED59.TMP.1.dr	String found in binary or memory: https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cf
Source: css[1].css0.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhv.woff)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: classification engine

Classification label: mal72.phis.win@3/21@2/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1A959558-981C-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF74735D9205806B08.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6004 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6004 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
20.55.100.100	csmcapitalccorp.com	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Contacted Domains

Name	IP	Active
csmcapitalccorp.com	20.55.100.100	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://csmcapitalccorp.com/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=e6d1fb745bbfa3f6e65161cfc7b13522439ad123413fc691592314d502b00c3032efe62f	true	SlashNext: Fake Login Page type: Phishing & Social Engineering	unknown

ID:	383655
Product:	CloudBasic
Start time:	05:39:22
Start date:	08.04.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1A959558-981C-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	D748F3944BE21A1A6219F1A60200734C	4DC45EEDA9C6C402904D51638EC56A29C42DE7FA	57B2AC443BC0D57D75C5C985F7E5EF36DBE0A61AE007C7B2E864A757F3276C6C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1A95955A-981C-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	EE5CE6DA1BCE84A7C9BFE16F61010F6D	937D2D728A5753401A35AF236573604DF945F658	E32796539CD41B1E57C3B4F05CFAE9C4449013C5552846CF3FFFD1B007118005
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1A95955B-981C-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	1D0F4CDF67E0B9ADA8CE10A4FA10AC7E	1E4F6D2A890FA1FCD6CA8CF6EE5C5E1CD15CC7D5	68C7B81D7DA22A18E316B7D5505425FE002B985EB5EFA6C737B3D25646BF800D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	A5CF89A4C836D074C234651F692BFBE9	5AA55DCA48F0232B4D3B0ACFF70F2F3364182095	0C609152B959004E910E8CF52A8872E965B9B99DEA86376FC3436FA8F9A5A34F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	58C882445EE4BAEEFA4EE2F64A4F3759	54364C3C1861FFDC7A0E588BBA432A70A704A358	245EA524FF21638BF2BC7A1DC9FE9519117653A9C3D6952C3258A43F452F51F4
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	1987CB09CFD060EC6AD650066E157897	4886B661BFE05C6DD4321B5ACAC7E608180E5F0C	BF60C59E2ED13723CAA80828CD718A187190A1BA6E6824929EA49F9FEEEAAAC0
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	C8BA96FE8B77AE2B29DDBEB207945639	7BD8EFC330CF29BCEBD1EBB7DD999BB9FE02FE17	B098C3A8749E129987CFBB04357275F28FBB0729B3216F9C4754C8EE3BD19EC7
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	139D79B19BF10EE4A35A3BEE57B2C1B8	8B876A9C9CC85CAF84C01E7D4C83E304A5D2047F	52F32A63A6E84EDC7086EDAC4DF89305A330AF47E29138CE33381D4FF94BA15F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	EE665B1903D2124FB021E4115E76BA20	76FA9D3CBCE111E6FD76D52E95CF2F83A197C30C	9ED869478AE70A7DFD11D51CA3DF3535BB822E70C410487574E1FCD140CAA07F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	10D81C61602AAF2261137ACB1345A26C	ED13F6C9B2BD993236EC8103835C6E9E84517B5D	6CA86800182D650DED94C954A2147B9DC313FC3A256440023C1CCADF70EDA15D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	AA94468D0ED90D32B435A937064D0340	E40E4F3128B5DCC6D8B4E14C68CBC3409258EFF3	D164D7D344F181F3E56CE4CC33C07D5E437D1BA8F1670FC5046D18BDDD6663E2
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	9A9395B060FC4B31719A752958BBF989	D99BB47056FDB8A31A97D111B5B24A42C426F878	8A6859A40C39D80FC6147D07F6BB291BCA753150590F10D28D7F52336252CC1E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\css[1].css	ASCII text, with very long lines, with CRLF line terminators	63DF83784CADD3A339B776520600C21A	69BB829612F3E3CB2F521323945C9284A2B0DCDE	2EE69AEF3AFB10B368BDE9FEA7E97CC75C030C890E3D2B8DC4AD19D498234DBF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png	PNG image data, 226 x 48, 8-bit/color RGBA, non-interlaced	EF884BDEDEF280DF97A4C5604058D8DB	6F04244B51AD2409659E267D308B97E09CE9062B	825DE044D5AC6442A094FF95099F9F67E9249A8110A2FBD57128285776632ADB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\s[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	474A9980C4D204E7D4B593832B226BEA	DBDB72D920A55C1AB76FDA122271C9986C8F9389	163589FCFF3F5D67836D8DF3EC13D11E561E93C25B9679D3BA92B98F9D34EABF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\pdf[1].png	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	F1E3F187F7C23FA8D1555004F3800356	E71E52A142E754399AE39EF38584789B66E9EA00	DB307FCEF7F95139689007D7A623B340EC21282BD421C4E4B2BA09078F230545
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\css[1].css	ASCII text	4CFC4658F748E1FC67D2EA27F9B3692F	82C520D112F48E337E99DF00067BFAA75D0F9CA2	ABC5A61E85F95E54C925FE9589099AD680912480E7C97052AF0496CBC6D111B8
C:\Users\user\AppData\Local\Temp\dat8C8D.tmp	Web Open Font Format, TrueType, length 2532, version 2.24904	10600F6B3D9C9BE2D2B2CE58D2C6508B	421CA4369738433E33348785FE776A0C839605D5	29B7A9358ABDC68C51DB5A5AF4A4F4E2E041A67527ADEE2366B1F84F116FE9A5
C:\Users\user\AppData\Local\Temp\~DF10F01ABFCA027A56.TMP	data	15C1ED6E7F4FFB47BB44888855648D04	738DE4DA7448AE39A84B58336D362BA74945FAD5	0949CA202BF2DD4C1219785492931ACECFB4FB782D30F675A7CF13ACB36EA3D9
C:\Users\user\AppData\Local\Temp\~DF74735D9205806B08.TMP	data	AB0F62A85F3F19E1733EA1AFD055A40A	14F6C4F6B0A04AC87CA6B469E1688DA91E6B1BDF	FDC8A4604E26BAE3A300F6B60FB472721620FA3158DBD42DD363C313A20DEC1E
C:\Users\user\AppData\Local\Temp\~DF8F64FE653A1BED59.TMP	data	7121C03D174E97D9BA4605441DAB54F7	B4A13C984FC614C61314CBFC30097AC35A6350D9	5ECB5622A21E0FF8AC0D4CDF7AE810A85D3CB9115DE376C7727DD63E63393241

Analysis Report https://csmcapitalccorp.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs