Analysis Report http://www.192192p.peynircimumit.com.tr/?#aHR0cHM6Ly9zcGVjaWFsc3RlZWwuaXQvemlwL09mZmljZVY0L3RyYWRlc3VwcG9ydEBzay5jb20=

Overview

General Information

Sample URL:	http://www.192192p.peynircimumit.com.tr/?#aHR0cHM6Ly9zcGVjaWFsc3RlZWwuaXQvemlwL09mZmljZVY0L3RyYWRlc3VwcG9ydEBzay5jb20=
Analysis ID:	384557
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: http://www.192192p.peynircimumit.com.tr/?#aHR0cHM6Ly9zcGVjaWFsc3RlZWwuaXQvemlwL09mZmljZVY0L3RyYWRlc3VwcG9ydEBzay5jb20=	SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering
Source: http://www.192192p.peynircimumit.com.tr/?#aHR0cHM6Ly9zcGVjaWFsc3RlZWwuaXQvemlwL09mZmljZVY0L3RyYWRlc3VwcG9ydEBzay5jb20=	Avira URL Cloud: detection malicious, Label: phishing
Source: http://www.192192p.peynircimumit.com.tr/?#aHR0cHM6Ly9zcGVjaWFsc3RlZWwuaXQvemlwL09mZmljZVY0L3RyYWRlc3VwcG9ydEBzay5jb20=	UrlScan: detection malicious, Label: phishing brand: microsoft	Perma Link

Antivirus detection for URL or domain

Source: https://specialsteel.it/zip/OfficeV4/authorize_client_id:xp4r0ga1-nqkd-504r-ilo1-gxvd8ys2h49z_u5gxwdl8h9p0c2arbt3fqsz64yjv1enimok7st1eq8z0j9fa7ynuo234pbx6ikwml5ghdrvcn07i4sewzyh2ru1gqdpcbo98j6tmk3fvax5l?data=dHJhZGVzdXBwb3J0QHNrLmNvbQ==	UrlScan: Label: phishing brand: microsoft	Perma Link
Source: http://www.192192p.peynircimumit.com.tr/?#aHR0cHM6Ly9zcGVjaWFsc3RlZWwuaXQvemlwL09mZmljZVY0L3RyYWRlc3	Avira URL Cloud: Label: phishing
Source: http://www.192192p.peynircimumit.com.tr/?	Avira URL Cloud: Label: phishing

Phishing:

Phishing site detected (based on favicon image match)

Source: https://specialsteel.it/zip/OfficeV4/authorize_client_id:xp4r0ga1-nqkd-504r-ilo1-gxvd8ys2h49z_u5gxwdl8h9p0c2arbt3fqsz64yjv1enimok7st1eq8z0j9fa7ynuo234pbx6ikwml5ghdrvcn07i4sewzyh2ru1gqdpcbo98j6tmk3fvax5l?data=dHJhZGVzdXBwb3J0QHNrLmNvbQ==

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: 571345.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\authorize_client_id_xp4r0ga1-nqkd-504r-ilo1-gxvd8ys2h49z_u5gxwdl8h9p0c2arbt3fqsz64yjv1enimok7st1eq8z0j9fa7ynuo234pbx6ikwml5ghdrvcn07i4sewzyh2ru1gqdpcbo98j6tmk3fvax5l[1].htm, type: DROPPED

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.2.4.79:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.2.4.79:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.2.4.79:443 -> 192.168.2.3:49733 version: TLS 1.2

Source: global traffic

HTTP traffic detected: GET /? HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.192192p.peynircimumit.com.trConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: www.192192p.peynircimumit.com.tr

Source: {D5DAD795-996B-11EB-90E4-ECF4BB862DED}.dat.1.dr, ~DFE6774F0342D20FA7.TMP.1.dr	String found in binary or memory: http://www.192192p.peynircimumit.com.tr/?#aHR0cHM6Ly9zcGVjaWFsc3RlZWwuaXQvemlwL09mZmljZVY0L3RyYWRlc3
Source: authorize_client_id_xp4r0ga1-nqkd-504r-ilo1-gxvd8ys2h49z_u5gxwdl8h9p0c2arbt3fqsz64yjv1enimok7st1eq8z0j9fa7ynuo234pbx6ikwml5ghdrvcn07i4sewzyh2ru1gqdpcbo98j6tmk3fvax5l[1].htm.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN_r8OUuhs.ttf)
Source: authorize_client_id_xp4r0ga1-nqkd-504r-ilo1-gxvd8ys2h49z_u5gxwdl8h9p0c2arbt3fqsz64yjv1enimok7st1eq8z0j9fa7ynuo234pbx6ikwml5ghdrvcn07i4sewzyh2ru1gqdpcbo98j6tmk3fvax5l[1].htm.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.png?x=ed9
Source: authorize_client_id_xp4r0ga1-nqkd-504r-ilo1-gxvd8ys2h49z_u5gxwdl8h9p0c2arbt3fqsz64yjv1enimok7st1eq8z0j9fa7ynuo234pbx6ikwml5ghdrvcn07i4sewzyh2ru1gqdpcbo98j6tmk3fvax5l[1].htm.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.svg?x=ee5
Source: {D5DAD795-996B-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://specialsteel.inircimumit.com.tr/?#aHR0cHM6Ly9zcGVjaWFsc3RlZWwuaXQvemlwL09mZmljZVY0L3RyYWRlc3
Source: ~DFE6774F0342D20FA7.TMP.1.dr	String found in binary or memory: https://specialsteel.it/zip/OfficeV4/authorize_client_id:xp4r0ga1-nqkd-504r-ilo1-gxvd8ys2h49z_u5gxwd
Source: imagestore.dat.2.dr	String found in binary or memory: https://specialsteel.it/zip/OfficeV4/images/favicon.ico~

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 185.2.4.79:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.2.4.79:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.2.4.79:443 -> 192.168.2.3:49733 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.win@3/21@4/2

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFF8C88BEE6B8462DB.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1000 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1000 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
95.130.175.151	www.192192p.peynircimumit.com.tr	Turkey		43260	AS43260TR	false
185.2.4.79	specialsteel.it	Italy		203461	REGISTER_UK-ASGB	false

Contacted Domains

Name	IP	Active
specialsteel.it	185.2.4.79	true
www.192192p.peynircimumit.com.tr	95.130.175.151	true
secure.aadcdn.microsoftonline-p.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.192192p.peynircimumit.com.tr/?	false	Avira URL Cloud: phishing	unknown

ID:	384557
Product:	CloudBasic
Start time:	12:42:30
Start date:	09.04.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D5DAD793-996B-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	ECB5AA203F0A71E385A6548E5F92DA27	F325DE6ACBEE1A42F1291CDFBCD2BE7F6C3BC631	BC28266B50551BA18A15B1853A63242D9FCE15FEBE904EE8BD1C776FD7173C0A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D5DAD795-996B-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	2D87B2F74896D4A43E7FB82E44C8FA2C	DD31E12A6E8A343A20A8549F94FA6B46A996620D	5E098B539221A427EC13824E1C97547979411C6477BF8EB6D6DC2A2644B7D289
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D5DAD796-996B-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	20143D51823CD76348E0C0885D1462B0	637BF3DB210F6A875B3830052D59E51A54F3D66B	084FCD75773604F64194EC153191EBD7B8C1E3CDDBE64AA829C6236ECFC05DCB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	AC8B3CC8619A691575F0D82A5581A60C	5C0F5F54CF3D02F868C4E73C06587FFC18E80F49	73F2F8CAD61EA663E1DB97D0D734E23415A0FC9ABF7F6F165660F2A3839150DC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ellipsis_grey[1].svg	SVG Scalable Vector Graphics image	2B5D393DB04A5E6E1F739CB266E65B4C	6A435DF5CAC3D58CCAD655FE022CCF3DD4B9B721	16C3F6531D0FA5B4D16E82ABF066233B2A9F284C068C663699313C09F5E8D6E6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ellipsis_white[1].svg	SVG Scalable Vector Graphics image	5AC590EE72BFE06A7CECFD75B588AD73	DDA2CB89A241BC424746D8CF2A22A35535094611	6075736EA9C281D69C4A3D78FF97BB61B9416A5809919BABE5A0C5596F99AAEA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\enterpass[1].png	PNG image data, 170 x 29, 8-bit/color RGB, non-interlaced	BD6E291A9A3CC17ED37605E4FF0010CC	6C1EFD74231E3D253E0F51E4656ECED2F3335D71	706DE242E7C3CFC4B16BA8174723F26FB80566C3171E9E795F057476011A5DE1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\arrow_left[1].svg	SVG Scalable Vector Graphics image	A9CC2824EF3517B6C4160DCF8FF7D410	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\authorize_client_id_xp4r0ga1-nqkd-504r-ilo1-gxvd8ys2h49z_u5gxwdl8h9p0c2arbt3fqsz64yjv1enimok7st1eq8z0j9fa7ynuo234pbx6ikwml5ghdrvcn07i4sewzyh2ru1gqdpcbo98j6tmk3fvax5l[1].htm	data	B66A388871FAE1487B836CF76FC43E1F	EF0F0FCE9C75B2CF4881BAD59652F78B99238628	20D76782AE39E75237C5DD5FB96737EE0D11B16F163C58D2FF8DD6791772606E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\passwrd[1].png	PNG image data, 69 x 34, 8-bit/color RGBA, non-interlaced	4F2A1D382216546E2C3BC620497FD4E3	F785EC5967B5666387304F779306F9C3E3359FF4	105C03D3360CDB953585482374B2CC953D090741037502B0609629F5BB0135B7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\sigin[1].png	PNG image data, 108 x 32, 8-bit/color RGBA, non-interlaced	681B83E88BA6AACCC72705FBF9F2257B	D69957C47026108511225160BE9BD15788D26E14	F32A760F15530284447282AF5C7D0825BABF8BC4739E073928F6128830819F7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\style[1].css	ASCII text, with very long lines, with no line terminators	9F94F80A5DC09BB962778175292195BC	A7F2E32B422AC9654F39EA870E403599791FCE1C	1CF4B3AD7ABF3189E78C1B3BD07308C92A03FA795FDBC5821FCDE24030CFEAD0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\firstmsg1[1].png	PNG image data, 353 x 41, 8-bit/color RGBA, non-interlaced	B7EA3983E3C2D7E5F61B8D1B42758189	FE0817947CA4BC53152ED9378470675D9AF189FD	7B6CF23AC2454B039DDF4F51B7074636ED5B08B6A1D254A47430C4ACE2A3569D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\microsoft_logo[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ZU5XMULY.htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	28E147F50975C4C72E6DAB2D4E6371E1	8037E18A7E3510F776CF9515D8D20AAF8E2AB3FA	4486B9C15240C78E879B593F2E9CF68E079E11173ED88CEC567488A375C33D43
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\favicon[1].ico	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	7CDD5A7E87E82D145E7F82358F9EBD04	265104CAD00300E4094F8CE6A9EDC86E54812EAD	5D91563B6ACD54468AE282083CF9EE3D2C9B2DAA45A8DE9CB661C2195B9F6CBF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\forgpass[1].png	PNG image data, 121 x 20, 8-bit/color RGB, non-interlaced	B19CAC60E41C79BD974C1080088C6FEF	FFE553D8CA430DD309494E910A989271648A4DDD	E29DB32031DC537AEE9CB557B408395F3324F1E0F744349C0CDF943A3AF39296
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\inv-big-background[1].png	PNG image data, 1920 x 1080, 8-bit colormap, non-interlaced	62DDD263C8A6A4C9074E205B91182D04	1B56D11B012DD79DD99212EBB54ADCFB60920A9D	A59EA699D353D00FF2999111F9FA11FB73A47EDA7800642609CA230560EA3703
C:\Users\user\AppData\Local\Temp\~DF3562BF1B2BF6EB4B.TMP	data	31D4FC498FC7345A6CDFEC361712BBD5	6509EFBE1F81D9050B6CE5777DC59BD8848AB993	BEEFE247E465EB2A9A445A58C1B73CAA4E4B98C448CADCFEA11F9EEC903BBAD5
C:\Users\user\AppData\Local\Temp\~DFE6774F0342D20FA7.TMP	data	262C4DF62571CBCD86ACE9FFA599274D	A0D07DFE0E4FAF796453446006E04586FAFF21F4	B9A1E1DCEDCC8F56AA750F92C49A287995E583CD44E6D5FEF94E06078D792B2E
C:\Users\user\AppData\Local\Temp\~DFF8C88BEE6B8462DB.TMP	data	E67012AE338C70BE1F5B67195052EEF1	4E960AA4FEF41B7D9F67B07966AA4654995F957D	5CEF74B78BA1C6F5918ED1CE7AEA13F2B7544F33239F7AB93539444C024A2DA8

Analysis Report http://www.192192p.peynircimumit.com.tr/?#aHR0cHM6Ly9zcGVjaWFsc3RlZWwuaXQvemlwL09mZmljZVY0L3RyYWRlc3VwcG9ydEBzay5jb20=

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs