Analysis Report RemitSwift119353 xlsx.htm

Overview

General Information

Sample Name:	RemitSwift119353 xlsx.htm
Analysis ID:	385276
MD5:	ca3a56c1d6eebe70576bb7196f53b1d0
SHA1:	72d5d6ef29bd345f17dcff7c299f47558e745d3e
SHA256:	3a6422545bcba48ce42dcbce1838b7042d8e5546f2ae527af18e7cd8b53ee879
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Yara detected HtmlPhish14

Yara detected obfuscated html page

Obfuscated HTML file found

Phishing site detected (based on logo template match)

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Suspicious form URL found

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: RemitSwift119353 xlsx.htm

Virustotal: Detection: 20%

Perma Link

Phishing:

Phishing site detected (based on favicon image match)

Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: 610930.0.links.csv, type: HTML
Source: Yara match	File source: 610930.pages.csv, type: HTML

Yara detected HtmlPhish14

Source: Yara match	File source: 610930.0.links.csv, type: HTML
Source: Yara match	File source: 610930.pages.csv, type: HTML

Yara detected obfuscated html page

Source: Yara match

File source: RemitSwift119353 xlsx.htm, type: SAMPLE

Phishing site detected (based on logo template match)

Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	Matcher: Template: microsoft matched
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	Matcher: Template: microsoft matched

HTML title does not match URL

Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: Title: Sign in to your account does not match URL
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: Title: Sign in to your account does not match URL
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: Title: Sign in to your account does not match URL
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: Title: Sign in to your account does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: Has password / email / username input fields

Suspicious form URL found

Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: Form action: https://ggman.my//routes/index.php
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: Form action: https://ggman.my//routes/index.php
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: Form action: https://ggman.my//routes/index.php
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: Form action: https://ggman.my//routes/index.php

Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49740 version: TLS 1.2

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 217.160.0.18 217.160.0.18
Source: Joe Sandbox View	IP Address: 192.229.221.185 192.229.221.185

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: clientconfig.passport.net

Source: 17-f90ef1[1].js.3.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://aka.ms/redeemrewards
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://ec.europa.eu/consumers/odr
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://ec.europa.eu/consumers/odr);
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://mixer.com/contact
Source: {FB42B5C1-9B60-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://privacy.micros
Source: ~DF21D4BF00FAEEC794.TMP.1.dr	String found in binary or memory: https://privacy.microsoft./en-GB/privacystatement
Source: ~DF21D4BF00FAEEC794.TMP.1.dr	String found in binary or memory: https://privacy.microsoft./en-GB/privacystatementsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.google.com/intl/en_ALL/help/terms_maps.html
Source: {FB42B5C1-9B60-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.microsoft.
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/allrates
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/emergency
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/emergency/
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/legal
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/legal.broadcast
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/store.reactivate.credit
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios)

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49740 version: TLS 1.2

Source: classification engine

Classification label: mal88.phis.evad.winHTM@3/31@9/4

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FB42B5BF-9B60-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFFED1E8E288005E12.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: RemitSwift119353 xlsx.htm

Virustotal: Detection: 20%

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6780 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

Obfuscated HTML file found

Source: RemitSwift119353 xlsx.htm	Initial file: Did not found title: "Sign in to your account" in HTML/HTM content
Source: RemitSwift119353 xlsx.htm	Initial file: Did not found title: "Sign in to your account" in HTML/HTM content

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
217.160.0.18	raktaxis.co.uk	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Private

IP
192.168.2.1

Contacted Domains

Name	IP	Active
cs1100.wpc.omegacdn.net	152.199.23.37	true
cs1227.wpc.alphacdn.net	192.229.221.185	true
raktaxis.co.uk	217.160.0.18	true
logincdn.msauth.net	unknown	unknown
clientconfig.passport.net	unknown	unknown
aadcdn.msftauth.net	unknown	unknown
ajax.aspnetcdn.com	unknown	unknown
privacy.microsoft	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=gunnar.grech@go.com.mt&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	true	low
file:///C:/Users/user/Desktop/RemitSwift119353%20xlsx.htm	true	low
https://privacy.microsoft./en-GB/privacystatement	true	unknown

ID:	385276
Product:	CloudBasic
Start time:	09:29:49
Start date:	12.04.2021
Sample:	RemitSwift119353 xlsx.htm
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	ca3a56c1d6eebe70576bb7196f53b1d0
SHA1:	72d5d6ef29bd345f17dcff7c299f47558e745d3e
SHA256:	3a6422545bcba48ce42dcbce1838b7042d8e5546f2ae527af18e7cd8b53ee879

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FB42B5BF-9B60-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	C8C292B8B5BACD683D19368F82A787AD	8F0A62051DDC02FC24F034F0482C9AC78A371209	C10510BF07209B830B7AF091739AC4DAF262515EBAE207AC66925917431CD22D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FB42B5C1-9B60-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	C68BCEB38918C073850B0D5276686055	CBED2EEB7A4BCF0823E8CD001D028B51EB5CA16A	896D29B3A193C64B318A3C631823ECCA7306809E4B310537F230BCF2A90EAC1D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FB42B5C2-9B60-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	75B5A9AB3237E9F4EA3DD835B3215ECB	DEEB4698A9B3586AA6621F17D12EA60A2E4BB04C	2654C17E3D013DDFCBF03E4C3B7309EF9F6208506F0AA3FCD897DCAC32327C99
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	E558BD37414FAC6546092E271CB36450	D50CFF3D9E9CA962B89BA1F5A75F9F7EE83F4663	D8F2248353C1777FB8FC36B76173002F6495BF7F03D9710D00F71B10BF991D5A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Converged_v21033_AZXChPIB5jI3ijrmoNll5w2[1].css	ASCII text, with very long lines	0195C284F201E632378A3AE6A0D965E7	BF2B78CCE5E09830A0F057FB6935E206333B752A	97EB235CAFA5525CEF7437B24548FB7936968778333DB62C0C661FFA8310090D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Print[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	B8E8859FCD4E43D51233559C17A3C7BD	F0CA023F26A84761995FA0BF6935DE6A3B8AE6F8	DC15A37B4015D0DECF639006E4F9002E742DDBFD7C669EC0AE469057F238B78D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\arrow_px_up[1].gif	GIF image data, version 89a, 7 x 9	95B65C94F57061E15ECC8304D3E578D5	A7483D668A780949FDA842F39877A3C08D0FC51C	BDA2D6EB8E72B3DBCA5EEF086178033F8A2BB3481180B2C63295FCF23843D960
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\script[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	633B23CA8A850C508C146635DB4239F5	CF78DA53BD7561F3ACB33710016ECBF60E9F0204	DAA1677D2640BE8A77F6C69EEE3911D2F8CF81DAA7BB604800A2D63A8F130C95
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\style[1].css	UTF-8 Unicode text, with very long lines, with no line terminators	9A3769F2253DF9AE29B12DC21062E2BC	23E899CB0B626CD27ED59033E60E9FDF0B1E6CBF	9E2732FD685A5101AB8B3EA0EBDA9764A004F21538F40BD42FAC359490C4CF80
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\d7-808fb1[1].css	UTF-8 Unicode text, with very long lines	B5C29B4AC43102BF428D32BF9C12C76D	ED7C97F502484C62E5D2D8D098EE2A4D240FF991	3673431352D7EAF65DEC60074374B6DF40EFA17997230B086A62D0688077E508
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[1].eot	Embedded OpenType (EOT), Segoe UI family	CAD76E4816AF6890C9BFD02A6D1EA899	9EDC91541C31034FCE0D83AABBAAD4C314CD3D33	D5794223D1A062E5DBE6C34C1994C8CE3792B24AFD5218D0644CB1F53DA4BE58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[2].eot	Embedded OpenType (EOT), Segoe UI Light family	17DFE73CB9C64527F7248B0A24DB317D	345198B9239FCDAF038FB2D3A919E4724037DBAA	AD75FB92B2EBCE6C37640F03E1AB96A752F388BCE60C877ADE4780B13839E8C4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\servicesagreement[1].htm	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	44A416A6D2C7B863B2B52AA92A0FBDDA	228D7BA0AA5D72A114CA3896601E7C22463C121F	23B458A23ADA39A1B1FA71AA025DE4E321360F3C4AE6099BD8EB2640C161CAF5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\17-f90ef1[1].js	ASCII text, with very long lines	07CB1B6723F61F949C862B399E06B3BF	83ABC38AB7E787F719E859E3EA97D4A634FE61FC	82A7ACB7D942575069E4067375BEC0C33F1949EA2864BE8BD12E9D6DB74A345D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\override[1].css	ASCII text, with very long lines, with CRLF line terminators	A570448F8E33150F5737B9A57B6D889A	860949A95B7598B394AA255FE06F530C3DA24E4E	0BD288D5397A69EAD391875B422BF2CBDCC4F795D64AA2F780AFF45768D78248
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\script[1].js	ASCII text, with very long lines, with no line terminators	793D36029B8AD32CB261F226B7012686	168780848C49158030673BD4DBA93CD3071D1DC8	E3BEAC351290C97CEFAF06552F5BF1CB1EE48611C896D46E9B397291869DA137
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\wcp-consent[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	38B769522DD0E4C2998C9034A54E174E	D95EF070878D50342B045DCF9ABD3FF4CCA0AAF3	208EDBED32B2ADAC9446DF83CAA4A093A261492BA6B8B3BCFE6A75EFB8B70294
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\0_pdvuot_2pyxh5ith335y8a2[1].jpg	JPEG image data, baseline, precision 8, 1920x1080, frames 3	A5DBD4393FF6A725C7E62B61DF7E72F0	55B292F885FFC92ABCE18750B07AA4ACFA4E903E	211A907DE2DA0FF4A0E90917AC8054E2F35C351180977550C26E51B4909F2BEB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE1Mu3b[1].png	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced	9F14C20150A003D7CE4DE57C298F0FBA	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\favicon[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\jquery-1.7.2.min[1].js	HTML document, UTF-8 Unicode text, with very long lines	B8D64D0BC142B3F670CC0611B0AEBCAE	ABCD2BA13348F178B17141B445BC99F1917D47AF	47B68DCE8CB6805AD5B3EA4D27AF92A241F4E29A5C12A274C852E4346A0500B4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\mwfmdl2-v3.54[1].woff	Web Open Font Format, TrueType, length 26288, version 0.0	D0263DC03BE4C393A90BDA733C57D6DB	8A032B6DEAB53A33234C735133B48518F8643B92	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
C:\Users\user\AppData\Local\Temp\~DF21D4BF00FAEEC794.TMP	data	8A4052E0D2490922EAF463EFA99889BC	67CA1A8A69144530F422863709177C5C54824542	B4D9DCE43EAC21EAD0970247C56B57F2DF20EC6BF5B8EEE8CE8A1747F3ADBAA7
C:\Users\user\AppData\Local\Temp\~DFA4B72BDCB6871BC2.TMP	data	BE76B75F3D6D4F247C5AD6D07DC61E3F	D8867E33EFDD9A19671365D3BFC1450AB48EDF7B	A21C2755232544B08A58D4089C0993A4629124BD6C50D8743AB15313DA5DAB98
C:\Users\user\AppData\Local\Temp\~DFFED1E8E288005E12.TMP	data	54FB92858E99E8216154FAAB46BCFFDF	14B8A59360ADF797D61F1802A9D2B3AE6B6A8851	6E28D3030AD8C4CE7E3BB0573CB01AD608837A7B6118EBBC32B4D986175F7487

Analysis Report RemitSwift119353 xlsx.htm

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs