Analysis Report http://encrypt.techomind.com

Overview

General Information

Sample URL: http://encrypt.techomind.com
Analysis ID: 412661
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Phishing site detected (based on shot template match)
Yara detected HtmlPhish10
Phishing site detected (based on image similarity)
Phishing site detected (based on logo template match)
HTML body contains low number of good links
HTML title does not match URL

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: http://encrypt.techomind.com SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering
Antivirus detection for URL or domain
Source: http://encrypt.techomind.com/ SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Phishing site detected (based on shot template match)
Source: http://encrypt.techomind.com/ Matcher: Template: pdf matched
Source: http://encrypt.techomind.com/ Matcher: Template: pdf matched
Yara detected HtmlPhish10
Source: Yara match File source: 767668.0.links.csv, type: HTML
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\main[1].htm, type: DROPPED
Phishing site detected (based on image similarity)
Source: https://hebronbilingualsda.org/content/main_files/microsoft_logo.svg Matcher: Found strong image similarity, brand: Microsoft Jump to dropped file
Phishing site detected (based on logo template match)
Source: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 Matcher: Template: microsoft matched
HTML body contains low number of good links
Source: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 HTTP Parser: Number of links: 0
Source: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 HTTP Parser: Title: Office 365 for Business does not match URL
Source: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 HTTP Parser: Title: Office 365 for Business does not match URL
Source: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 HTTP Parser: No <meta name="author".. found
Source: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 HTTP Parser: No <meta name="author".. found
Source: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 HTTP Parser: No <meta name="copyright".. found
Source: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 198.12.154.178:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.12.154.178:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: encrypt.techomind.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wild.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: http://encrypt.techomind.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: encrypt.techomind.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /way.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: http://encrypt.techomind.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: encrypt.techomind.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: encrypt.techomind.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1User-Agent: AutoItHost: encrypt.techomind.com
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: encrypt.techomind.comConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: encrypt.techomind.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 12 May 2021 18:55:19 GMTServer: ApacheAccept-Ranges: bytesKeep-Alive: timeout=5, max=98Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 Data Ascii: 111157<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>3404
Source: {06CF1659-B39F-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: http://encrypt.techomi
Source: ~DFCDF5FB740613BB71.TMP.2.dr String found in binary or memory: http://encrypt.techomind.com/
Source: ~DFCDF5FB740613BB71.TMP.2.dr, {06CF1659-B39F-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: http://encrypt.techomind.com/&TechnoMind
Source: ~DFCDF5FB740613BB71.TMP.2.dr String found in binary or memory: http://encrypt.techomind.com//content/main.html?accessToFile=validating&fileAccess=56662&encryptedCo
Source: {06CF1659-B39F-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: http://encrypt.techomind.com/Root
Source: main[1].htm.3.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Source: 3MODYROK.htm.3.dr String found in binary or memory: https://hebronbilingualsda.org/content/
Source: imagestore.dat.3.dr String found in binary or memory: https://hebronbilingualsda.org/content/cut.ico
Source: imagestore.dat.3.dr String found in binary or memory: https://hebronbilingualsda.org/content/cut.ico~
Source: ~DFCDF5FB740613BB71.TMP.2.dr String found in binary or memory: https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedC
Source: {06CF1659-B39F-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://hebronbilinguand.com/lsda.org/content/main.html?accessToFile=validating&fileAccess=56662&enc
Source: main[1].htm.3.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7135.7/content/images/ellipsis_grey.png?x=5bc25
Source: main[1].htm.3.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7135.7/content/images/ellipsis_grey.svg?x=2b5d3
Source: main[1].htm.3.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7135.7/content/images/ellipsis_white.png?x=0ad4
Source: main[1].htm.3.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7135.7/content/images/ellipsis_white.svg?x=5ac5
Source: main[1].htm.3.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7135.7/content/images/microsoft_logo.png?x=ed9c
Source: main[1].htm.3.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7135.7/content/images/microsoft_logo.svg?x=ee5c
Source: main[1].htm.3.dr String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7135.7/content/images/picker_account_aad.svg?x=
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown HTTPS traffic detected: 198.12.154.178:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.12.154.178:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: classification engine Classification label: mal80.phis.win@3/19@4/2
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF08B42D9D3081252A.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3236 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3236 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 412661 URL: http://encrypt.techomind.com Startdate: 12/05/2021 Architecture: WINDOWS Score: 80 15 encrypt.techomind.com 2->15 23 Antivirus detection for URL or domain 2->23 25 Antivirus / Scanner detection for submitted sample 2->25 27 Phishing site detected (based on shot template match) 2->27 29 3 other signatures 2->29 7 iexplore.exe 2 62 2->7         started        signatures3 process4 process5 9 iexplore.exe 2 48 7->9         started        dnsIp6 17 encrypt.techomind.com 162.241.115.110, 49711, 49712, 49719 UNIFIEDLAYER-AS-1US United States 9->17 19 hebronbilingualsda.org 198.12.154.178, 443, 49721, 49722 AS-26496-GO-DADDY-COM-LLCUS United States 9->19 21 secure.aadcdn.microsoftonline-p.com 9->21 13 C:\Users\user\AppData\Local\...\main[1].htm, HTML 9->13 dropped file7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.241.115.110
 encrypt.techomind.com United States
46606 UNIFIEDLAYER-AS-1US false
198.12.154.178
 hebronbilingualsda.org United States
26496 AS-26496-GO-DADDY-COM-LLCUS false

Contacted Domains

Name IP Active
encrypt.techomind.com 162.241.115.110 true
hebronbilingualsda.org 198.12.154.178 true
secure.aadcdn.microsoftonline-p.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://encrypt.techomind.com/wild.png true
  • Avira URL Cloud: safe
 unknown
http://encrypt.techomind.com/favicon.ico true
  • Avira URL Cloud: safe
 unknown
http://encrypt.techomind.com/ true
  • SlashNext: Fake Login Page type: Phishing & Social Engineering
 unknown
http://encrypt.techomind.com/way.png true
  • Avira URL Cloud: safe
 unknown
https://hebronbilingualsda.org/content/main.html?accessToFile=validating&fileAccess=56662&encryptedCookie=5080b7079e42e7f7f42339337d7fbaa9&u=000142e8f0f0d64fe362ba89009a9da7&connecting=8ea008c13c68eba7937193ba001c13b4&phaseAccess=0eb7b8b7921971db486379d636704280&p=fb527d3e6d419408d9d7f0fb6644eb37 true
    		unknown
    http://encrypt.techomind.com/ true
    • SlashNext: Fake Login Page type: Phishing & Social Engineering
    		 unknown