Analysis Report https://ishift.biz/ALTA/download.html

Overview

General Information

Sample URL:	https://ishift.biz/ALTA/download.html
Analysis ID:	432894
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish10

Phishing site detected (based on logo template match)

HTML body contains low number of good links

HTML title does not match URL

Suspicious form URL found

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://ishift.biz/ALTA/download.html

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish10

Source: Yara match	File source: 760639.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\download[1].htm, type: DROPPED

Phishing site detected (based on logo template match)

Source: https://ishift.biz/ALTA/download.html

Matcher: Template: outlook matched

HTML body contains low number of good links

Source: https://ishift.biz/ALTA/download.html	HTTP Parser: Number of links: 0
Source: https://ishift.biz/ALTA/download.html	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://ishift.biz/ALTA/download.html	HTTP Parser: Title: Login does not match URL
Source: https://ishift.biz/ALTA/download.html	HTTP Parser: Title: Login does not match URL

Suspicious form URL found

Source: https://ishift.biz/ALTA/download.html	HTTP Parser: Form action: IN.php
Source: https://ishift.biz/ALTA/download.html	HTTP Parser: Form action: IN.php

Source: https://ishift.biz/ALTA/download.html	HTTP Parser: No <meta name="author".. found
Source: https://ishift.biz/ALTA/download.html	HTTP Parser: No <meta name="author".. found

Source: https://ishift.biz/ALTA/download.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ishift.biz/ALTA/download.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.241.121.59:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.121.59:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.27.48.115:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.27.48.115:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.3:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.3:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.121.59:443 -> 192.168.2.3:49743 version: TLS 1.2

Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x2b7b629b,0x01d75e7f</date><accdate>0x2b7b629b,0x01d75e7f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x2b7b629b,0x01d75e7f</date><accdate>0x2b7b629b,0x01d75e7f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x2b8289ad,0x01d75e7f</date><accdate>0x2b8289ad,0x01d75e7f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x2b8289ad,0x01d75e7f</date><accdate>0x2b8289ad,0x01d75e7f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x2b8289ad,0x01d75e7f</date><accdate>0x2b8289ad,0x01d75e7f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x2b8289ad,0x01d75e7f</date><accdate>0x2b8289ad,0x01d75e7f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: ishift.biz

Source: font-awesome-4.6.3.min[1].css.2.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome-4.6.3.min[1].css.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: script-xkd.2[1].js.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/css/bootstrap-4.1.2.min.css
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/css/font-awesome-4.6.3.min.css
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/css/login.css
Source: script-xkd.2[1].js.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/css/style-xkd.2.css
Source: style-xkd.2[1].css.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/fonts/password.ttf);
Source: login[1].css.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/images/ajax.gif);width:16px;height:16px;margin:0
Source: login[1].css.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/images/linen.png)
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/js/bootstrap.min.js
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/js/jquery-3.3.1.min.js
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/js/script-xkd.2.js
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/sys/alberta/googletrack.js
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/sys/alberta/paragon-login-background.png)
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn.clareitysecurity.net/sys/alberta/paragon-login-bg.png)
Source: download[1].htm.2.dr	String found in binary or memory: https://cdn2.downdetector.com/static/uploads/logo/outlook-com-logo.png
Source: download[1].htm.2.dr	String found in binary or memory: https://collector.clareity.net
Source: download[1].htm.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:300
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc-.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: bootstrap-4.1.2.min[1].css.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: ~DF35CFB899C4618C4B.TMP.1.dr	String found in binary or memory: https://ishift.biz/ALTA/download.html
Source: {54BE78B8-CA72-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://ishift.biz/ALTA/download.htmlRoot
Source: ~DF35CFB899C4618C4B.TMP.1.dr	String found in binary or memory: https://ishift.biz/ALTA/download.htmll
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: analytics[1].js.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 162.241.121.59:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.121.59:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.27.48.115:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.27.48.115:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.60.13.52:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.3:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.3:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.121.59:443 -> 192.168.2.3:49743 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@3/35@6/4

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFE2C3B5B1199B26B2.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:952 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:952 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.140.154	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
104.27.48.115	cdn2.downdetector.com	United States	13335	CLOUDFLARENETUS	false
45.60.13.52	w87gi54.x.incapdns.net	United States	19551	INCAPSULAUS	false
162.241.121.59	ishift.biz	United States	46606	UNIFIEDLAYER-AS-1US	false

Contacted Domains

Name	IP	Active
ishift.biz	162.241.121.59	true
w87gi54.x.incapdns.net	45.60.13.52	true
cdn2.downdetector.com	104.27.48.115	true
stats.l.doubleclick.net	74.125.140.154	true
lfsdujd.x.incapdns.net	45.60.13.52	true
cdn.clareitysecurity.net	unknown	unknown
collector.clareity.net	unknown	unknown
stats.g.doubleclick.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ishift.biz/ALTA/download.html	true		unknown

ID:	432894
Product:	CloudBasic
Start time:	22:02:31
Start date:	10.06.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{54BE78B6-CA72-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	D7A710C7243F1A8E6159C265B423445E	25111A5B5B5B95F2130D8547C779E3B5AF2CEF32	8836ED321D9DBF3F08866336ECA9584F7E4CF1196C87C004DB7CC3A88ECFEFE0
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{54BE78B8-CA72-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	89FC10E2CB7AB510DA04D87C0F7AEFD3	B4E4EEDD2AC44792A3B39B575CB4003939D3C4A4	5D09E993F655B0677598302D974EA4818CC8FCC78EA86F658598BB41DCC2246F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{54BE78B9-CA72-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	516049888E8B5C52F02233A26A12B82A	C1FCA1666768ECDB4322A6D8BF75DCC5779FFB27	27BB535FF5F81F2D54FFA8BF9E857E2D4C718A9C21C16760967AF41E3F745BD9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	B3B2908B4B3C0B33D5B342A3D6B1C7B9	3A8EB78886213E0EB3289A086827CE18854F69FA	2B52D0EB60CA29D2E52B27FA62CC2A500B5107E4E824E7F418DD05544B744BBA
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	34295B5D315D9E4AFE5FFAA0E2C304AA	18A0B34E2E42A37083EF9B88F31071206815BE46	7A54DEBDA454C9A5AB6BCF35A5198B1C9FC5241DCFC9ECCAA02A91B507A88810
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	2CD29925BC10527814B1FBACE1EE2A8C	0325D4B84AC6C49D1C07D72A9924FE1460B582E2	33C88A339688F4108973D656A10034AC14FDF9790F38DC39602E66D235252C05
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	95F5D553E1F68320C667D2E1674AD1A7	4EF03456B8E64D9E7B79985121EBB0BC38181890	D6822DD5314C58FD278DA8A6C482C524EFBE96DCBF70929D9FCD0E5C7BCA0490
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	0C5807E7BA6D0817F64090C9639DF71A	FCF04E379D5CD3F8DDA8CF95051ECF93A8222B97	C31E43186E888BC436BC6DB3AB7AFA15DF09B0B94B00FB3A185C9CFBFFD00550
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	B215EDA330C34F48769CBEA79B0FFAC7	71FC9DDDAAEFF42E0C655AA44EC828E181465FBB	3208740FDA512E7CCBDA768DDCA005C7BCC0A5923A436833391186768045561E
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	7F42728F74E42600479EE58D1B86830C	73606C023254968B03A336B14BC9EC88F8C0D8BC	29D4DF6D141976563F9D4A4CA9EF9CBC50D02265B8E54CC7583A7B2816703038
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	D89231E74B857B3A7413499EF7980381	937941EE61A201563D19D74FFD21CBEE5986D3FD	03544DFF838000E44B1E188C0A83CB612A547EB6F6F7AD46C438DE3BC85376D5
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	344D10CC4814CFBFC9C51AC5EE0CBCE3	181FA834AD87EABAF7E80A1A0253C642FC5A6C50	2C6C35B8271CCF24E190C271D5C88297CC44EDA3DC26D17E5891D206E2959B37
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\KFOlCnqEu92Fr1MmWUlfBBc-[1].woff	Web Open Font Format, TrueType, length 20396, version 1.1	68D6DABFE54E245E7D5D5C16C3C4B1A9	7FDAB895EAEBECEDB3FB5473EAB94A1B292CEF19	A01A632E56731A854F35701AA8C3A6A19A113290D9032FF9048F8064C45383BD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\bootstrap.min[1].js	ASCII text, with very long lines	8C237312864D2E4C4F03544CD4F9B195	253711C6D825DE55A8360552573BE950DA180614	D5FD173D00D9733900834E0E1083DE86B532E048B15C0420BA5C2DB0623644B8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fontawesome-webfont[1].eot	Embedded OpenType (EOT), FontAwesome family	25A32416ABEE198DD821B0B17A198A8F	965CE8F688FEDBEED504EFD498BC9C1622D12362	50BBE9192697E791E2EE4EF73917AEB1B03E727DFF08A1FC8D74F00E4AA812E1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\script-xkd.2[1].js	ASCII text	CE8BC4711C510E94C7D40542ED1CBEAE	B8CCE865F2B6AA5A95072730C8E7FED11B702124	F7C087F29D01DF63F968943C63A8458D578CDA254B1D988D069756AE6A27B1B7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\style-xkd.2[1].css	ASCII text, with very long lines	021E1DF61BB9805D13381529464A34B8	8CE8DA99588630288B762699F1E52B4211C5C892	E3E343F02ABB359B929059100559BE60B2499B0183C7556D9640316B2C31DA9B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bootstrap-4.1.2.min[1].css	ASCII text, with very long lines	88D1B1C0FD447A75E6E60A61CA041AAE	5B0F9FFC6551C19931B78B109438FFBE4DD7B61B	CD5525BC887734465161AF57FEAA4D63C3F5681CB477816B23B6E17D94995707
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\font-awesome-4.6.3.min[1].css	ASCII text, with very long lines	9A11FBA5E34C647BBCB8F8EFE2D791CA	9675BB432A66AE97256734E37C099E1E6B7E0D85	277F19546C365FF5A65F44FA6D7D3278A90EE38320F00D02D6386E728DF5CB42
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\googletrack[1].js	ASCII text, with very long lines	BC93BFF56601B50D782223E1226E3150	90EE62288A01D952A2874CCD4173868D12FF92CD	00F973F96F9FCEBD037F59485A24AC1F3F073D0FB20879DDF445265C7EF77D87
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\login[1].css	assembler source, ASCII text, with very long lines	134E7C6FC37EE08928A8879762F27DC0	F882F653C788F437DCB2C06D1C0E24D43002EE84	B7E5367878F252A70A3EAECD650B0613A9BF53439C6A73FC76213FAB103BAAD9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\password[1].ttf	TrueType Font data, digitally signed, 20 tables, 1st "DSIG", 67 names, Unicode, type 1 string	0BF6C6D477F09BC6C4FB1C371F760B58	6CAF2339FB3F4CEECAE4481B8AAB0418463133AE	5585D482C2EEE6ACBECA5FE3D9FFAAD32B15C5B26995EE345B0208F557571155
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ALTA[1].htm	HTML document, ASCII text	DA8556A286B763705B9EC5446CD08087	782BEA47324771E6E43CD50C859E1E7D32FA34D9	0EC1FEA1E62678B5BDE4BC257DE9623F0914EFC9C919A1C1476BCB39EB073E2A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\KFOmCnqEu92Fr1Mu4mxM[1].woff	Web Open Font Format, TrueType, length 20332, version 1.1	DC3E086FC0C5ADDC09702E111D2ADB42	B1138B84FF19EAC5F43C4202297529D389BD09B7	EA50AC7FDDB61A5CE248A7F8B3A31A98FE16285E076B16E6DA6B4E10910724BB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\analytics[1].js	ASCII text, with very long lines	6DF1787C4BE82D1BB24F8BFFA10C7738	3634E839429E462E49C5F42B75FBFB4BA318AF6D	2CB09C7B3E19BFC41743CA3624EF81C3258D56525647FEAC76AA757E0292627A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery-3.3.1.min[1].js	ASCII text, with very long lines	A09E13EE94D51C524B7E2A728C7D4039	0DC32DB4AA9C5F03F3B38C47D883DBD4FED13AAE	160A426FF2894252CD7CEBBDD6D6B7DA8FCD319C65B70468F10B6690C45D02EF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\outlook-com-logo[1].png	PNG image data, 587 x 115, 8-bit/color RGBA, non-interlaced	978EB8B36E0AD90E4AE655C656A502C2	787292EAB93C8F7F0619E39FE246C35A5A39F4E2	46D011C7A7CFF18C5F4E7C1E005A9BA400A0CE2AF701597150F3AB91A462A5F8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\KFOlCnqEu92Fr1MmSU5fBBc-[1].woff	Web Open Font Format, TrueType, length 20404, version 1.1	BF0F407102FAF3A0B521D3B545F547A5	CA357CD0DE5DD0242E8EFACFB8D24AB60FDC86AB	855A06974032BB69157D469ABA6F63440E8BE47C421F45C3F396F4E0B87B6DE8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\css[1].css	ASCII text	72DA71EACAE9E595F0429770C533F3E7	A4BB90C015F7C573F2B989490E1362412B9194AA	00F13F954125777E8A26FD0E9F6BC730D763E9E59DCFB54D240602665B9B1B43
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\download[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	48B573ECD3BD0C5542F41E04E227A8C3	A42C08149BA98A68D07F892287D094845A2AD643	9B55076EA627C0DB732379566A40673192884E8DF62F25A7EDB1EA4B7EDF5FD2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\paragon-login-background[1].png	PNG image data, 2100 x 1612, 8-bit/color RGB, non-interlaced	0403121CD2F853E130A560A346087AAD	B5B6EA9FF01762D96C585295B32E78828DD07FA0	17CECC18EE875908251A0AB107CC1EC9DD5FE73AF2B759CAA69316F5793C85B9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\paragon-login-bg[1].png	PNG image data, 600 x 461, 8-bit/color RGBA, non-interlaced	1EEBB4FFEA2A4B3B8DAF810FC728FDF3	4A225532CF25483FA24F1E532FFDC33A0769EDC1	1DCAB816CA5EE2317F01C1822391BCF8D8F9FDFAA3E5D776592D6C3CE6E559AF
C:\Users\user\AppData\Local\Temp\~DF35CFB899C4618C4B.TMP	data	E4A1B620F7C48D5A555A3B6109AB9FC5	C9C66A615345989BE6365CC4986CE47E20A0718B	7E029D37AFCA1F8562B6B4A746D450FD9E3BAD66822D4C81B262FC617DD563BD
C:\Users\user\AppData\Local\Temp\~DFD05493EFF0DF9AEE.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
C:\Users\user\AppData\Local\Temp\~DFE2C3B5B1199B26B2.TMP	data	EFB8F1F957B361E62376B5DC1B744665	F4307F6C98A65FB76E31E5248D72EC1578933368	DE9EE1EB5FB07B5E7D6A945B6C9D3B33244CED12D51B89CC290CFF7C78B5ECA3

Analysis Report https://ishift.biz/ALTA/download.html

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs