Windows Analysis Report https://bit.ly/36R4geg

Overview

General Information

Sample URL: https://bit.ly/36R4geg
Analysis ID: 452248
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Yara detected HtmlPhish10
Yara detected HtmlPhish20
Yara detected HtmlPhish7
HTML body contains low number of good links
HTML title does not match URL

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: 91064.pages.csv, type: HTML
Yara detected HtmlPhish20
Source: Yara match File source: 91064.pages.csv, type: HTML
Yara detected HtmlPhish7
Source: Yara match File source: 91064.pages.csv, type: HTML
HTML body contains low number of good links
Source: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html HTTP Parser: Number of links: 0
Source: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html HTTP Parser: Title: OneDrive does not match URL
Source: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html HTTP Parser: Title: OneDrive does not match URL
Source: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html HTTP Parser: No <meta name="author".. found
Source: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html HTTP Parser: No <meta name="author".. found
Source: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html HTTP Parser: No <meta name="copyright".. found
Source: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: 77EC63BDA74BD0D0E0426DC8F8008506.2.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 4D1ED785E3365DE6C966A82E99CCE8EA_216A6C169356295AB09C26D4D7D32E06.2.dr String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmA
Source: EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619.2.dr String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1Jg
Source: Reporting and NEL.2.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=MbcbACeFNaWE4YV%2BykWD0gB3iJJHvKwAPMyQiabpM5amD11my0Ie4KnT4
Source: Reporting and NEL.2.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=dHIXOSbGMDcOwB2fAOoN5NcuMuOuNz30wa1E8VIpk7jLo372EcDJJtQSKGm
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, manifest.json0.0.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://accounts.google.com
Source: d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://ajax.googleapis.com
Source: 4b604237260d4090_0.0.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: bd8ed83d42d2a190_0.0.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.jsa
Source: bd8ed83d42d2a190_0.0.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.jsaD
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, manifest.json0.0.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://apis.google.com
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://bit.ly
Source: Current Session.0.dr, History.0.dr String found in binary or memory: https://bit.ly/36R4geg
Source: History Provider Cache.0.dr String found in binary or memory: https://bit.ly/36R4geg2
Source: History.0.dr String found in binary or memory: https://bit.ly/36R4gegOneDrive
Source: History.0.dr String found in binary or memory: https://bit.ly/36R4gegOneDrive/&H
Source: Current Session.0.dr String found in binary or memory: https://bit.ly/36R4gegf
Source: d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://cdnjs.cloudflare.com
Source: 5fcb4d810f618d50_0.0.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json1.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://code.jquery.com
Source: 738dbc06345f3eb5_0.0.dr String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://content-autofill.googleapis.com
Source: manifest.json0.0.dr String found in binary or memory: https://content.googleapis.com
Source: Reporting and NEL.2.dr, Reporting and NEL-journal.2.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/downloads-lorry
Source: 678ba568-9573-46ef-8f00-5dab3911804e.tmp.2.dr, 19773482-ac05-4b09-bb32-a94b97d13bef.tmp.2.dr, 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://dns.google
Source: manifest.json0.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: manifest.json0.0.dr String found in binary or memory: https://hangouts.google.com/
Source: d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com
Source: bcd50c0593d29b4f_0.0.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://ogs.google.com
Source: manifest.json1.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://r2---sn-h0jeener.gvt1.com
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json1.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://ssl.gstatic.com
Source: d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://stackpath.bootstrapcdn.com
Source: a616bab70880d4b1_0.0.dr String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://storage.googleapis.com
Source: 4b604237260d4090_0.0.dr String found in binary or memory: https://storage.googleapis.com/
Source: bcd50c0593d29b4f_0.0.dr String found in binary or memory: https://storage.googleapis.com/Z
Source: Current Session.0.dr String found in binary or memory: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html
Source: History Provider Cache.0.dr String found in binary or memory: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.html2
Source: History.0.dr String found in binary or memory: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.htmlOneDrive
Source: History.0.dr String found in binary or memory: https://storage.googleapis.com/nkt4knn4knknk.appspot.com/17004.htmlOneDrive/&H
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://use.fontawesome.com
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, manifest.json0.0.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://www.google.com
Source: manifest.json1.0.dr String found in binary or memory: https://www.google.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.google.com;
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 177d27af-e0c3-44ae-b962-7f5571fdcaab.tmp.2.dr, 14b44e13-d048-4924-b6fa-8c63dc0a1883.tmp.2.dr, d03ae835-d26c-40c4-9108-d1b71d0fb9b7.tmp.2.dr String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.134.120:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: classification engine Classification label: mal72.phis.win@35/229@12/12
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60F92F41-300.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\dc43c9f8-0d71-4e30-b8ce-0de9add1ab74.tmp Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://bit.ly/36R4geg'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,13602693734026748389,18434443092193835822,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1720 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1544,13602693734026748389,18434443092193835822,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4720 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,13602693734026748389,18434443092193835822,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1720 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1544,13602693734026748389,18434443092193835822,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4720 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 452248 URL: https://bit.ly/36R4geg Startdate: 22/07/2021 Architecture: WINDOWS Score: 72 15 s3.amazonaws.com 2->15 27 Antivirus detection for URL or domain 2->27 29 Yara detected HtmlPhish20 2->29 31 Yara detected HtmlPhish10 2->31 33 Yara detected HtmlPhish7 2->33 7 chrome.exe 14 501 2->7         started        signatures3 process4 dnsIp5 17 192.168.2.1 unknown unknown 7->17 19 239.255.255.250 unknown Reserved 7->19 10 chrome.exe 40 7->10         started        13 chrome.exe 7->13         started        process6 dnsIp7 21 142.250.185.238, 443, 64363 GOOGLEUS United States 10->21 23 gstaticadssl.l.google.com 142.250.186.67, 443, 49734 GOOGLEUS United States 10->23 25 13 other IPs or domains 10->25
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.186.67
 gstaticadssl.l.google.com United States
15169 GOOGLEUS false
142.250.203.110
 clients.l.google.com United States
15169 GOOGLEUS false
142.250.185.238
 unknown United States
15169 GOOGLEUS false
104.18.11.207
 stackpath.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
52.217.134.120
 s3.amazonaws.com United States
16509 AMAZON-02US false
172.217.168.45
 accounts.google.com United States
15169 GOOGLEUS false
142.250.203.97
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
104.16.18.94
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false
67.199.248.11
 bit.ly United States
396982 GOOGLE-PRIVATE-CLOUDUS false

Private
IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
gstaticadssl.l.google.com 142.250.186.67 true
stackpath.bootstrapcdn.com 104.18.11.207 true
s3.amazonaws.com 52.217.134.120 true
accounts.google.com 172.217.168.45 true
bit.ly 67.199.248.11 true
cdnjs.cloudflare.com 104.16.18.94 true
maxcdn.bootstrapcdn.com 104.18.11.207 true
clients.l.google.com 142.250.203.110 true
googlehosted.l.googleusercontent.com 142.250.203.97 true
use.fontawesome.com unknown unknown
clients2.googleusercontent.com unknown unknown
clients2.google.com unknown unknown
code.jquery.com unknown unknown