Windows Analysis Report 0333 - CCFL Seniors Funded Facilities Risk Assessments 20210801.mhtml

Overview

General Information

Sample Name: 0333 - CCFL Seniors Funded Facilities Risk Assessments 20210801.mhtml
Analysis ID: 458967
MD5: 129696ab429a996fba603f5946f20389
SHA1: 8bb06a0a27d7ac48a92576b27abb02eaf1acd21c
SHA256: ff890973cd32878dff5325414d4a6d36e483c828fbda3eaf6f0fa469fbb2d987
Infos:

Most interesting Screenshot:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

No high impact signatures.

Classification

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: msapplication.xml0.0.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x14a50c70,0x01d788ad</date><accdate>0x14a50c70,0x01d788ad</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.0.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x14a50c70,0x01d788ad</date><accdate>0x14a50c70,0x01d788ad</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.0.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x14c40b34,0x01d788ad</date><accdate>0x14c40b34,0x01d788ad</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.0.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x14c40b34,0x01d788ad</date><accdate>0x14c40b34,0x01d788ad</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.0.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x14cb31e9,0x01d788ad</date><accdate>0x14cb31e9,0x01d788ad</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.0.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x14cb31e9,0x01d788ad</date><accdate>0x14cb31e9,0x01d788ad</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml.0.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.0.dr String found in binary or memory: http://www.google.com/
Source: wbk9C9B.tmp.2.dr String found in binary or memory: http://www.healthspace.com/Clients/Common/ReportDefinitions.nsf/RefNum/0333
Source: msapplication.xml2.0.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.0.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.0.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.0.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.0.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.0.dr String found in binary or memory: http://www.youtube.com/
Source: wbk9C9B.tmp.2.dr String found in binary or memory: https://ravens.healthspace.ca/ReportServer?%2FVIHA%2FCCFL%2F0333%20-%20CCFL%20Seniors%20Funded%20Fac
Source: classification engine Classification label: clean0.winMHTML@3/14@0/1
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3F393D3B-F4A0-11EB-90EB-ECF4BBEA1588}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF7AB7A8B365382B36.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' C:\Users\user\Desktop\0333 - CCFL Seniors Funded Facilities Risk Assessments 20210801.mhtml
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6944 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6944 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 458967 Sample: 0333 - CCFL Seniors Funded ... Startdate: 03/08/2021 Architecture: WINDOWS Score: 0 5 iexplore.exe 1 79 2->5         started        dnsIp3 10 192.168.2.1 unknown unknown 5->10 8 iexplore.exe 26 5->8         started        process4
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private
IP
192.168.2.1