Windows Analysis Report heather.simpson@brmsonline.com #Ud83d#Udce0LUK08HIDGB019153.HTM

Overview

General Information

Sample Name: heather.simpson@brmsonline.com #Ud83d#Udce0LUK08HIDGB019153.HTM
Analysis ID: 458976
MD5: 7b3a79f2dffc3c722e80e72c881975af
SHA1: 475a899dad6a31ff3dafba067505435639a573b3
SHA256: 8e98f2ecc66be9b8ebfda7962ddd9dccdeb01bec9e52fab8127b6233dc6b9b41
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish10
Yara detected HtmlPhish44
Phishing site detected (based on logo template match)
HTML body contains low number of good links
IP address seen in connection with other malware
Invalid T&C link found
JA3 SSL client fingerprint seen in connection with other malware
No HTML title found
None HTTPS page querying sensitive user data (password, username or email)

Classification

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: 36433.0.pages.csv, type: HTML
Yara detected HtmlPhish44
Source: Yara match File source: heather.simpson@brmsonline.com #Ud83d#Udce0LUK08HIDGB019153.HTM, type: SAMPLE
Phishing site detected (based on logo template match)
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM Matcher: Template: microsoft matched
HTML body contains low number of good links
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: Number of links: 0
Invalid T&C link found
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: Invalid link: Terms of Use
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: Invalid link: Privacy & Cookies
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: Invalid link: Terms of Use
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: Invalid link: Privacy & Cookies
No HTML title found
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: HTML title missing
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\7092_545289250\LICENSE.txt Jump to behavior
Source: unknown HTTPS traffic detected: 104.26.6.182:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 63.32.159.255:443 -> 192.168.2.4:49829 version: TLS 1.2

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.16.123.175 104.16.123.175
Source: Joe Sandbox View IP Address: 40.90.142.230 40.90.142.230
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: b32309a26951912be7dba376398abc3b
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: Ruleset Data.1.dr String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Ruleset Data.1.dr String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: unknown DNS traffic detected: queries for: accounts.google.com
Source: 77EC63BDA74BD0D0E0426DC8F8008506.3.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://1drv.ms
Source: History.1.dr String found in binary or memory: https://1drv.ms/b/s
Source: Reporting and NEL.3.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=UQ9Av6hVKF4bYSqO5helmUyNV4mgGMZumQz%2FX3JsUozHkHkqujvL2qca2
Source: manifest.json0.1.dr, 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://accounts.google.com
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr String found in binary or memory: https://amcdn.msftauth.net
Source: 2ba61d985b6f3119_0.1.dr String found in binary or memory: https://amcdn.msftauth.net/me?partner=ShellDocuments&version=10.21153.1&market=en-GB&wrapperId=suite
Source: manifest.json0.1.dr, 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://apis.google.com
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr String found in binary or memory: https://az725175.vo.msecnd.net
Source: 90968034e12632ef_0.1.dr String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json0.1.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.1.dr String found in binary or memory: https://content.googleapis.com
Source: Reporting and NEL.3.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: 60afc150-0016-4c0b-bf82-62efe9fded76.tmp.3.dr, 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, 7b92363c-82db-4237-b81a-ae8cb035e027.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://dns.google
Source: manifest.json0.1.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.1.dr String found in binary or memory: https://fonts.googleapis.com;
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.1.dr String found in binary or memory: https://fonts.gstatic.com;
Source: manifest.json0.1.dr String found in binary or memory: https://hangouts.google.com/
Source: c792b594b1b0a66c_0.1.dr, c36f97f4732746c1_0.1.dr, f77b813e26b8bc3a_0.1.dr String found in binary or memory: https://live.com/
Source: 983703a0c97e821c_0.1.dr String found in binary or memory: https://live.com/#
Source: cac0e09f16a13db3_0.1.dr String found in binary or memory: https://live.com/(MD
Source: 68fce5297bd0458d_0.1.dr String found in binary or memory: https://live.com/-I
Source: 8e7db8d5a6e4e063_0.1.dr String found in binary or memory: https://live.com/-z
Source: 3f177ee38fc6ce45_0.1.dr String found in binary or memory: https://live.com/4S
Source: 2ba61d985b6f3119_0.1.dr String found in binary or memory: https://live.com/5
Source: ad0003c742b0d065_0.1.dr String found in binary or memory: https://live.com/:
Source: 48961c54794d25bb_0.1.dr String found in binary or memory: https://live.com/B
Source: df3404d771e5f26d_0.1.dr String found in binary or memory: https://live.com/L
Source: 58407beacb590573_0.1.dr String found in binary or memory: https://live.com/M
Source: 7aa921112547ca13_0.1.dr String found in binary or memory: https://live.com/QM
Source: a9cd4f01fcad9f21_0.1.dr String found in binary or memory: https://live.com/WR
Source: 6a16f5d3581dc290_0.1.dr String found in binary or memory: https://live.com/WiG
Source: c9ca51d67fb706ff_0.1.dr String found in binary or memory: https://live.com/fs
Source: dbe00ca633e55920_0.1.dr String found in binary or memory: https://live.com/i
Source: a508e0ff9d9fccf8_0.1.dr String found in binary or memory: https://live.com/j
Source: 93e761951402bb85_0.1.dr String found in binary or memory: https://live.com/v
Source: 87218292e46bb229_0.1.dr String found in binary or memory: https://live.com/z$1
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://loading.io
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://ogs.google.com
Source: 000003.log6.1.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://onedrive.live.com
Source: QuotaManager.1.dr, 000003.log0.1.dr String found in binary or memory: https://onedrive.live.com/
Source: QuotaManager.1.dr String found in binary or memory: https://onedrive.live.com//
Source: Favicons.1.dr, History.1.dr String found in binary or memory: https://onedrive.live.com/?authkey=%21ACvrKNGiuX1SBRI&cid=88683D2BDCA1F06B&id=88683D2BDCA1F06B%21107
Source: History.1.dr, Current Session.1.dr String found in binary or memory: https://onedrive.live.com/?cid=88683d2bdca1f06b&id=88683D2BDCA1F06B%21107&authkey=%21ACvrKNGiuX1SBRI
Source: Current Session.1.dr String found in binary or memory: https://onedrive.live.com/?cid=88683d2bdca1f06b&id=88683D2BDCA1F06B%21107&ithint=file
Source: Current Session.1.dr String found in binary or memory: https://onedrive.live.com/redir?resid=88683D2BDCA1F06B
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://p.sfx.ms
Source: Favicons.1.dr String found in binary or memory: https://p.sfx.ms/images/favicon.ico
Source: manifest.json.1.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://play.google.com
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.1.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://shell.cdn.office.net
Source: 5f80e804e486b521_0.1.dr String found in binary or memory: https://shell.cdn.office.net/shellux/o365/versionless/suiteux.shell.chat.55db018a067486c0dfbf.js
Source: 3d511b0115a8f7f3_0.1.dr String found in binary or memory: https://shell.cdn.office.net/shellux/o365/versionless/suiteux.shell.consappdata.4aa98e1d857405dbd579
Source: f7a34ad4911dc3cd_0.1.dr String found in binary or memory: https://shell.cdn.office.net/shellux/o365/versionless/suiteux.shell.core.9153ee7880d440d8ba50.js
Source: c36f97f4732746c1_0.1.dr String found in binary or memory: https://shell.cdn.office.net/shellux/o365/versionless/suiteux.shell.plus.79877b1c329c6af6c93d.js
Source: 3f177ee38fc6ce45_0.1.dr String found in binary or memory: https://shell.cdn.office.net/shellux/o365/versionless/suiteux.shell.responsive.f5e3127f4d1a10713230.
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://shellprod.msocdn.com
Source: 8d9c18276a76f291_0.1.dr String found in binary or memory: https://shellprod.msocdn.com/api/shellbootstrapper/consumer/oneshell?noext
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://skyapi.onedrive.live.com
Source: Current Session.1.dr String found in binary or memory: https://skyapi.onedrive.live.com/xmlproxy.htm?domain=live.com
Source: a8a6d6200524c59b_0.1.dr String found in binary or memory: https://skyapi.onedrive.live.com/xmlproxy.js?.
Source: f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://spoprod-a.akamaihd.net
Source: 91f76f1c5e95bc60_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/
Source: db42e74f7a3543b3_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/0.chunk.js
Source: 7aa921112547ca13_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/120.chunk.js
Source: e89abd2875f04f6a_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/135.chunk.js
Source: 8e7db8d5a6e4e063_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/146.chunk.js
Source: dbe00ca633e55920_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/157.chunk.js
Source: 9704f4e331360c38_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/160.chunk.js
Source: 93f87431c3776cea_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/183.chunk.js
Source: 68fce5297bd0458d_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/185.chunk.js
Source: f4a0d5b103688b43_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/186.chunk.js
Source: e878504d08964d5e_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/187.chunk.js
Source: 57032c12778cedd5_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/191.chunk.js
Source: dcba28b9219ac2b1_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/194.chunk.js
Source: a69e7c7fcdc10f64_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/195.chunk.js
Source: eb1638e21105ba53_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/196.chunk.js
Source: e4d062890cc0187b_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/198.chunk.js
Source: 8c1378b73cbdd8f7_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/202.chunk.js
Source: 95aef4953674c7da_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/205.chunk.js
Source: 58407beacb590573_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/206.chunk.js
Source: df3404d771e5f26d_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/207.chunk.js
Source: c792b594b1b0a66c_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/208.chunk.js
Source: 39f438551abfe01a_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/214.chunk.js
Source: d73da2367884c043_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/225.chunk.js
Source: e71ca96ff988b03e_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/247.chunk.js
Source: b80de8e4091312c9_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/248.chunk.js
Source: 74771480d89f5477_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/258.chunk.js
Source: 404787dce53ce5e5_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/259.chunk.js
Source: 6a16f5d3581dc290_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/260.chunk.js
Source: d56533f87b5085b7_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/279.chunk.js
Source: 48961c54794d25bb_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/282.chunk.js
Source: 73dc0f1e14da33dc_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/283.chunk.js
Source: 6802ab3056071f2f_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/284.chunk.js
Source: 327e70df27d59d1d_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/286.chunk.js
Source: 983703a0c97e821c_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/287.chunk.js
Source: 87218292e46bb229_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/288.chunk.js
Source: 93e761951402bb85_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/290.chunk.js
Source: e54cb0c04ff4f570_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/309.chunk.js
Source: d5b69e1aff4b88e3_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/342.chunk.js
Source: 59faf56ef1e335d0_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/344.chunk.js
Source: cac0e09f16a13db3_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/346.chunk.js
Source: 9252283850e1ef4e_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/349.chunk.js
Source: d7b671d371a1843d_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/354.chunk.js
Source: 9789823839c0dd73_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/356.chunk.js
Source: c9087256c0e2d0dc_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/362.chunk.js
Source: 45730cb29de3a138_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/382.chunk.js
Source: 6d4f8d5b77d688b1_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/71.chunk.js
Source: ad0003c742b0d065_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/75.chunk.js
Source: 353e5c77fa043d0b_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/98.chunk.js
Source: 8d2606efb3bde082_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/deferred.chun
Source: cd8973a874463c07_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/deferred.odsp
Source: a508e0ff9d9fccf8_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/deferred.offi
Source: db3981b7b22f9078_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/en-gb/deferre
Source: 3c946357cde708ac_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/en-gb/ondeman
Source: c0cc2e6bb805a10d_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/en-gb/plt.res
Source: c9ca51d67fb706ff_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/odconedrive.j
Source: 693d750eba5ed7f9_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/plt.items-vie
Source: 133541474331a921_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/plt.odsp-comm
Source: a9cd4f01fcad9f21_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/plt.office-ui
Source: f77b813e26b8bc3a_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-web-prod_2021-07-16.003/nextwebpack.manifest/plt.react.chu
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://ssl.gstatic.com
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://static2.sharepointonline.com
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr String found in binary or memory: https://storage.live.com
Source: messages.json83.1.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json83.1.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://unpkg.com
Source: manifest.json0.1.dr, 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr String found in binary or memory: https://www.google.com/
Source: manifest.json0.1.dr String found in binary or memory: https://www.google.com;
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 7ba53f06-69be-4eb4-8a68-90477cc06d9b.tmp.3.dr, 1c044859-d655-4799-9284-8938d8ed1acd.tmp.3.dr, f7e5a43b-a088-4c60-b3de-59ca3a6022e7.tmp.3.dr String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.1.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 104.26.6.182:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 63.32.159.255:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: classification engine Classification label: mal60.phis.winHTM@40/307@30/14
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6109B8D7-1BB4.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\0dc8ff0d-6fb1-4182-b184-ac56aee97d5f.tmp Jump to behavior
Source: QuotaManager-journal.1.dr Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'C:\Users\user\Desktop\heather.simpson@brmsonline.com #Ud83d#Udce0LUK08HIDGB019153.HTM'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,13064197192390813916,61693579399129369,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1664 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,13064197192390813916,61693579399129369,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1664 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\7092_545289250\LICENSE.txt Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 458976 Sample: heather.simpson@brmsonline.... Startdate: 03/08/2021 Architecture: WINDOWS Score: 60 13 storage.live.com 2->13 15 spoprod-a.akamaihd.net 2->15 17 9 other IPs or domains 2->17 29 Yara detected HtmlPhish44 2->29 31 Yara detected HtmlPhish10 2->31 33 Phishing site detected (based on logo template match) 2->33 7 chrome.exe 14 501 2->7         started        signatures3 process4 dnsIp5 19 192.168.2.1 unknown unknown 7->19 21 239.255.255.250 unknown Reserved 7->21 10 chrome.exe 57 7->10         started        process6 dnsIp7 23 i-am3p-cor006.api.p001.1drv.com 13.104.158.180, 443, 49819 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 10->23 25 i-am3p-cor001.api.p001.1drv.com 40.90.142.230, 443, 49807, 49808 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 10->25 27 40 other IPs or domains 10->27
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
216.58.208.161
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
13.104.158.180
 i-am3p-cor006.api.p001.1drv.com United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
216.58.205.66
 adservice.google.com United States
15169 GOOGLEUS false
104.16.123.175
 unpkg.com United States
13335 CLOUDFLARENETUS false
104.26.6.182
 loading.io United States
13335 CLOUDFLARENETUS false
216.58.208.174
 clients.l.google.com United States
15169 GOOGLEUS false
40.90.142.230
 i-am3p-cor001.api.p001.1drv.com United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
216.58.205.77
 accounts.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
63.32.159.255
 dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com United States
16509 AMAZON-02US false
172.217.21.66
 pagead46.l.doubleclick.net United States
15169 GOOGLEUS false
142.250.186.102
 dart.l.doubleclick.net United States
15169 GOOGLEUS false

Private
IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
i-am3p-cor001.api.p001.1drv.com 40.90.142.230 true
dart.l.doubleclick.net 142.250.186.102 true
pagead46.l.doubleclick.net 172.217.21.66 true
accounts.google.com 216.58.205.77 true
dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com 63.32.159.255 true
loading.io 104.26.6.182 true
i-am3p-cor002.api.p001.1drv.com 40.90.142.226 true
adservice.google.com 216.58.205.66 true
1drv.ms 13.107.42.12 true
i-am3p-cor006.api.p001.1drv.com 13.104.158.180 true
clients.l.google.com 216.58.208.174 true
unpkg.com 104.16.123.175 true
googlehosted.l.googleusercontent.com 216.58.208.161 true
ad.doubleclick.net unknown unknown
by3302files.storage.live.com unknown unknown
shellprod.msocdn.com unknown unknown
storage.live.com unknown unknown
adservice.google.de unknown unknown
skyapi.onedrive.live.com unknown unknown
firebasestorage.s.com unknown unknown
clients2.googleusercontent.com unknown unknown
static2.sharepointonline.com unknown unknown
clients2.google.com unknown unknown
secure.aadcdn.microsoftonline-p.com unknown unknown
code.jquery.com unknown unknown
onedrive.live.com unknown unknown
nuph0g.by.files.1drv.com unknown unknown
api.onedrive.com unknown unknown
p.sfx.ms unknown unknown
amcdn.msftauth.net unknown unknown
spoprod-a.akamaihd.net unknown unknown
dpm.demdex.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
file:///C:/Users/user/Desktop/heather.simpson@brmsonline.com%20%23Ud83d%23Udce0LUK08HIDGB019153.HTM true
    		low
    https://onedrive.live.com/?cid=88683d2bdca1f06b&id=88683D2BDCA1F06B%21107&authkey=%21ACvrKNGiuX1SBRI false
      		high
      https://onedrive.live.com/?authkey=%21ACvrKNGiuX1SBRI&cid=88683D2BDCA1F06B&id=88683D2BDCA1F06B%21107&parId=88683D2BDCA1F06B%21106&o=OneUp false
        		high