Windows Analysis Report 26222021 114007 a.m. Owa Outlook App.html

Overview

General Information

Sample Name: 26222021 114007 a.m. Owa Outlook App.html
Analysis ID: 491437
MD5: efa08de227c06d13162b994472142102
SHA1: 195d8bd6d84fd8da5208ed91ee578fd8feab7f5c
SHA256: 21e1b3843d882911bc6fc1ba3b991060562d0ab228ff298d4c8c87ae582bf333
Infos:

Most interesting Screenshot:

Detection

Outlook Phishing HTMLPhisher
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish10
Yara detected Outlook Phishing page
IP address seen in connection with other malware

Classification

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: 26222021 114007 a.m. Owa Outlook App.html, type: SAMPLE
Yara detected Outlook Phishing page
Source: Yara match File source: 26222021 114007 a.m. Owa Outlook App.html, type: SAMPLE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.18.11.207 104.18.11.207
Source: unknown DNS traffic detected: queries for: accounts.google.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: global traffic HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /slageris.lv HTTP/1.1Host: logo.clearbit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /owa/auth/15.0.1497/themes/resources/favicon.ico HTTP/1.1Host: mail.borets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8Content-Length: 1Connection: closeDate: Mon, 27 Sep 2021 13:37:59 GMTx-content-type-options: nosniffServer: envoyX-Cache: Error from cloudfrontVia: 1.1 240ebea27618238384903016b8e84169.cloudfront.net (CloudFront)X-Amz-Cf-Pop: MXP63-P1X-Amz-Cf-Id: htvAx_nwdIX-i7MEi-8xETDTFGiCzgrjvV47ETf0gXu7ajAAUUlD8Q==
Source: Reporting and NEL.1.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=Sii3wCioA2UnbNBFXBnWznYP62RcZaAY30C1%2B95RV3ihxEDo%2FxTh9mh
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr String found in binary or memory: https://ajax.googleapis.com
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://bigmonkey.xyz/aruba2/processor.php
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: Reporting and NEL.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: Reporting and NEL.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: 5421334c-1056-4c48-b50f-719b716521d0.tmp.1.dr, 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://dns.google
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://logo.clearbit.com/slageris.lv
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://mail.borets.com/owa/
Source: 26222021 114007 a.m. Owa Outlook App.html, Favicons.0.dr String found in binary or memory: https://mail.borets.com/owa/auth/15.0.1497/themes/resources/favicon.ico
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://mail.borets.com/owa/auth/15.0.1497/themes/resources/segoeui-regular.eot?#iefix
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://mail.borets.com/owa/auth/15.0.1497/themes/resources/segoeui-regular.ttf
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://mail.borets.com/owa/auth/15.0.1497/themes/resources/segoeui-semibold.eot?#iefix
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://mail.borets.com/owa/auth/15.0.1497/themes/resources/segoeui-semibold.ttf
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://mail.borets.com/owa/auth/15.0.1497/themes/resources/segoeui-semilight.eot?#iefix
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://mail.borets.com/owa/auth/15.0.1497/themes/resources/segoeui-semilight.ttf
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr String found in binary or memory: https://r1---sn-1gi7znes.gvt1.com
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: 26222021 114007 a.m. Owa Outlook App.html String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://www.google.com
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: 0ef202ba-9601-451a-bbb7-b36c9773b379.tmp.1.dr, 25abaca1-f42a-4692-96cb-088faeb5696f.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\chrome_BITS_3560_1941343343 Jump to behavior
Source: classification engine Classification label: mal52.phis.winHTML@8/78@8/10
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'C:\Users\user\Desktop\26222021 114007 a.m. Owa Outlook App.html'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,11094347611715134829,13990568648629289274,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1708 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,11094347611715134829,13990568648629289274,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1708 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-615247C5-DE8.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 491437 Sample: 26222021 114007 a.m. Owa Ou... Startdate: 27/09/2021 Architecture: WINDOWS Score: 52 24 Yara detected HtmlPhish10 2->24 26 Yara detected Outlook Phishing page 2->26 6 chrome.exe 10 58 2->6         started        process3 dnsIp4 12 192.168.2.1 unknown unknown 6->12 14 192.168.2.22 unknown unknown 6->14 16 3 other IPs or domains 6->16 9 chrome.exe 18 6->9         started        process5 dnsIp6 18 d26p066pn2w0s0.cloudfront.net 18.66.196.75, 443, 49740 MIT-GATEWAYSUS United States 9->18 20 accounts.google.com 172.217.168.13, 443, 49736 GOOGLEUS United States 9->20 22 8 other IPs or domains 9->22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
18.66.196.75
 d26p066pn2w0s0.cloudfront.net United States
3 MIT-GATEWAYSUS false
98.164.36.69
 mail.borets.com United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
172.217.168.13
 accounts.google.com United States
15169 GOOGLEUS false
104.18.11.207
 stackpath.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
104.16.19.94
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false

Private
IP
192.168.2.1
192.168.2.7
192.168.2.22
192.168.2.23

Contacted Domains

Name IP Active
stackpath.bootstrapcdn.com 104.18.11.207 true
d26p066pn2w0s0.cloudfront.net 18.66.196.75 true
accounts.google.com 172.217.168.13 true
cdnjs.cloudflare.com 104.16.19.94 true
mail.borets.com 98.164.36.69 true
maxcdn.bootstrapcdn.com 104.18.11.207 true
clients.l.google.com 172.217.168.78 true
clients2.google.com unknown unknown
code.jquery.com unknown unknown
logo.clearbit.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
    		high
    https://logo.clearbit.com/slageris.lv false
      		high
      https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js false
        		high
        https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js false
          		high
          https://mail.borets.com/owa/auth/15.0.1497/themes/resources/favicon.ico false
          • Avira URL Cloud: safe
          		 unknown
          https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js false
            		high