Windows Analysis Report https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fwww.ismyrotaryclub.org%2f%2fClick%2f%3f_uid%3d800004603%26_ctid%3d1972187%26redirect%3dhttps%3a%2f%2f1n0w8.codesandbox.io%2f%3faf%3dam1lcmNpZXJAbXVyZXhsdGQuY29t&c=E,1,33KLss3YzRWhFedSrTUVgatC3BBMx2L-L4e7_qZWgR8ttsvQZbCsR6smducdjsRz-uGYCcQc5RJAZdgfM9YfGqlADpHhdxTFS_EgtztnR08wn2_60sAU2Wi-&typo=1

Overview

General Information

Sample URL:	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fwww.ismyrotaryclub.org%2f%2fClick%2f%3f_uid%3d800004603%26_ctid%3d1972187%26redirect%3dhttps%3a%2f%2f1n0w8.codesandbox.io%2f%3faf%3dam1lcmNpZXJAbXVyZXhsdGQuY29t&c=E,1,33KLss3YzRWhFedSrTUVgatC3BBMx2L-L4e7_qZWgR8ttsvQZbCsR6smducdjsRz-uGYCcQc5RJAZdgfM9YfGqlADpHhdxTFS_EgtztnR08wn2_60sAU2Wi-&typo=1
Analysis ID:	510504
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Phishing site detected (based on logo template match)

Invalid 'forgot password' link found

HTML body contains low number of good links

HTML title does not match URL

Invalid T&C link found

Classification

Signatures

AV Detection:

Antivirus detection for URL or domain

Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://www.ismyrotaryclub.org//Click/?_uid=800004603&_ctid=1972187&redirect=https://1n0w8.codesandbox.io/?af=am1lcmNpZXJAbXVyZXhsdGQuY29t	Avira URL Cloud: Label: phishing

Phishing:

Yara detected HtmlPhish10

Source: Yara match	File source: 016477.pages.csv, type: HTML
Source: Yara match	File source: 016477.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\index[1].htm, type: DROPPED

Phishing site detected (based on logo template match)

Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com

Matcher: Template: microsoft matched

Invalid 'forgot password' link found

Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Invalid link: Forgot my password
Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Invalid link: Forgot my password

HTML body contains low number of good links

Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Number of links: 0
Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Title: Sign in to Outlook does not match URL

Invalid T&C link found

Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Invalid link: Terms of use
Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Invalid link: Privacy & cookies
Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Invalid link: Terms of use
Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: Invalid link: Privacy & cookies

Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: No <meta name="author".. found
Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: No <meta name="author".. found

Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: No <meta name="copyright".. found
Source: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 18.192.226.97:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.192.226.97:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.175.102.136:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.175.102.136:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.95.148.134:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.95.148.134:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.3:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.3:49753 version: TLS 1.2

Source: unknown

DNS traffic detected: queries for: linkprotect.cudasvc.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: global traffic	HTTP traffic detected: GET /url?a=https%3a%2f%2fwww.ismyrotaryclub.org%2f%2fClick%2f%3f_uid%3d800004603%26_ctid%3d1972187%26redirect%3dhttps%3a%2f%2f1n0w8.codesandbox.io%2f%3faf%3dam1lcmNpZXJAbXVyZXhsdGQuY29t&c=E,1,33KLss3YzRWhFedSrTUVgatC3BBMx2L-L4e7_qZWgR8ttsvQZbCsR6smducdjsRz-uGYCcQc5RJAZdgfM9YfGqlADpHhdxTFS_EgtztnR08wn2_60sAU2Wi-&typo=1 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: linkprotect.cudasvc.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //Click/?_uid=800004603&_ctid=1972187&redirect=https://1n0w8.codesandbox.io/?af=am1lcmNpZXJAbXVyZXhsdGQuY29t HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.ismyrotaryclub.org
Source: global traffic	HTTP traffic detected: GET /?af=am1lcmNpZXJAbXVyZXhsdGQuY29t HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: 1n0w8.codesandbox.io
Source: global traffic	HTTP traffic detected: GET /public/sse-hooks/sse-hooks.f648b14c15c640a14a557113a991cb8d.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://1n0w8.codesandbox.io/?af=am1lcmNpZXJAbXVyZXhsdGQuY29tAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: codesandbox.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /static/js/banner.be879265d.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://1n0w8.codesandbox.io/?af=am1lcmNpZXJAbXVyZXhsdGQuY29tAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: codesandbox.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /beacon.min.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://1n0w8.codesandbox.io/?af=am1lcmNpZXJAbXVyZXhsdGQuY29tAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.cloudflareinsights.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /index.html HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Referer: https://1n0w8.codesandbox.io/?af=am1lcmNpZXJAbXVyZXhsdGQuY29tAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.htmlAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoOrigin: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.comAccept-Encoding: gzip, deflateHost: cdnjs.cloudflare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.comConnection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 Forbiddenx-amz-request-id: 6X6C9PT58WZJWXD9x-amz-id-2: oSJptkmAodk2dxbT6ds5z/3J/ijJqaA6r1XZl0CgdI9fpM5nGl1fDjUczSKMbYhKdA9B8vaLmMw=Content-Type: application/xmlTransfer-Encoding: chunkedDate: Wed, 27 Oct 2021 18:57:29 GMTServer: AmazonS3Connection: close

Source: {26C0008E-37A3-11EC-90E9-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://1n0w8.codesandbox.io/?af=am1lcmNpZXJAbXVyZXhsdGQuY29t
Source: index[1].htm.3.dr	String found in binary or memory: https://beatitbar.com/wp-content/plugins/fatboyoffice/call.php?u=
Source: index[1].htm.3.dr	String found in binary or memory: https://beatitbar.com/wp-content/plugins/fatboyoffice/clearbit.php?d=
Source: index[1].htm.3.dr	String found in binary or memory: https://beatitbar.com/wp-content/plugins/fatboyoffice/rcform.php
Source: index[1].htm.3.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Source: banner.be879265d[1].js.3.dr	String found in binary or memory: https://codesandbox.io/
Source: DFGA14QX.htm.3.dr	String found in binary or memory: https://codesandbox.io/public/sse-hooks/sse-hooks.f648b14c15c640a14a557113a991cb8d.js
Source: DFGA14QX.htm.3.dr	String found in binary or memory: https://codesandbox.io/static/js/banner.be879265d.js
Source: {26C0008E-37A3-11EC-90E9-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html
Source: DFGA14QX.htm.3.dr	String found in binary or memory: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#
Source: {26C0008E-37A3-11EC-90E9-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier
Source: ~DF75153F92E31AE6D4.TMP.2.dr, {26C0008E-37A3-11EC-90E9-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#mercier
Source: {26C0008E-37A3-11EC-90E9-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html:
Source: index[1].htm.3.dr	String found in binary or memory: https://portal.office.com/servicestatus
Source: DFGA14QX.htm.3.dr	String found in binary or memory: https://static.cloudflareinsights.com/beacon.min.js

Source: unknown	HTTPS traffic detected: 18.192.226.97:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.192.226.97:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.175.102.136:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.175.102.136:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.95.148.134:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.95.148.134:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.3:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.3:49753 version: TLS 1.2

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFF890F1947A547B5C.TMP

Jump to behavior

Source: classification engine

Classification label: mal60.phis.win@3/12@8/6

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6688 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6688 CREDAT:17410 /prefetch:2	Jump to behavior

Source: https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fwww.ismyrotaryclub.org%2f%2fClick%2f%3f_uid%3d800004603%26_ctid%3d1972187%26redirect%3dhttps%3a%2f%2f1n0w8.codesandbox.io%2f%3faf%3dam1lcmNpZXJAbXVyZXhsdGQuY29t&c=E,1,33KLss3YzRWhFedSrTUVgatC3BBMx2L-L4e7_qZWgR8ttsvQZbCsR6smducdjsRz-uGYCcQc5RJAZdgfM9YfGqlADpHhdxTFS_EgtztnR08wn2_60sAU2Wi-&typo=1

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
184.175.102.136	ismyrotaryclub.org	United States	7393	CYBERCONUS	false
104.18.22.207	1n0w8.codesandbox.io	United States	13335	CLOUDFLARENETUS	false
52.95.148.134	s3-r-w.eu-west-2.amazonaws.com	United States	16509	AMAZON-02US	false
18.192.226.97	linkprotect.cudasvc.com	United States	16509	AMAZON-02US	false
104.16.18.94	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.16.95.65	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
1n0w8.codesandbox.io	104.18.22.207	true
static.cloudflareinsights.com	104.16.95.65	true
codesandbox.io	104.18.22.207	true
cdnjs.cloudflare.com	104.16.18.94	true
ismyrotaryclub.org	184.175.102.136	true
s3-r-w.eu-west-2.amazonaws.com	52.95.148.134	true
linkprotect.cudasvc.com	18.192.226.97	true
kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com	unknown	unknown
www.ismyrotaryclub.org	unknown	unknown
favicon.ico	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fwww.ismyrotaryclub.org%2f%2fClick%2f%3f_uid%3d800004603%26_ctid%3d1972187%26redirect%3dhttps%3a%2f%2f1n0w8.codesandbox.io%2f%3faf%3dam1lcmNpZXJAbXVyZXhsdGQuY29t&c=E,1,33KLss3YzRWhFedSrTUVgatC3BBMx2L-L4e7_qZWgR8ttsvQZbCsR6smducdjsRz-uGYCcQc5RJAZdgfM9YfGqlADpHhdxTFS_EgtztnR08wn2_60sAU2Wi-&typo=1	false		unknown
https://codesandbox.io/public/sse-hooks/sse-hooks.f648b14c15c640a14a557113a991cb8d.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js	false		high
https://www.ismyrotaryclub.org//Click/?_uid=800004603&_ctid=1972187&redirect=https://1n0w8.codesandbox.io/?af=am1lcmNpZXJAbXVyZXhsdGQuY29t	false	Avira URL Cloud: phishing	unknown
https://codesandbox.io/static/js/banner.be879265d.js	false		high
https://1n0w8.codesandbox.io/?af=am1lcmNpZXJAbXVyZXhsdGQuY29t	false		high
https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/favicon.ico	false		high
https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html#jmercier@murexltd.com	false	SlashNext: Fake Login Page type: Phishing & Social Engineering	high
https://kjkrewm-oer84593-nmdfjhplq.s3.eu-west-2.amazonaws.com/index.html	false		high
https://static.cloudflareinsights.com/beacon.min.js	false	URL Reputation: safe	unknown

ID:	510504
Product:	CloudBasic
Start time:	20:56:19
Start date:	27.10.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{26C0008C-37A3-11EC-90E9-ECF4BB862DED}.dat	Composite Document File V2 Document, Cannot read section info	510065F5B61D71D72BDAF52F7F495534	C10D21B9E602A9519EFC4D4399C29389762DA2EB	2E5D71D409F493E314FE783F02B84414DD940B440A9450FEAD0BE839311DED0A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{26C0008E-37A3-11EC-90E9-ECF4BB862DED}.dat	Composite Document File V2 Document, Cannot read section info	DB7031038B30470A930611289B9CD2BC	13DD2F20029C0926742F17715BEF293461DB8132	E31A3737138B5A69C6B9FBA989F5D135B5D6CD9BDE5C5C64033B1D8C6E0C4020
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2E92B668-37A3-11EC-90E9-ECF4BB862DED}.dat	Composite Document File V2 Document, Cannot read section info	5E90782435B6C970E8F88D5E195C8860	67DB40B9002191D97233FAE60322750A6425B5A5	B7EE7B889E62EB7080B07DF7E2518CDA247863819F2AD644DBF956E847701C59
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\index[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	0EAD602C593B799DCD4ABC75C9672614	AA08CF50CBEDE9F1DB16530E4EF10A06F8AF3E85	2DB449A4D8B0D19EA64E787E2E2F33EE0E8FC9D6E764EAA34A77B44E40F59103
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\jquery.min[1].js	ASCII text, with very long lines	8FB8FEE4FCC3CC86FF6C724154C49C42	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\DFGA14QX.htm	HTML document, ASCII text	E72A661252132C3688D4F975512119D0	C79923CF296C173806B7FB351D5F3C0F03E1BCC2	E9FC887F8EFC942005558EDD06A94993483AA6E2F224FE994A174843FD45B951
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\banner.be879265d[1].js	HTML document, ASCII text, with very long lines	DA94EBDDFA54539635E6DC804B2885B8	15A1F830CC8AA4CC4E2F5D354B0BE21F9B25D9F1	3ADCC764BEC65346B5A72DE77F2F5688C2484AB587D2D093EB5E2327D608AF60
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\beacon.min[1].js	ASCII text, with very long lines, with no line terminators	0ED6E98B55F00F35ECD21C397ADC3B16	C4A963BDD737FD83B6C20DE3D205BD5682B62F7A	ACD89C8DD5CC9CF47EE574302EC883993C33D419DA8840DDB05763B857F1F09F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sse-hooks.f648b14c15c640a14a557113a991cb8d[1].js	UTF-8 Unicode text, with very long lines	523A971C96C4FB67E4B80157FF11EE5C	4AC2B055DCD8C444CEDD5B271717F40813AD34BC	D653312BF01341A4DCD9635548E8ADC173E98C6D0864017152EBD4BC71FD4028
C:\Users\user\AppData\Local\Temp\~DF75153F92E31AE6D4.TMP	data	1BA06AE0F977AE8DE26CEF6DF4ADEFA9	1553D3180FC6ECD6A9B543929707C1283C910893	3620B244B1FDCBA43494E8D603E4D950CEBC230301887E0DB0FF263CE34029E2
C:\Users\user\AppData\Local\Temp\~DF7E54C710E01EB69E.TMP	data	BAE4F7A74A5A11C6C051F0918C1CECEF	C352D244D87037DE12A8995C84FF85B517F333CE	8BC3D5AA4632E5A49AD6B02696D9535763AF4CE8D940695035F6EBED411098AE
C:\Users\user\AppData\Local\Temp\~DFF890F1947A547B5C.TMP	data	E34DEE85FD79D8D7B6017FA688FE2D7E	BFFC01AA7036E91CDEB9BDA205433EE2D52153CB	A619CD596BFE0A8117C5EB1C2AF8527136EE7E313E8AFE6C941CE2402CB676FD

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs