Play interactive tour

Edit tour

Windows Analysis Report https://webmailhelpdesk-secure.azurefd.net/#test@test.com

Overview

General Information

Sample URL:	https://webmailhelpdesk-secure.azurefd.net/#test@test.com
Analysis ID:	546775
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish10

Yara detected OWA Phishing

Phishing site detected (based on logo template match)

URL contains potential PII (phishing indication)

HTML body contains low number of good links

Suspicious form URL found

No HTML title found

Form action URLs do not match main URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6608 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://webmailhelpdesk-secure.azurefd.net/#test@test.com MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,15337706214180988688,1135011093778955787,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish10

Show sources

Source: Yara match

File source: 96078.0.pages.csv, type: HTML

Yara detected OWA Phishing

Show sources

Source: Yara match

File source: 96078.0.pages.csv, type: HTML

Phishing site detected (based on logo template match)

Show sources

Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com

Matcher: Template: outlook matched

Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com

Sample URL: PII: test@test.com

Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: Number of links: 0
Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: Number of links: 0

Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: Form action: https://397750328498584992com2038xyz.xyz/exch/oauth05112021/client_id=56230006/1.php
Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: Form action: https://397750328498584992com2038xyz.xyz/exch/oauth05112021/client_id=56230006/1.php

Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: HTML title missing
Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: HTML title missing

Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: Form action: https://397750328498584992com2038xyz.xyz/exch/oauth05112021/client_id=56230006/1.php azurefd 397750328498584992com2038xyz
Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: Form action: https://397750328498584992com2038xyz.xyz/exch/oauth05112021/client_id=56230006/1.php azurefd 397750328498584992com2038xyz

Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: No <meta name="copyright".. found
Source: https://webmailhelpdesk-secure.azurefd.net/#test@test.com	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://webmailhelpdesk-secure.azurefd.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://webmailhelpdesk-secure.azurefd.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveOrigin: https://webmailhelpdesk-secure.azurefd.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://webmailhelpdesk-secure.azurefd.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.0/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveOrigin: https://webmailhelpdesk-secure.azurefd.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://webmailhelpdesk-secure.azurefd.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://webmailhelpdesk-secure.azurefd.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://webmailhelpdesk-secure.azurefd.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.14.0/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://webmailhelpdesk-secure.azurefd.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://webmailhelpdesk-secure.azurefd.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=W4jfVqGP8dJl6Hc4mXaNmliBvy9EMndT1vIotmFAFlf9S4MM6hNH3fIhQtE
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr, manifest.json2.0.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr, manifest.json2.0.dr	String found in binary or memory: https://apis.google.com
Source: data_1.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr, pnacl_public_x86_64_libcrt_platform_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr, pnacl_public_x86_64_libcrt_platform_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.0.dr, manifest.json.0.dr, manifest.json2.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: data_1.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.min.js
Source: data_1.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.min.jsC
Source: data_1.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.slim.min.js
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.1.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCdbdLSKujak8Egk
Source: manifest.json2.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr, 14122e22-79c5-4b4d-b922-b904a7e88f7a.tmp.1.dr, 0bb28641-d32c-4646-a286-674fa145f564.tmp.1.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: manifest.json2.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json2.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json2.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr, angular.js.0.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json2.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_1.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Source: data_1.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.cssf
Source: data_1.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Source: data_1.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.jsFS0U
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr	String found in binary or memory: https://r1---sn-4g5lzne6.gvt1.com
Source: data_3.1.dr	String found in binary or memory: https://r1---sn-4g5lzne6.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=102.1
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_1.1.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: data_1.1.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdicN
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: data_1.1.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Source: data_1.1.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Source: messages.json41.0.dr, messages.json15.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json73.0.dr, messages.json83.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json39.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json57.0.dr, messages.json18.0.dr, messages.json.0.dr, messages.json68.0.dr, messages.json51.0.dr, messages.json36.0.dr, messages.json50.0.dr, messages.json67.0.dr, messages.json8.0.dr, messages.json2.0.dr, messages.json52.0.dr, messages.json55.0.dr, messages.json6.0.dr, messages.json72.0.dr, messages.json1.0.dr, messages.json86.0.dr, messages.json84.0.dr, messages.json22.0.dr, messages.json4.0.dr, messages.json19.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr, messages.json15.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json73.0.dr, messages.json83.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json39.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json57.0.dr, messages.json18.0.dr, messages.json.0.dr, messages.json68.0.dr, messages.json51.0.dr, messages.json36.0.dr, messages.json50.0.dr, messages.json67.0.dr, messages.json8.0.dr, messages.json2.0.dr, messages.json52.0.dr, messages.json55.0.dr, messages.json6.0.dr, messages.json72.0.dr, messages.json1.0.dr, messages.json86.0.dr, messages.json84.0.dr, messages.json22.0.dr, messages.json4.0.dr, messages.json19.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: data_1.1.dr	String found in binary or memory: https://webmailhelpdesk-secure.azurefd.net/
Source: Current Session.0.dr	String found in binary or memory: https://webmailhelpdesk-secure.azurefd.net/#test
Source: data_1.1.dr	String found in binary or memory: https://webmailhelpdesk-secure.azurefd.net/DXP
Source: data_1.1.dr	String found in binary or memory: https://webmailhelpdesk-secure.azurefd.net/favicon.ico
Source: data_1.1.dr	String found in binary or memory: https://webmailhelpdesk-secure.azurefd.net/favicon.icoChIKBw14bxIZGgAKBw2M818KGgA=
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr, manifest.json2.0.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json2.0.dr	String found in binary or memory: https://www.google.com;
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 871e51bd-7973-46da-8ae8-14287f9192b0.tmp.1.dr, d8bb97ce-dd64-4fee-974a-07b7545e6b4f.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: manifest.json2.0.dr	String found in binary or memory: https://www.gstatic.com;

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\1a2f9acb-b5a8-4451-993e-474db1ae738f.tmp

Jump to behavior

Source: classification engine

Classification label: mal64.phis.win@32/259@8/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://webmailhelpdesk-secure.azurefd.net/#test@test.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,15337706214180988688,1135011093778955787,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,15337706214180988688,1135011093778955787,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61CF6DE0-19D0.pma

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading3	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report https://webmailhelpdesk-secure.azurefd.net/#test@test.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph