Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://towergroupofcompany.com/wp-includes/blobcit.html

Overview

General Information

Sample URL:https://towergroupofcompany.com/wp-includes/blobcit.html
Analysis ID:1576822

Detection

HTMLPhisher
Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
Yara detected HtmlPhish75
Found HTTP page in a blob
HTML body contains low number of good links
HTML body with high number of embedded images detected
HTML title does not match URL
Invalid 'forgot password' link found
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 1160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • chrome.exe (PID: 3680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1980,i,11896842480148817951,8333722955416218856,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • chrome.exe (PID: 4188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://towergroupofcompany.com/wp-includes/blobcit.html" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup
SourceRuleDescriptionAuthorStrings
0.0.id.script.csvJoeSecurity_HtmlPhish_75Yara detected HtmlPhish_75Joe Security
    No Sigma rule has matched
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results

    Phishing

    barindex
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35Joe Sandbox AI: Score: 9 Reasons: The brand 'Citi' is a well-known financial institution, typically associated with the domain 'citi.com'., The URL provided is 'blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35', which does not match the legitimate domain 'citi.com'., The domain 'towergroupofcompany.com' is not associated with Citi and appears unrelated., The use of a 'blob:' URL scheme is unusual for legitimate banking sites and can be indicative of phishing., The presence of input fields for 'User ID' and 'Password' on a non-legitimate domain is a common phishing tactic. DOM: 2.0.pages.csv
    Source: Yara matchFile source: 0.0.id.script.csv, type: HTML
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35DOM page: Blob-based
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: Number of links: 0
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: Total embedded image size: 63777
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: Title: Sign On to Your Citi Account - Citibank does not match URL
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: Invalid link: Forgot Password?
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: <input type="password" .../> found
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: No favicon
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: No favicon
    Source: https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: No favicon
    Source: https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: No favicon
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: No <meta name="author".. found
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: No <meta name="author".. found
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: No <meta name="copyright".. found
    Source: blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35HTTP Parser: No <meta name="copyright".. found
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
    Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:61769 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:61788 version: TLS 1.2
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
    Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: global trafficDNS traffic detected: DNS query: towergroupofcompany.com
    Source: global trafficDNS traffic detected: DNS query: code.jquery.com
    Source: global trafficDNS traffic detected: DNS query: www.google.com
    Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
    Source: global trafficDNS traffic detected: DNS query: yomyyomy.site
    Source: unknownNetwork traffic detected: HTTP traffic on port 61786 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61782 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61801 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61787
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61788
    Source: unknownNetwork traffic detected: HTTP traffic on port 61809 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61772 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61780
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61781
    Source: unknownNetwork traffic detected: HTTP traffic on port 61791 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61782
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61783
    Source: unknownNetwork traffic detected: HTTP traffic on port 61795 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61799 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61810 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61786
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49694
    Source: unknownNetwork traffic detected: HTTP traffic on port 49679 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49692
    Source: unknownNetwork traffic detected: HTTP traffic on port 61781 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49692 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61800 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61798
    Source: unknownNetwork traffic detected: HTTP traffic on port 61808 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61799
    Source: unknownNetwork traffic detected: HTTP traffic on port 61775 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61771 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61779 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61792 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61791
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61792
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61793
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61794
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61795
    Source: unknownNetwork traffic detected: HTTP traffic on port 61796 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61796
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61797
    Source: unknownNetwork traffic detected: HTTP traffic on port 61761 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61780 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61806
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61807
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61808
    Source: unknownNetwork traffic detected: HTTP traffic on port 61769 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61809
    Source: unknownNetwork traffic detected: HTTP traffic on port 61788 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61774 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61797 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61807 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61800
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61801
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61769
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61802
    Source: unknownNetwork traffic detected: HTTP traffic on port 61770 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61778 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61793 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61761
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61762
    Source: unknownNetwork traffic detected: HTTP traffic on port 61762 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61787 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61783 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49694 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61802 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61806 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61798 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 61773 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61777
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61810
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61778
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61779
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61813
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61770
    Source: unknownNetwork traffic detected: HTTP traffic on port 61777 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61771
    Source: unknownNetwork traffic detected: HTTP traffic on port 61794 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61772
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61773
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61774
    Source: unknownNetwork traffic detected: HTTP traffic on port 61813 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61775
    Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:61769 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:61788 version: TLS 1.2
    Source: classification engineClassification label: mal60.phis.win@28/6@18/163
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1980,i,11896842480148817951,8333722955416218856,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://towergroupofcompany.com/wp-includes/blobcit.html"
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1980,i,11896842480148817951,8333722955416218856,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
    Registry Run Keys / Startup Folder
    1
    Process Injection
    3
    Masquerading
    OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
    Registry Run Keys / Startup Folder
    1
    Process Injection
    LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Non-Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
    Application Layer Protocol
    Automated ExfiltrationData Encrypted for Impact

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    https://towergroupofcompany.com/wp-includes/blobcit.html0%Avira URL Cloudsafe
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    SourceDetectionScannerLabelLink
    blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c350%Avira URL Cloudsafe
    about:blank#blocked0%Avira URL Cloudsafe
    NameIPActiveMaliciousAntivirus DetectionReputation
    towergroupofcompany.com
    191.252.83.191
    truetrue
      unknown
      code.jquery.com
      151.101.194.137
      truefalse
        high
        yomyyomy.site
        63.250.38.156
        truefalse
          unknown
          cdnjs.cloudflare.com
          104.17.25.14
          truefalse
            high
            www.google.com
            142.250.181.100
            truefalse
              high
              NameMaliciousAntivirus DetectionReputation
              about:blank#blockedfalse
              • Avira URL Cloud: safe
              unknown
              blob:https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35true
              • Avira URL Cloud: safe
              unknown
              https://towergroupofcompany.com/0601563c-40ee-4981-a0e4-08522a4b1c35true
                unknown
                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs
                IPDomainCountryFlagASNASN NameMalicious
                172.217.19.206
                unknownUnited States
                15169GOOGLEUSfalse
                1.1.1.1
                unknownAustralia
                13335CLOUDFLARENETUSfalse
                172.217.17.78
                unknownUnited States
                15169GOOGLEUSfalse
                172.217.17.35
                unknownUnited States
                15169GOOGLEUSfalse
                142.250.181.100
                www.google.comUnited States
                15169GOOGLEUSfalse
                151.101.2.137
                unknownUnited States
                54113FASTLYUSfalse
                63.250.38.156
                yomyyomy.siteUnited States
                22612NAMECHEAP-NETUSfalse
                191.252.83.191
                towergroupofcompany.comBrazil
                27715LocawebServicosdeInternetSABRtrue
                64.233.164.84
                unknownUnited States
                15169GOOGLEUSfalse
                239.255.255.250
                unknownReserved
                unknownunknownfalse
                172.217.19.170
                unknownUnited States
                15169GOOGLEUSfalse
                172.217.21.35
                unknownUnited States
                15169GOOGLEUSfalse
                151.101.194.137
                code.jquery.comUnited States
                54113FASTLYUSfalse
                142.250.181.67
                unknownUnited States
                15169GOOGLEUSfalse
                104.17.25.14
                cdnjs.cloudflare.comUnited States
                13335CLOUDFLARENETUSfalse
                142.250.181.74
                unknownUnited States
                15169GOOGLEUSfalse
                IP
                192.168.2.18
                192.168.2.4
                Joe Sandbox version:41.0.0 Charoite
                Analysis ID:1576822
                Start date and time:2024-12-17 16:11:34 +01:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:defaultwindowsinteractivecookbook.jbs
                Sample URL:https://towergroupofcompany.com/wp-includes/blobcit.html
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:15
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • EGA enabled
                Analysis Mode:stream
                Analysis stop reason:Timeout
                Detection:MAL
                Classification:mal60.phis.win@28/6@18/163
                • Exclude process from analysis (whitelisted): SIHClient.exe
                • Excluded IPs from analysis (whitelisted): 172.217.21.35, 64.233.164.84, 172.217.17.78, 172.217.17.46, 142.250.181.74, 172.217.19.170
                • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com
                • Not all processes where analyzed, report is missing behavior information
                • VT rate limit hit for: https://towergroupofcompany.com/wp-includes/blobcit.html
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 14:12:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2675
                Entropy (8bit):3.9776974664836873
                Encrypted:false
                SSDEEP:
                MD5:28F8B2DBB107125D877EA9707EC4954B
                SHA1:425B24A17A196212B8DB5A50180B86E5426FB173
                SHA-256:3C41F9D365552F41078ECFC665A3C72461708F498AB5AFA7071FBC3B8AE0DAA4
                SHA-512:94BA73E83ED318993D90FDA4EA0DEEB343CC8D9CB362A3A5ECFA58796C755A5816C257EF7CE214C0C8B619B94311A8DE6C1E5C343854669A8DC5E79B451D9DC8
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,...... ..P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y|y....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.y....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y.y....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.y...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.y.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........&0y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 14:12:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2677
                Entropy (8bit):3.9962125427965045
                Encrypted:false
                SSDEEP:
                MD5:9FA8345E4B962FEA3431CE8E9E9E26AF
                SHA1:A45D2FD27A92C77B0E9436CCD1135ACF8E3E4F5F
                SHA-256:92DFBB8D4A7EC29E3737E9D2E168A3FDD134F3C5A515D77CD6C34AD712A984BC
                SHA-512:31885AC61945CB9132FF573CDEF3D3C23C0B04CBDBD05721FD7A38CBB4FC92BC7FFA99657C35BC3FDEA483EB377E1697665C7C6CCD89F869292FD661D15B59D7
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,.....q...P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y|y....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.y....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y.y....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.y...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.y.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........&0y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2691
                Entropy (8bit):4.004448286281815
                Encrypted:false
                SSDEEP:
                MD5:11740C6ED21F9669BE5BC566F8872B43
                SHA1:7BA6ED03AA543DB240DF476503AAE5B6DF7BB029
                SHA-256:9528412FB2FDA63AC6D94E125C869497A684096780B48038E25D541B87F0455D
                SHA-512:08D3DD1778D6A76AA483E77B903F4C42D2A4566D3B5AA0487D25180BFC188703387EBC65CA53E457D3E2B87C0591D8BABFA8C69F374C59C3B96F445E956DE2ED
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y|y....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.y....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y.y....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.y...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........&0y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 14:12:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2679
                Entropy (8bit):3.994907882537744
                Encrypted:false
                SSDEEP:
                MD5:844BE2BFD9018A66DDAA54B38BEA96D7
                SHA1:DDCDB2B34E708EF5F9E3E5757B0FE52A2A9630A5
                SHA-256:DD9415E517E0672A59E9ADD2084EC4E1D6024643EA2313147CFFAFC4BA035D9C
                SHA-512:7B02CD320369D95174832D72C687FBC91C5B824D52ED061BE81273E54977DF1828964C77AF5784DF998610718E2976ED5C2DF605D3E2813B01A9571223751F09
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,...../...P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y|y....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.y....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y.y....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.y...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.y.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........&0y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 14:12:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2679
                Entropy (8bit):3.984014047203338
                Encrypted:false
                SSDEEP:
                MD5:7581245A58DD8419091F71AC40F82D7F
                SHA1:B583ECC9089FDCE20957BAB684EBFEE93279A2DF
                SHA-256:0A5A8DDFBA46E01FE54923F92EF2D2929DF7F7D4112F7B71871478FBEFDDFF4D
                SHA-512:8122BC1F184857FEC26614DC530459C37C4A64AA299475316DEF01678D0667863DCA39D9567708A8AA515785D8BE5FE7DD732C467CAF6C8116A14530D0AE1ED9
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,.........P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y|y....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.y....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y.y....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.y...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.y.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........&0y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 14:12:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2681
                Entropy (8bit):3.9920737128934047
                Encrypted:false
                SSDEEP:
                MD5:39AD387D888989E086D4713785B76857
                SHA1:96A8FD3981FC4B9D9311CC5891EA7B4DBBBCD721
                SHA-256:521061884771AB60A1CCDF98223076A6D1F88669836B5F6B58B617FC9DD8EC68
                SHA-512:FAF42031372C9F914568D14DB7F50CAB4DEF3A7F51545E0D6B42110946E7CF1DAEE510763E8CD84E7228B438F493AE3A1BBF027EB1B73B4CB96A0366DE9002A4
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,.....D...P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y|y....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.y....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y.y....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.y...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.y.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........&0y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                No static file info