Edit tour
Windows
Analysis Report
phish_alert_sp2_2.0.0.0-1.eml
Overview
General Information
| Sample name: | phish_alert_sp2_2.0.0.0-1.eml |
| Analysis ID: | 1643123 |
| MD5: | e92ff2938edd30fe0b26c3989355579b |
| SHA1: | 2c33e6b207147752502241726b6412ffc1c89a0d |
| SHA256: | 2a78d8a31b646a111bb09c47d577f139e43973403fed72ed0abdbc4432ece43d |
| Infos: |  |
 | |
Detection
| Score: | 56 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
AI detected phishing page
AI detected landing page (webpage, office document or email)
AI detected suspicious elements in Email content
Creates files inside the system directory
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected suspicious crossdomain redirect
HTML page contains hidden javascript code
HTML title does not match URL
None HTTPS page querying sensitive user data (password, username or email)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Stores large binary data to the registry
Classification
- System is w10x64_ra
OUTLOOK.EXE (PID: 6964 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\OUTLO OK.EXE" /e ml "C:\Use rs\user\De sktop\phis h_alert_sp 2_2.0.0.0- 1.eml" MD5: 91A5292942864110ED734005B7E005C0) 
ai.exe (PID: 7140 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \root\vfs\ ProgramFil esCommonX6 4\Microsof t Shared\O ffice16\ai .exe" "892 1680B-582C -4042-A822 -580C276C8 C37" "E5A3 3783-7E8F- 4504-BAC4- BE6C564D9B 7F" "6964" "C:\Progr am Files ( x86)\Micro soft Offic e\Root\Off ice16\OUTL OOK.EXE" " WordCombin edFloatieL reOnline.o nnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD) 
chrome.exe (PID: 6620 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --s tart-maxim ized --sin gle-argume nt https:/ /nam04.saf elinks.pro tection.ou tlook.com/ ?url=https %3A%2F%2Fc onnect.int uit.com%2F portal%2Fa pp%2FComme rceNetwork %2Fview%2F scs-v1-7fd d6aab7e644 2cfa5cc1c8 ebfe43f876 e49a713a5a 44ac88e7fc 0ad7efaf54 d748f4675f 44f425e8b9 fac6e6dafe c04%3Floca le%3DEN_US &data=05%7 C02%7Crham mond%40olg oonik.com% 7Ceefd234f 044f4f6d24 7508dd6646 8274%7C341 c5aad39be4 7a3901e146 d297ecd80% 7C0%7C0%7C 6387791753 96201178%7 CUnknown%7 CTWFpbGZsb 3d8eyJFbXB 0eU1hcGkiO nRydWUsIlY iOiIwLjAuM DAwMCIsIlA iOiJXaW4zM iIsIkFOIjo iTWFpbCIsI ldUIjoyfQ% 3D%3D%7C0% 7C%7C%7C&s data=ERDBT c%2FxWMEhs GQD9%2Bhp1 KrGwLoMHse xMbBhQwZm2 I4%3D&rese rved=0 MD5: E81F54E6C1129887AEA47E7D092680BF) - chrome.exe (PID: 6764 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --no-pre-r ead-main-d ll --field -trial-han dle=2028,i ,468353614 7431504556 ,199580059 8163726755 ,262144 -- disable-fe atures=Opt imizationG uideModelD ownloading ,Optimizat ionHints,O ptimizatio nHintsFetc hing,Optim izationTar getPredict ion --vari ations-see d-version --mojo-pla tform-chan nel-handle =2096 /pre fetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF) - chrome.exe (PID: 8128 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --no-pre- read-main- dll --fiel d-trial-ha ndle=2028, i,46835361 4743150455 6,19958005 9816372675 5,262144 - -disable-f eatures=Op timization GuideModel Downloadin g,Optimiza tionHints, Optimizati onHintsFet ching,Opti mizationTa rgetPredic tion --var iations-se ed-version --mojo-pl atform-cha nnel-handl e=5988 /pr efetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF) - chrome.exe (PID: 8144 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --n o-pre-read -main-dll --field-tr ial-handle =2028,i,46 8353614743 1504556,19 9580059816 3726755,26 2144 --dis able-featu res=Optimi zationGuid eModelDown loading,Op timization Hints,Opti mizationHi ntsFetchin g,Optimiza tionTarget Prediction --variati ons-seed-v ersion --m ojo-platfo rm-channel -handle=59 28 /prefet ch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)
- cleanup
⊘No yara matches
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: X__Junior (Nextron Systems): | ||
⊘No Suricata rule has matched
- • Phishing
- • Compliance
- • Networking
- • System Summary
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Language, Device and Operating System Detection
Click to jump to signature section
Show All Signature Results
Phishing |   |
|---|
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | Classification: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||