Edit tour

Windows Analysis Report
https://www.kwconnect.com/redirect?url=https://www.lugiest.com/sqx/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==

Overview

General Information

Sample URL:	https://www.kwconnect.com/redirect?url=https://www.lugiest.com/sqx/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==
Analysis ID:	1532990
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected phishing page (G)

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish70

Detected use of open redirect vulnerability

Phishing site detected (based on logo match)

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5972 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2216,i,18146185978484782937,9265471150824236331,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.kwconnect.com/redirect?url=https://www.lugiest.com/sqx/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.2.pages.csv	JoeSecurity_HtmlPhish_70	Yara detected HtmlPhish_70	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://www.kwconnect.com/redirect?url=https://www.lugiest.com/sqx/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://mariposassecretno.pl/3WmZ/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The URL 'mariposassecretno.pl' does not match the legitimate domain 'microsoft.com'., The domain 'mariposassecretno.pl' is unrelated to Microsoft and uses a '.pl' extension, which is not typically associated with Microsoft's official domains., The URL contains no recognizable association with Microsoft, suggesting a potential phishing attempt., The email domain 'cybg.com' in the input fields is unrelated to Microsoft, adding to the suspicion. DOM: 0.3.pages.csv
Source: https://mariposassecretno.pl/3WmZ/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'mariposassecretno.pl' does not match the legitimate domain for Microsoft., The URL uses a '.pl' domain extension, which is not typically associated with Microsoft., The URL contains no reference to 'Microsoft', which is suspicious given the brand association., The presence of a password input field on a non-Microsoft domain is a common phishing tactic. DOM: 0.4.pages.csv
Source: https://mariposassecretno.pl/3WmZ/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'mariposassecretno.pl' does not match the legitimate domain for Microsoft., The URL uses a '.pl' domain extension, which is not typically associated with Microsoft., The URL contains no recognizable association with Microsoft, suggesting a potential phishing attempt., The presence of a password input field increases the risk of phishing, especially when the domain does not match the brand. DOM: 0.5.pages.csv

AI detected phishing page (G)

Source: https://mariposassecretno.pl/3WmZ/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	LLM: Score: 10 Reasons: The URL mariposassecretno.pl does not match the legitimate domain microsoft.com for the wellknown brand Microsoft., The domain name is completely different from the expected domain for Microsoft., The provided URL uses an unusual top-level domain '.pl' which is not commonly associated with Microsoft., The input field contains an email address, which could be used for phishing purposes. DOM: 0.3.pages.csv
Source: https://mariposassecretno.pl/3WmZ/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	LLM: Score: 10 Reasons: The URL mariposassecretno.pl does not match the legitimate domain microsoft.com for Microsoft., The domain extension '.pl' is suspicious in this context., The URL contains no clear association with Microsoft., The presence of a password field on an unrelated site increases the risk of phishing. DOM: 0.4.pages.csv
Source: https://mariposassecretno.pl/3WmZ/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	LLM: Score: 10 Reasons: The URL mariposassecretno.pl does not match the legitimate domain microsoft.com for Microsoft., The domain extension '.pl' is suspicious in this context., The URL contains no clear association with Microsoft., The presence of a password field on an unrelated site increases the risk of phishing. DOM: 0.5.pages.csv

Yara detected HtmlPhish70

Source: Yara match

File source: 0.2.pages.csv, type: HTML

Detected use of open redirect vulnerability

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Proxy from: www.kwconnect.com/redirect?url=https://www.lugiest.com/sqx/ to https://www.lugiest.com/sqx/

Phishing site detected (based on logo match)

Source: https://mariposassecretno.pl/3WmZ/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	Matcher: Template: microsoft matched
Source: https://mariposassecretno.pl/3WmZ/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	Matcher: Template: microsoft matched
Source: https://mariposassecretno.pl/3WmZ/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	Matcher: Template: microsoft matched