MALICIOUS — 33470cc687ad039a258ec7ab1fa10ff4e8f01f217bb87187a0d6125cf66029af

MALICIOUS — 33470cc687ad039a258ec7ab1fa10ff4e8f01f217bb87187a0d6125cf66029af is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100). 2 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 33470cc687ad039a258ec7ab1fa10ff4e8f01f217bb87187a0d6125cf66029af
• SHA-1: 9ca8f4e28984a6447ac98c1f4473c91e6e0d2785
• MD5: 22d10a227c3ad45d7dd0fb7896bfa060
• ssdeep: 48:SadUTq/aBQ4sbcuwsAqu7x3JKp82s1SV5o9ogUCXWXd/GPGhb8D6EJV9ogF4Gj+T:Sad54427LHtlb2/axOyNDsOQrrQQj
• TLSH: T17B27ED283789ACC04997ED1B6477C4B05CBFC2F1A35F52E19B8296D2854CB1D68B02E7
• Submitted as: 33470cc687ad039a258ec7ab1fa10ff4e8f01f217bb87187a0d6125cf66029af
• File type: html · Size: 15783 bytes
• Verdict: malicious (83/100)

Detections (2 of 54 engines)

• Microsoft Defender: Phish:HTML/FakeLogin.PABI!MTB
• Kaspersky (KVRT): Hoax.HTML.Phish.aad

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 83/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Phish:HTML/FakeLogin.PABI!MTB (rule Phish:HTML/FakeLogin.PABI!MTB) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Hoax.HTML.Phish.aad (rule Hoax.HTML.Phish.aad) - engine signal, weight 0.55, confidence 0.85
• Contacted 9 external host(s) and 12 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

13665 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 251.0.0.224.in-addr.arpa.
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 2.17.178.52.in-addr.arpa.
• nexusrules.officeapps.live.com
• 193.110.171.150.in-addr.arpa.
• ecs.office.com
• update.googleapis.com
• desktop-hsgcbep
• self.events.data.microsoft.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 52.123.252.220
• 52.178.17.2
• 52.168.117.175
• 51.116.246.105
• 20.42.179.204
• 72.154.7.106
• 92.223.78.30
• 52.148.114.188
• 20.184.175.17
• 57.155.104.224
• 52.168.117.171
• 52.110.12.40
• 20.184.175.16
• 52.123.128.14
• 20.42.179.192
• 85.210.196.11
• 40.84.97.4
• 172.215.188.232
• 72.145.35.96
• 72.145.35.97
• 172.172.255.216
• 20.165.94.46
• 57.155.101.212
• 172.215.188.225
• 40.84.85.40

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report