MALICIOUS — b824328f33b607500c090efe7d7da01a1e00f401469a7b1058f40149cfb119f0

MALICIOUS — b824328f33b607500c090efe7d7da01a1e00f401469a7b1058f40149cfb119f0 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (81/100). 1 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: b824328f33b607500c090efe7d7da01a1e00f401469a7b1058f40149cfb119f0
• SHA-1: 77e0208fdbd3d3005d222b2485e055652bd3e99e
• MD5: 36c56e9576797442141354a91383f742
• ssdeep: 384:2nA4ywi+pIvlNztvukeKXXTuUkwFq5ZQebLIWQQ/U4cR1LeeIYECdG55LkuxOk7X:e189tWkekPkeO11k90t
• TLSH: T1482C761E7757294FC27A8E02B4D6FADD189A67FB94704020824CEF4F9D46C60358B2DA
• Submitted as: b824328f33b607500c090efe7d7da01a1e00f401469a7b1058f40149cfb119f0
• File type: html · Size: 25781 bytes
• Verdict: malicious (81/100)

Detections (1 of 54 engines)

• Microsoft Defender: Trojan:JS/Phish.MB!MTB

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 81/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Trojan:JS/Phish.MB!MTB (rule Trojan:JS/Phish.MB!MTB) - engine signal, weight 0.55, confidence 0.85
• Obfuscated powershell script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 15 external host(s) and 11 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1711 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 76.0.240.10.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• update.googleapis.com
• desktop-hsgcbep
• self.events.data.microsoft.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 251.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 1.0.240.10.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

Embedded URLs

• https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN_r8OUuhs.ttf
• https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFVZ0e.ttf
• https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UNirkOUuhs.ttf
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• fonts.gstatic.com
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 4.247.188.233
• 20.184.175.0
• 20.42.65.94
• 52.148.114.188
• 52.110.12.37
• 4.150.223.96
• 57.155.101.212
• 52.123.252.238
• 135.232.92.34
• 72.145.35.97
• 72.145.35.110
• 72.145.35.103
• 203.26.79.13
• 4.150.223.111
• 172.172.255.216
• 20.42.73.26
• 4.150.223.101
• 13.69.239.69
• 4.207.44.66
• 20.184.175.14
• 51.116.253.169
• 52.253.84.76
• 52.123.252.227
• 52.110.12.16
• 52.110.12.54

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report