Analysis date (UTC): 14 November 2023, 00:27Analysis environment: Windows 7 Pro, build 7601, x86

http://www.govplanet.com/jsp/mailing/mail-landing.jsp?userMailing=531485437&action=url&name=ImageBanner_1689024521039&url=https://barnematconsulting.com/wpfile/4340/tvrja/d2lsbC5pLmFtYnJvQGdtYWlsLmNvbQ==

SHA1:9FD11086EC75A304BC029BBA85BE78A25C37628E
SHA256:D6DD9992E23718F142AFFC5FAB282BB3022D4C56DC28A5A99C2A09424AE2F34B

Analysis result

Behavior activities

MALICIOUS

PHISHING has been detected (SURICATA)

  • chrome.exe (PID: 3408)

SUSPICIOUS

No suspicious indicators.

INFO

Application launched itself

  • chrome.exe (PID: 3128)

The process uses the downloaded file

  • chrome.exe (PID: 1904)
  • chrome.exe (PID: 124)
  • chrome.exe (PID: 476)

Manual execution by a user

  • wmpnscfg.exe (PID: 3972)

Checks supported languages

  • wmpnscfg.exe (PID: 3972)

Reads the computer name

  • wmpnscfg.exe (PID: 3972)

Reads the machine GUID from the registry

  • wmpnscfg.exe (PID: 3972)

Threats

PIDProcessClassMessage
3408chrome.exePossible Social Engineering AttemptedPHISHING [ANY.RUN] Phishing domain chain detected (DadSec)
3408chrome.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
3408chrome.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
3408chrome.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare Network Error Logging (NEL)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN