Edit tour

Windows Analysis Report
Fw Fw EMAIL VALIDATION.msg

Overview

General Information

Sample name:	Fw Fw EMAIL VALIDATION.msg
Analysis ID:	1533507
MD5:	a8590bdf52211068a0f6433599bb4fab
SHA1:	b4daffeee0d0294ec3a41fdd90b83bf3cb4d7032
SHA256:	8a034d0dd267a660f5903e2361fb92c29b8ccade6851eca7e05777fa62bb4dbc
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected phishing page (A)

Yara detected HtmlPhish20

AI detected landing page (webpage, office document or email)

AI detected landing page (webpage, office document or email) (A)

Detected hidden input values containing email addresses (often used in phishing pages)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6068 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Fw Fw EMAIL VALIDATION.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 2116 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "50E7322A-F90A-46A7-8D74-B5626AD72665" "2B8163F1-AE17-4411-9208-875FEDB14145" "6068" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.us.m.mimecastprotect.com/s/10qwCpYW4xTYjMDfPf1FGmAEO?domain=urldefense.proofpoint.com MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2024,i,4959187215483288706,2671594810383570988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.0.pages.csv	JoeSecurity_HtmlPhish_20	Yara detected HtmlPhish_20	Joe Security
1.2.pages.csv	JoeSecurity_HtmlPhish_20	Yara detected HtmlPhish_20	Joe Security
1.1.pages.csv	JoeSecurity_HtmlPhish_20	Yara detected HtmlPhish_20	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_20	Yara detected HtmlPhish_20	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6068, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform

LLM: Score: 8 Reasons: The brand 'Microsoft' is a well-known technology company., The URL 'docs.google.com' is associated with Google, not Microsoft., There is a mismatch between the brand 'Microsoft' and the domain 'google.com'., Google Docs is a legitimate service, but it is not related to Microsoft., The presence of an email input field on a Google Docs URL claiming to be Microsoft-related is suspicious. DOM: 1.0.pages.csv

AI detected phishing page (A)

Source: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform

LLM: Score: 7 Reasons: The brand 'Microsoft Account' is well-known and typically associated with the domain 'microsoft.com'., The URL 'docs.google.com' is a legitimate domain associated with Google, not Microsoft., The presence of input fields for 'EMAIL', 'PASSWORD', and 'Re-Enter Password' on a Google domain while claiming to be related to Microsoft is suspicious., There is a mismatch between the brand (Microsoft) and the domain (Google), which is a common phishing tactic. DOM: 1.0.pages.csv

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Source: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform	HTTP Parser: lhuizar@mydatapath.com
Source: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform	HTTP Parser: test@test.org

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.17:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.150:443 -> 192.168.2.17:49844 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71

Source: global traffic	DNS traffic detected: DNS query: url.us.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: urldefense.proofpoint.com
Source: global traffic	DNS traffic detected: DNS query: forms.gle
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lh5.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Fw Fw EMAIL VALIDATION.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "50E7322A-F90A-46A7-8D74-B5626AD72665" "2B8163F1-AE17-4411-9208-875FEDB14145" "6068" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "50E7322A-F90A-46A7-8D74-B5626AD72665" "2B8163F1-AE17-4411-9208-875FEDB14145" "6068" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.us.m.mimecastprotect.com/s/10qwCpYW4xTYjMDfPf1FGmAEO?domain=urldefense.proofpoint.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2024,i,4959187215483288706,2671594810383570988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.us.m.mimecastprotect.com/s/10qwCpYW4xTYjMDfPf1FGmAEO?domain=urldefense.proofpoint.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2024,i,4959187215483288706,2671594810383570988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: Email	LLM: Page contains button: 'CLICK HERE' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'click here'
Source: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/formResponse	LLM: Page contains button: 'Submit another response' Source: '2.6.pages.csv'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
docs.google.com	142.250.184.238	true	false	unknown
url.us.m.mimecastprotect.com	207.211.31.113	true	false	unknown
play.google.com	142.250.184.238	true	false	unknown
urldefense.com	52.71.28.102	true	false	unknown
forms.gle	199.36.158.100	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
googlehosted.l.googleusercontent.com	216.58.212.129	true	false	unknown
lh5.googleusercontent.com	unknown	unknown	false	unknown
urldefense.proofpoint.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/formResponse	true		unknown
https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform	true		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
142.250.185.129	unknown	United States	15169	GOOGLEUS	false
52.71.28.102	urldefense.com	United States	14618	AMAZON-AESUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
216.58.212.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.202	unknown	United States	15169	GOOGLEUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
52.109.32.97	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.89.19	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.58.212.131	unknown	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
207.211.31.113	url.us.m.mimecastprotect.com	United States	14135	NAVISITE-EAST-2US	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
199.36.158.100	forms.gle	United States	15169	GOOGLEUS	false
20.50.73.4	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.151	unknown	European Union	16625	AKAMAI-ASUS	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
142.250.185.131	unknown	United States	15169	GOOGLEUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
142.250.184.238	docs.google.com	United States	15169	GOOGLEUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.74	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533507
Start date and time:	2024-10-14 19:31:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Fw Fw EMAIL VALIDATION.msg
Detection:	MAL
Classification:	mal72.phis.winMSG@18/118@28/300
Cookbook Comments:	Found application associated with file extension: .msg

Input	Output
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "CLICK HERE", "prominent_button_name": "CLICK HERE", "text_input_field_labels": [ "now to keep your account active.BVCS" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Email Model: jbxai	{ "brands":["Datapath"], "text":"This email is to notify all staff that we will be carrying out email validation exercises. We will need you to confirm that your email is still in use, please CLICK HERE", "contains_trigger_text":true, "trigger_text":"CLICK HERE", "prominent_button_name":"CLICK HERE", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "Datapath", "Big Valley Grace Community Church", "Big Valley Christian School" ] }

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in with School E-mail & Password", "prominent_button_name": "Submit", "text_input_field_labels": [ "EMAIL", "PASSWORD", "Re-Enter Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false } Google indexed: True

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: jbxai	{ "brands":["Microsoft"], "text":"Microsoft Account", "contains_trigger_text":true, "trigger_text":"Sign in with School E-mail & Password", "prominent_button_name":"Submit", "text_input_field_labels":["EMAIL", "PASSWORD", "Re-Enter Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft Account" ] } Google indexed: True

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: jbxai	{ "phishing_score":8, "brands":"Microsoft", "legit_domain":"microsoft.com", "classification":"wellknown", "reasons":["The brand 'Microsoft' is a well-known technology company.", "The URL 'docs.google.com' is associated with Google, not Microsoft.", "There is a mismatch between the brand 'Microsoft' and the domain 'google.com'.", "Google Docs is a legitimate service, but it is not related to Microsoft.", "The presence of an email input field on a Google Docs URL claiming to be Microsoft-related is suspicious."], "brand_matches":[false], "url_match":false, "brand_input":"Microsoft", "input_fields":"EMAIL"}

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: gpt-4o	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The brand 'Microsoft Account' is well-known and typically associated with the domain 'microsoft.com'.", "The URL 'docs.google.com' is a legitimate domain associated with Google, not Microsoft.", "The presence of input fields for 'EMAIL', 'PASSWORD', and 'Re-Enter Password' on a Google domain while claiming to be related to Microsoft is suspicious.", "There is a mismatch between the brand (Microsoft) and the domain (Google), which is a common phishing tactic." ], "riskscore": 9} Google indexed: True
URL: docs.google.com Brands: Microsoft Account Input Fields: EMAIL, PASSWORD, Re-Enter Password
URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in with School E-mail & Password", "prominent_button_name": "Submit", "text_input_field_labels": [ "EMAIL ", "PASSWORD ", "Re-Enter Password *" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in with School E-mail & Password", "prominent_button_name": "Submit", "text_input_field_labels": [ "EMAIL ", "PASSWORD ", "Re-Enter Password *" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in with School E-mail & Password", "prominent_button_name": "Submit", "text_input_field_labels": [ "EMAIL", "PASSWORD", "Re-Enter Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: jbxai	{ "brands":["Microsoft"], "text":"Microsoft Account", "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Submit", "text_input_field_labels":["EMAIL", "PASSWORD"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: jbxai	{ "brands":["Microsoft"], "text":"Microsoft Account", "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Submit", "text_input_field_labels":["EMAIL", "PASSWORD", "Re-Enter Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: jbxai	{ "brands":["Microsoft"], "text":"Microsoft Account", "contains_trigger_text":true, "trigger_text":"Sign in with School E-mail & Password", "prominent_button_name":"Submit", "text_input_field_labels":["EMAIL", "PASSWORD", "Re-Enter Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft Account" ] }
	```json { "brands": [ "Microsoft Account" ] }
URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft Account" ] }
	```json { "brands": [ "Microsoft Account" ] }
URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in with School E-mail & Password", "prominent_button_name": "Submit", "text_input_field_labels": [ "EMAIL ", "PASSWORD ", "Re-Enter Password *" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: jbxai	{ "brands":["Microsoft"], "text":"Microsoft Account", "contains_trigger_text":true, "trigger_text":"Sign in with School E-mail & Password", "prominent_button_name":"Submit", "text_input_field_labels":["EMAIL", "PASSWORD"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: jbxai	{ "brands":["Google"], "text":"Microsoft Account", "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Submit", "text_input_field_labels":["EMAIL", "PASSWORD", "Re-Enter Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in with School E-mail & Password", "prominent_button_name": "Submit", "text_input_field_labels": [ "EMAIL", "PASSWORD", "Re-Enter Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/viewform Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/formResponse Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Submit another response", "prominent_button_name": "Submit another response", "text_input_field_labels": [ "Microsoft Account" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/formResponse Model: jbxai	{ "brands":["Google"], "text":"Microsoft Account Thank You Submit another response", "contains_trigger_text":true, "trigger_text":"Submit another response", "prominent_button_name":"Submit another response", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://docs.google.com/forms/d/e/1FAIpQLSccffzpxl94U2LSAFb-abJo-o41TJisbLsN9qCB0TbrkAjaBQ/formResponse Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft Account", "Google Forms" ] }

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.3798244596700515
Encrypted:	false
SSDEEP:
MD5:	3C8803FF8A0C2E3567C84B9C2EB843C1
SHA1:	DBC9F9A578593F954DDBEB8F209C41E4657A60C4
SHA-256:	D68834ABC2820B4232B0ABAA77D1A27CF75CFCCEA170379F3A6B627F663D2FC2
SHA-512:	2994BBE9E58A204E571FCD6470A4F2996582E5453D5B99A70A170B25A562864224C4B4D6C9307BBEDE719C665BE47884557DBBD112B04872D2E705DDCA7BF4CA
Malicious:	false
Reputation:	unknown
Preview:	TH02...... . ...^.......SM01X...,....{\|.^...........IPM.Activity...........h...............h............H..h..x..........h........h...H..h\tor ...AppD...hh..0...P.x....h_..............h........_`.k...h....@...I.+w...h....H...8..k...0....T...............d.........2h...............k..D...........!h.............. h........h.x...#h....8.........$hh.......8....."h8.............'h..............1h_...<.........0h....4.....k../h....h......kH..h....p.....x...-h .........x...+h.........x................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 16:32:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.989629807107503
Encrypted:	false
SSDEEP:
MD5:	46185C715848D410E1FCFABE4F4D2450
SHA1:	012B8E04138B510DF4E6CB859839BB3B2C89C380
SHA-256:	E386144E04E58E80583E919AE7262E3E4AC335D49D51C7D70F02C1004FA00B49
SHA-512:	AD5B95CD1D0F661FC52E6320A1F7B91F914D33EC4D09035B730D3D45F37D92F3A13896BD65C5F10FB0F7365731DFE9F24BA8EB293F087CC90EA5BF290B131AE0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......^._.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VNY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VNY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VNY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........3.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	5.865270608635305
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	Fw Fw EMAIL VALIDATION.msg
File size:	135'680 bytes
MD5:	a8590bdf52211068a0f6433599bb4fab
SHA1:	b4daffeee0d0294ec3a41fdd90b83bf3cb4d7032
SHA256:	8a034d0dd267a660f5903e2361fb92c29b8ccade6851eca7e05777fa62bb4dbc
SHA512:	3e104c5731b4202664077a118aea5878b78f7d237ff9ffc3ae0359f7b9029d70512db62f23a29418c0da5df1c3ea26caacd33c756a2e84433e2f8eb94488ba70
SSDEEP:	1536:Wo8JehSTdcwGCl/WzWvW8WQCoWVWdHNTL/VIJgW8u997RS9gIHeA0cgEZSBpev3E:WBewTdFa+Hogfu99NS9jHnZSBIvm1
TLSH:	C1D3D61539E94616F27BDF324EE384979536BC92AD10CA8F7195334E0A72A40AC61F3F
File Content Preview:	........................>..................................."..................................................................................................................................................................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fw Fw EMAIL VALIDATION.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\08374176-72B6-4FF5-91A9-236D03ED576B

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4CE0EE70.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CF5CBBB1.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B08EA0A9-EAFE-467C-951D-88D2E783D48C}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728927143271581400_14AB2E12-A2EC-482F-9061-E7E05FD263B0.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728927143272354600_14AB2E12-A2EC-482F-9061-E7E05FD263B0.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241014T1332230027-6068.etl

C:\Users\user\AppData\Local\Temp\~DF91EA30DEE953D555.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 133

Windows Analysis Report
Fw Fw EMAIL VALIDATION.msg

Subject:	Fw: Fw: EMAIL VALIDATION
From:	Luis Huizar <lhuizar@mydatapath.com>
To:	Gabriel Espinoza <GEspinoza@mydatapath.com>
Cc:
BCC:
Date:	Mon, 14 Oct 2024 19:29:20 +0200
Communications:	Luis Huizar Lead Technician e: lhuizar@mydatapath.com d: 2095210055 \| o: 800.838.1488 <https://instagram.com/datapathinc> <http://www.mydatapath.com/> ________________________________ From: Deborah Raingruber <draingruber@bvcs.org> Sent: Monday, October 14, 2024 9:56 AM To: Luis Huizar <lhuizar@mydatapath.com> Subject: Fwd: Fw: EMAIL VALIDATION External Sender: ________________________________ ---------- Forwarded message --------- From: Hrayr Santourian <HrayrS@bvg.org <mailto:HrayrS@bvg.org> > Date: Mon, Oct 14, 2024 at 9:09AM Subject: Fw: EMAIL VALIDATION To: Deborah Raingruber <draingruber@bvcs.org <mailto:draingruber@bvcs.org> > Do we need to take a look at Proofpoint again? ________________________________ From: Linda Swartz <lindas@bvcs.org <mailto:lindas@bvcs.org> > Sent: Monday, October 14, 2024 8:50 AM Subject: EMAIL VALIDATION This email is to notify all staff that we will be carrying out email validation exercises. We will need you to confirm that your email is still in use, please CLICK HERE <https://url.us.m.mimecastprotect.com/s/10qwCpYW4xTYjMDfPf1FGmAEO?domain=urldefense.proofpoint.com> now to keep your account active.BVCS Linda K. Swartz, BVCS United States History, CP - AP Government * Economics Lindas@bvcs.org <mailto:Lindas@bvcs.org> -- <https://ci3.googleusercontent.com/mail-sig/AIorK4zl4fIh187cwBcR2Pp7HpC-FGBjDAKYtjgQcwLGUh6ieEqSi5PG77H1m4lN9_JUXyWAPnyxh3RsFCz2> Deborah Raingruber Big Valley Christian School Director of Technology draingruber@bvcs.org <mailto:draingruber@bvcs.org>
Attachments:	Outlook-3fwjzuza.jpg C2_signature_datapath-logo_email-signature_235e6d49-1466-4411-ad60-77a2f2e22808.png

Key	Value
Received	from MWHPR1301MB1936.namprd13.prod.outlook.com
17	29:20 +0000
Authentication-Results	dkim=none (message not signed)
(2603	10b6:208:4aa::10) with Microsoft SMTP Server (version=TLS1_2,
2024 17	29:20 +0000
([fe80	:3566:c8fe:823d:88c%7]) with mapi id 15.20.8048.020; Mon, 14 Oct 2024
Content-Type	application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding	binary
From	Luis Huizar <lhuizar@mydatapath.com>
To	Gabriel Espinoza <GEspinoza@mydatapath.com>
Subject	Fw: Fw: EMAIL VALIDATION
Thread-Topic	Fw: EMAIL VALIDATION
Thread-Index	AQHbHlob7ER7ORbTYE+vxgsB9HtXlrKGgG2i
Date	Mon, 14 Oct 2024 17:29:20 +0000
Message-ID	<MWHPR1301MB1936BB5A6B43C89B7B5F8219CD442@MWHPR1301MB1936.namprd13.prod.outlook.com>
References	<CAAQQROPC5-X4kGGJdQowUOZLnoQaPfkn3mfX9sDC5enSjgcnRQ@mail.gmail.com>
In-Reply-To	<CAJryWOKPYjO+nJE==SFCym9aoSm0vMGnOnxhiO14Cviu4akgcw@mail.gmail.com>
Accept-Language	en-US
Content-Language	en-US
X-MS-Exchange-Organization-ModifySensitivityLabel	00000000-0000-0000-0000-000000000000;e3926ae2-a5f5-4eb8-b7a9-2a972f12d6fe
X-MS-Has-Attach	yes
X-MS-Exchange-Organization-SCL	1
X-MS-TNEF-Correlator	<MWHPR1301MB1936BB5A6B43C89B7B5F8219CD442@MWHPR1301MB1936.namprd13.prod.outlook.com>
msip_labels	MSIP_Label_e3926ae2-a5f5-4eb8-b7a9-2a972f12d6fe_Enabled=True;MSIP_Label_e3926ae2-a5f5-4eb8-b7a9-2a972f12d6fe_SiteId=9ef5d077-23c6-453f-94f9-7809c35a837f;MSIP_Label_e3926ae2-a5f5-4eb8-b7a9-2a972f12d6fe_SetDate=2024-10-14T17:29:27.123Z;MSIP_Label_e3926ae2-a5f5-4eb8-b7a9-2a972f12d6fe_Name=General;MSIP_Label_e3926ae2-a5f5-4eb8-b7a9-2a972f12d6fe_ContentBits=0;MSIP_Label_e3926ae2-a5f5-4eb8-b7a9-2a972f12d6fe_Method=Standard;
x-codetwoprocessed	true
x-codetwo-clientsignature-inserted	true
MIME-Version	1.0
X-MS-Exchange-Organization-MessageDirectionality	Originating
X-MS-Exchange-Organization-AuthSource	MWHPR1301MB1936.namprd13.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Internal
X-MS-Exchange-Organization-AuthMechanism	04
X-MS-Exchange-Organization-Network-Message-Id	6ba381a4-6cbb-4608-ed2b-08dcec75bcc4
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	MWHPR1301MB1936:EE_\|IA2PR13MB6786:EE_\|BYAPR13MB2712:EE_
Return-Path	lhuizar@mydatapath.com
X-MS-Exchange-Organization-ExpirationStartTime	14 Oct 2024 17:29:21.0834
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Office365-Filtering-Correlation-Id	6ba381a4-6cbb-4608-ed2b-08dcec75bcc4
X-Microsoft-Antispam	BCL:0;ARA:13230040\|366016\|69100299015\|41050700001;
X-Forefront-Antispam-Report	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MWHPR1301MB1936.namprd13.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(69100299015)(41050700001);DIR:INT;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	14 Oct 2024 17:29:20.1762
X-MS-Exchange-CrossTenant-FromEntityHeader	Hosted
X-MS-Exchange-CrossTenant-Id	9ef5d077-23c6-453f-94f9-7809c35a837f
X-MS-Exchange-CrossTenant-AuthSource	MWHPR1301MB1936.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Internal
X-MS-Exchange-CrossTenant-Network-Message-Id	6ba381a4-6cbb-4608-ed2b-08dcec75bcc4
X-MS-Exchange-CrossTenant-MailboxType	HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName	A1gE6LzpfN47nkgFS1BRZwDIsgV/fGqthXdW5/Po3fqb+942AVZnCtr/Q2T7jp4xE375rNYGbZ78f7qjlhYdDg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped	IA2PR13MB6786
X-MS-Exchange-Transport-EndToEndLatency	00:00:05.2775713
X-MS-Exchange-Processed-By-BccFoldering	15.20.8048.020
X-Microsoft-Antispam-Mailbox-Delivery	ucf:1;jmr:0;auth:0;dest:C;OFR:CustomRules;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003);
X-Microsoft-Antispam-Message-Info	xgumBT/F2qmXwAANYYG7VmZ7SHV5chuVav4LFuH40nn3XelLR6RL9+12jM07og2DDJQXjWf5qs69QM8i5dGOESALE1+ndyPjryfdxlVcZXycBasGA2qwuvQn6KdSuolDekzBD7pV546304a1Z76sZT1S7l8hSlA8pFbLkld3qGeQzEh1g1iFftlCyplj6ebAnfnxKli7lfQmxN4j1r6tD+Lz9Eh6VPG1GUx52ZMrjeK4LEAT/Huxd3ghb2AGumIoKfw+u5XW4Ap27X2oYqCAcuczHelKpRZfEw08Eq2quQDufBtiQcqepjaGBXxRGv8TavJWuFCmFWPQ+wc7o1yBAThCIWb5kDbCwXYV0/69JQx4VUWzSwPVS6Wzdr4hjjcFMmxXI1H4sVJfDLxRwNn2nrlYf8f7OUSI/g1hFTkOniwOiU1d7zgAdLgCBRHb1p5ALRQtS5lYAOlsMnQdUJ07xBsF3+7REhiv2BOuE3w4mfDfvw9N7st9Y+yB0+vrDBGlbjPUAZZRaG5kkNzd4eh8JeV7VPJ8NGZukcZhMb5e8iCrpzd45PPkXX0yr8Kl7CEt51epA6ZONBZ57E6kfPcgYchdwzWGcAYRRz4SlSLxdzy/t+eblNyGnL9hm1p9uINtNMISKdOmKhsOP+YGcVfi6Lu8rRnzwCLsiM4MCA7z4qjYE/qJTUFUpSazksw+2+62nJJMEFqaEyBCCMWKTvAH6hbW7IRFT+a02YqP+BHas00B04XXmeM7rQdMzz59iLH2prR6357UShln/UWjFkZRHVPhy3JNWZek0x3wtwkcXeml+GMpzXWsJ9FjRW6lbp4XxYWI6NQAI6+d4vaPyB83vvCxD3bKiCYEPY2z855FHpKaYU7wlm8udmbg4z0sjX8h
date	Mon, 14 Oct 2024 19:29:20 +0200

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre