Windows Analysis Report
https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f

Overview

General Information

Sample URL: https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f
Analysis ID: 1540575

Detection

Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected phishing page
AI detected landing page (webpage, office document or email)
Detected non-DNS traffic on DNS port
Drops files with a non-matching file extension (content does not match file extension)
HTML body contains low number of good links
HTML body with high number of embedded images detected
HTML title does not match URL
Stores files to the Windows start menu directory
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Phishing

barindex
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The provided URL 'pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev' does not match the legitimate domain for Microsoft., The URL uses a domain extension '.dev', which is not typically associated with Microsoft., The URL contains a long string of characters before the '.dev' extension, which is unusual and suspicious., The input fields 'Email, phone, or Skype' are commonly targeted in phishing attempts, especially for a brand like Microsoft. DOM: 3.9.pages.csv
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: Number of links: 0
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: Total embedded image size: 45708
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: Title: Profile login does not match URL
Source: https://successnewsonline.com/300/# HTTP Parser: let usuuid = "z2azdtkqgaekjwdov0scddshscn91fymiobh65onsoadzmrdds0rzqsohyc/7tk5sqbluo+dxtrylp7ud0lezg=="; let policy = "pxmvmec2r2ugrndvjdt/6gp5msx1bwn4czrd0lm5xy9mvsoya3rymff+cnjdqdxc";let sv = "0"; let sir = "1"; function decstr(encryptedstring, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarray.create(encrypteddata.words.slice(0, 4)); const ciphertext = cryptojs.lib.wordarray.create( encrypteddata.words.slice(4) ); const decrypteddata = cryptojs.aes.decrypt( { ciphertext: ciphertext, }, cryptojs.enc.utf8.par...
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: No favicon
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: No favicon
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: No favicon
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: No favicon
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: No favicon
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: No <meta name="author".. found
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: No <meta name="author".. found
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: No <meta name="copyright".. found
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:50000 version: TLS 1.2
Source: chrome.exe Memory has grown: Private usage: 25MB later: 38MB
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:49807 -> 1.1.1.1:53
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: global traffic DNS traffic detected: DNS query: merzcon-my.sharepoint.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic DNS traffic detected: DNS query: merzcon.sharepoint.com
Source: global traffic DNS traffic detected: DNS query: southcentralus1-mediap.svc.ms
Source: global traffic DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic DNS traffic detected: DNS query: pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev
Source: global traffic DNS traffic detected: DNS query: successnewsonline.com
Source: global traffic DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: o365.alnassers.net
Source: global traffic DNS traffic detected: DNS query: code.jquery.com
Source: global traffic DNS traffic detected: DNS query: aed653ac3a89e6f019b4c06785dc7b57.fp.measure.office.com
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic DNS traffic detected: DNS query: tr-ooc-acdc.office.com
Source: global traffic DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:50000 version: TLS 1.2
Source: classification engine Classification label: mal52.phis.win@19/306@70/314
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1944,i,11790135556718033235,16616107549424836971,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1944,i,11790135556718033235,16616107549424836971,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: Window Recorder Window detected: More than 3 window changes detected

Persistence and Installation Behavior

barindex
Source: https://pub-d53a2e4f0ccc40e9b0d8b81a5cfa401a.r2.dev/0nedrivefax.html LLM: Page contains button: 'VIEW DOCUMENT' Source: '3.5.pages.csv'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 690 Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs