Edit tour

Windows Analysis Report
https://assets-usa.mkt.dynamics.com/a915fd66-2592-ef11-8a66-00224803a417/digitalassets/standaloneforms/3d7495e3-e695-ef11-8a69-000d3a3501d6

Overview

General Information

Sample URL:	https://assets-usa.mkt.dynamics.com/a915fd66-2592-ef11-8a66-00224803a417/digitalassets/standaloneforms/3d7495e3-e695-ef11-8a69-000d3a3501d6
Analysis ID:	1544485
Infos:

Detection

Mamba2FA

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Found malware configuration

Yara detected Mamba 2FA PaaS

AI detected landing page (webpage, office document or email)

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid 'forgot password' link found

Invalid T&C link found

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1312 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2264,i,4796902220830496040,4729114084845855456,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://assets-usa.mkt.dynamics.com/a915fd66-2592-ef11-8a66-00224803a417/digitalassets/standaloneforms/3d7495e3-e695-ef11-8a69-000d3a3501d6" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

Threatname: Mamba2FA

{"sv": "o365_1_one", "rand": "T1BGeTU=", "uid": "USER22102024U36102220"}

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
2.3.pages.csv	JoeSecurity_Mamba2FA	Yara detected Mamba 2FA PaaS	Joe Security
2.2.pages.csv	JoeSecurity_Mamba2FA	Yara detected Mamba 2FA PaaS	Joe Security

Suricata Signatures

ET PHISHING Javascript Browser Fingerprinting POST Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T13:46:35.661219+0100	2056643	2	Possible Social Engineering Attempted	192.168.2.4	63993	165.22.49.66	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://assets-usa.mkt.dynamics.com/a915fd66-2592-ef11-8a66-00224803a417/digitalassets/standaloneforms/3d7495e3-e695-ef11-8a69-000d3a3501d6

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Found malware configuration

Source: 0.1.pages.csv

Malware Configuration Extractor: Mamba2FA {"sv": "o365_1_one", "rand": "T1BGeTU=", "uid": "USER22102024U36102220"}

Phishing

AI detected phishing page

Source: https://www.photogallerybd.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPVQxQkdlVFU9JnVpZD1VU0VSMjIxMDIwMjRVMzYxMDIyMjA=N0123N	LLM: Score: 9 Reasons: The brand 'OneDrive' is a well-known cloud storage service by Microsoft., The URL 'www.photogallerybd.com' does not match the legitimate domain for OneDrive, which is 'onedrive.live.com'., The domain 'photogallerybd.com' does not have any known association with Microsoft or OneDrive., The presence of input fields labeled as 'u, n, k, n, o, w, n' is unusual and does not align with typical OneDrive login or input forms., The URL structure and domain name do not suggest any legitimate association with the OneDrive brand. DOM: 2.2.pages.csv
Source: https://www.photogallerybd.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPVQxQkdlVFU9JnVpZD1VU0VSMjIxMDIwMjRVMzYxMDIyMjA=N0123N	LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'www.photogallerybd.com' does not match the legitimate domain for Microsoft., The domain 'photogallerybd.com' does not have any known association with Microsoft., The presence of input fields for 'Email, phone or Skype' is typical for Microsoft services, but the domain does not match., The URL contains no direct reference to Microsoft, which is suspicious given the brand association. DOM: 2.3.pages.csv

Yara detected Mamba 2FA PaaS

Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML

Phishing site detected (based on image similarity)