Edit tour
Windows
Analysis Report
https://www.canva.com/design/DAGVnZ3mr_Y/4CQQbX1-EKRcha16TVbYxQ/view?utm_content=DAGVnZ3mr_Y&utm_campaign=designshare&utm_medium=link&utm_source=editor
Overview
General Information
Detection
Mamba2FA
Score: | 88 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
AI detected phishing page
Antivirus / Scanner detection for submitted sample
Found malware configuration
Yara detected Mamba 2FA PaaS
AI detected landing page (webpage, office document or email)
Phishing site detected (based on image similarity)
Phishing site detected (based on logo match)
Phishing site or detected (based on various text indicators)
Detected non-DNS traffic on DNS port
Detected suspicious crossdomain redirect
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
HTML title does not match URL
Invalid T&C link found
Javascript checks online IP of machine
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Classification
- System is w10x64
- chrome.exe (PID: 6076 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed "about :blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 4524 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2180 --fi eld-trial- handle=196 0,i,768365 0443928977 383,139865 1975394286 4806,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 3060 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=56 36 --field -trial-han dle=1960,i ,768365044 3928977383 ,139865197 5394286480 6,262144 - -disable-f eatures=Op timization GuideModel Downloadin g,Optimiza tionHints, Optimizati onHintsFet ching,Opti mizationTa rgetPredic tion /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- chrome.exe (PID: 4424 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://www.c anva.com/d esign/DAGV nZ3mr_Y/4C QQbX1-EKRc ha16TVbYxQ /view?utm_ content=DA GVnZ3mr_Y& utm_campai gn=designs hare&utm_m edium=link &utm_sourc e=editor" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
{"sv": "o365_1_sp", "rand": "Z1pmaEk=", "uid": "USER25102024U47102513"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Mamba2FA | Yara detected Mamba 2FA PaaS | Joe Security | ||
JoeSecurity_Mamba2FA | Yara detected Mamba 2FA PaaS | Joe Security |
⊘No Sigma rule has matched
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-05T20:11:35.989502+0100 | 2022112 | 1 | Exploit Kit Activity Detected | 192.168.2.5 | 49908 | 142.250.185.196 | 443 | TCP |
2024-11-05T20:11:37.504775+0100 | 2022112 | 1 | Exploit Kit Activity Detected | 192.168.2.5 | 49920 | 142.250.186.132 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-05T20:12:15.447447+0100 | 2056643 | 2 | Possible Social Engineering Attempted | 192.168.2.5 | 50145 | 103.6.199.200 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | SlashNext: |
Source: | Malware Configuration Extractor: |
Phishing |
---|
Source: | LLM: |
Source: | File source: | ||
Source: | File source: |
Source: | Matcher: |
Source: | Matcher: |
Source: | OCR Text: | ||
Source: | OCR Text: |
Source: | HTTP Parser: |
Source: | HTTP Parser: |
Source: | HTTP Parser: |
Source: | HTTP Parser: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: | ||
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | HTTP Parser: |
Source: | HTTP Parser: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Binary string: |