Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Account Activation.eml

Overview

General Information

Sample name:Account Activation.eml
Analysis ID:1558883
MD5:48eb42d6b690cbb9ee08714c463ebcff
SHA1:14c06498a5061048374c003e71a5037b3a81ad67
SHA256:6d6777575a1c13bd46f53fe34f07d376c0bad2b4b951e05f3525eb0410750931
Infos:

Detection

Score:4
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Detected hidden input values containing email addresses (often used in phishing pages)
Detected suspicious crossdomain redirect
HTML body contains low number of good links
HTML page contains hidden javascript code
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7056 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Account Activation.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6352 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "232B3E22-7832-4ABB-BB8F-3CE1B02474C6" "1816B496-C878-4E9C-AC1E-3156942D4F74" "7056" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_token%2Fv1%2Fredeem%3Fmtid%3D1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1%26mtsec%3Dg0ZdjUDSmcDg5hiMJqr_CrgwS2PWh7xFCz8MPTgg7bU&data=05%7C02%7Cjminot%40santaclaraca.gov%7C293c1debb86346386e5108dd083f4fec%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638675791173233740%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=zh70XBLyl1Yk%2FobcOIaGGrzaz5on5sHW8pIVGI2mtKI%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 1488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1704 --field-trial-handle=1884,i,11741520992509703267,8091029071197411952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 5508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_token%2Fv1%2Fredeem%3Fmtid%3D1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1%26mtsec%3Dg0ZdjUDSmcDg5hiMJqr_CrgwS2PWh7xFCz8MPTgg7bU&data=05%7C02%7Cjminot%40santaclaraca.gov%7C293c1debb86346386e5108dd083f4fec%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638675791173233740%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=zh70XBLyl1Yk%2FobcOIaGGrzaz5on5sHW8pIVGI2mtKI%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2000,i,4706141409970112763,1385621711572975550,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7056, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://account.docusign.com/v2/usertoaccountinvite/tokenhandlerHTTP Parser: {"settings":{"traceToken":"f66dce53-0040-466b-894a-a3950312700c","siteRoot":"https://account.docusign.com/","forgotPasswordUri":"https://account.docusign.com/forgotpassword","flowSubmissionUris":{"oAuth":"/oauth/auth","sso":"/saml2/login/sp","username":"/username","password":"/password","web":"/web/login","signUp":"/signup","securityKeyLogin":"/securitykeylogin","resourceCredentialSecurityKeyCreation":"/resources/v1/manage/security-key/create","resourceCredentialSecurityKeyLogin":"/resources/v1/manage/security-key/login"},"allowGetBrowserFingerprint":true,"allowNewI18Library":true,"renderInkLoginApp":true,"assetPreloaderUrl":null,"pseudoLouserzationEnabled":false,"rebrandingEnabled":true},"stateData":{"state":"invite","oAuthLoginHintQS":null,"oAuthLoginHintCookie":null,"usernamePostAction":null,"logoBytes":null,"data":{"state":"activate_user","login_uri":null,"submission_uri":"/v2/usertoaccountinvite/activateuser","data":{"email":"jminot@santaclaraca.gov","account_name":"City of Santa Clara","username":"Julie Minot","password":null,"access_code":null,"question_answer_pairs":null,"is_federated_user":false,"compliance_jurisdiction_country_code":null,"user_invite_id":"fdb77111-bcb1-4de7-9cf7-12ceb00583af","accept_invitation":null,"access_code_remaining_attempts":null,"error":null,"phone_country_code":null,"phone_number":null,"sms_verification_is_locked_out":null,"sms_code":null},"password_requirements":null,"forgot_password_questions":null,"activation_view_template":"DefaultActivationPage","locale":null,"usePrivacyAndTermsLinkFromIntlLibrary":true}},"error":null}
Source: https://account.docusign.com/v2/usertoaccountinvite/tokenhandlerHTTP Parser: {"settings":{"traceToken":"a0a1bebe-48a2-4d20-8fc3-ce89c38a57ce","siteRoot":"https://account.docusign.com/","forgotPasswordUri":"https://account.docusign.com/forgotpassword","flowSubmissionUris":{"oAuth":"/oauth/auth","sso":"/saml2/login/sp","username":"/username","password":"/password","web":"/web/login","signUp":"/signup","securityKeyLogin":"/securitykeylogin","resourceCredentialSecurityKeyCreation":"/resources/v1/manage/security-key/create","resourceCredentialSecurityKeyLogin":"/resources/v1/manage/security-key/login"},"allowGetBrowserFingerprint":true,"allowNewI18Library":true,"renderInkLoginApp":true,"assetPreloaderUrl":null,"pseudoLouserzationEnabled":false,"rebrandingEnabled":true},"stateData":{"state":"invite","oAuthLoginHintQS":null,"oAuthLoginHintCookie":null,"usernamePostAction":null,"logoBytes":null,"data":{"state":"activate_user","login_uri":null,"submission_uri":"/v2/usertoaccountinvite/activateuser","data":{"email":"jminot@santaclaraca.gov","account_name":"City of Santa Clara","username":"Julie Minot","password":null,"access_code":null,"question_answer_pairs":null,"is_federated_user":false,"compliance_jurisdiction_country_code":null,"user_invite_id":"fdb77111-bcb1-4de7-9cf7-12ceb00583af","accept_invitation":null,"access_code_remaining_attempts":null,"error":null,"phone_country_code":null,"phone_number":null,"sms_verification_is_locked_out":null,"sms_code":null},"password_requirements":null,"forgot_password_questions":null,"activation_view_template":"DefaultActivationPage","locale":null,"usePrivacyAndTermsLinkFromIntlLibrary":true}},"error":null}
Source: https://account.docusign.com/v2/usertoaccountinvite/tokenhandlerHTTP Parser: Number of links: 0
Source: https://account.docusign.com/v2/usertoaccountinvite/tokenhandlerHTTP Parser: Base64 decoded: {"version":3,"sources":["C:\\D:\\W\\Account\\src\\Account.Web\\ReactApp\\src\\styles\\app.scss"],"names":[],"mappings":"AAAA,gBACI,WAAA,CAGJ,oCAGI,cAAA,CAGJ,8BACI,qBAAA,CAGJ,YACI,gBAAA,CAGJ,gCAEI,eAAA,CAGJ,UACI,WAAA,CACA,mBAAA,CAGJ,YACI,kBAAA,CAGJ,8BAEI,c...
Source: https://account.docusign.com/v2/usertoaccountinvite/tokenhandlerHTTP Parser: No <meta name="author".. found
Source: https://account.docusign.com/v2/usertoaccountinvite/tokenhandlerHTTP Parser: No <meta name="author".. found
Source: https://account.docusign.com/v2/usertoaccountinvite/tokenhandlerHTTP Parser: No <meta name="copyright".. found
Source: https://account.docusign.com/v2/usertoaccountinvite/tokenhandlerHTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://na.account.docusign.com/managed_token/v1/redeem?mtid=1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1&mtsec=g0zdjudsmcdg5himjqr_crgws2pwh7xfcz8mptgg7bu
Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://na.account.docusign.com/managed_token/v1/redeem?mtid=1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1&mtsec=g0zdjudsmcdg5himjqr_crgws2pwh7xfcz8mptgg7bu
Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox ViewIP Address: 104.47.64.28 104.47.64.28
Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+3tn694lw7ARtCC&MD=GM4kVTc9 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+3tn694lw7ARtCC&MD=GM4kVTc9 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_token%2Fv1%2Fredeem%3Fmtid%3D1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1%26mtsec%3Dg0ZdjUDSmcDg5hiMJqr_CrgwS2PWh7xFCz8MPTgg7bU&data=05%7C02%7Cjminot%40santaclaraca.gov%7C293c1debb86346386e5108dd083f4fec%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638675791173233740%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=zh70XBLyl1Yk%2FobcOIaGGrzaz5on5sHW8pIVGI2mtKI%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_token%2Fv1%2Fredeem%3Fmtid%3D1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1%26mtsec%3Dg0ZdjUDSmcDg5hiMJqr_CrgwS2PWh7xFCz8MPTgg7bU&data=05%7C02%7Cjminot%40santaclaraca.gov%7C293c1debb86346386e5108dd083f4fec%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638675791173233740%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=zh70XBLyl1Yk%2FobcOIaGGrzaz5on5sHW8pIVGI2mtKI%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: gcc02.safelinks.protection.outlook.com
Source: global trafficDNS traffic detected: DNS query: na.account.docusign.com
Source: global trafficDNS traffic detected: DNS query: account.docusign.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global trafficDNS traffic detected: DNS query: telemetry.docusign.net
Source: unknownHTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: chromecache_69.13.dr, chromecache_80.13.drString found in binary or memory: http://eligrey.com
Source: Account Activation.emlString found in binary or memory: http://schema.org/Creat=
Source: Account Activation.emlString found in binary or memory: http://schema.org/EmailMessage
Source: Account Activation.emlString found in binary or memory: https://NA3.docusign.net/Member/Image.aspx?i=3Dlogo&amp;l=3Ddfc210ae-23=
Source: Account Activation.emlString found in binary or memory: https://NA3.docusign.net/Member/Image.aspx?i=3Dlogo&l=3Ddfc210ae-=
Source: ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drString found in binary or memory: https://NA3.docusign.net/Member/Image.aspx?i=logo&l=dfc210ae-23d7-43b0-a87f-9d7897b9775f
Source: Account Activation.emlString found in binary or memory: https://NA3.docusign.net/member/Imag=
Source: ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drString found in binary or memory: https://NA3.docusign.net/member/Images/email/accountActivation-white.png
Source: Account Activation.eml, ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drString found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: Account Activation.emlString found in binary or memory: https://community.docusign.com/esignature-=
Source: Account Activation.emlString found in binary or memory: https://docucdn-a.a=
Source: Account Activation.emlString found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-a=
Source: Account Activation.emlString found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-te=
Source: ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drString found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png
Source: Account Activation.emlString found in binary or memory: https://gcc02.sa=
Source: Account Activation.emlString found in binary or memory: https://gcc02.safelin=
Source: Account Activation.emlString found in binary or memory: https://gcc02.safelinks.pro=
Source: Account Activation.emlString found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?=
Source: Account Activation.emlString found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2=
Source: Account Activation.emlString found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fcommuni=
Source: Account Activation.emlString found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F=
Source: ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drString found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.docusign.com%2Fesignatur
Source: ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drString found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_
Source: ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drString found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2F&data=05%7C
Source: ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drString found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2Fs%2Farticle
Source: ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drString found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.docusign.com%2Ffeatures-and-be
Source: Account Activation.emlString found in binary or memory: https://gcc02.safelinks=
Source: chromecache_69.13.dr, chromecache_80.13.drString found in binary or memory: https://gist.github.com/1129031
Source: chromecache_82.13.drString found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_82.13.drString found in binary or memory: https://github.com/zloirock/core-js/blob/v3.25.0/LICENSE
Source: chromecache_82.13.drString found in binary or memory: https://github.com/zloirock/core-js/blob/v3.36.1/LICENSE
Source: Account Activation.emlString found in binary or memory: https://na.account.docusign.com/managed_t=
Source: Account Activation.emlString found in binary or memory: https://na.account.docusign.com/managed_token/v1/redeem?mtid=3D1afd3=
Source: Account Activation.emlString found in binary or memory: https://support.docusign.com/s/ar=
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.ca/company/privacy-policy
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.ca/company/terms-and-conditions/web
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.co.uk/company/privacy-policy
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.co.uk/company/terms-and-conditions/web
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.com.au/company/privacy-policy
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.com.au/company/terms-and-conditions/web
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.com.br/politica-de-privacidade
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.com.br/termos-uso
Source: chromecache_82.13.drString found in binary or memory: https://www.docusign.com/company/privacy-policy
Source: chromecache_82.13.drString found in binary or memory: https://www.docusign.com/company/terms-and-conditions/web
Source: Account Activation.emlString found in binary or memory: https://www.docusign.com/features-and-benefits/mob=
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.de/unternehmen/agb
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.de/unternehmen/datenschutz
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.es/empresa/condiciones-de-uso/web
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.es/empresa/politica-de-privacidad
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.fr/conditions-generales-d-utilisation
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.fr/societe/politique-de-confidentialite
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.jp/company/privacy-policy
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.jp/company/terms-and-conditions/web
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.mx/compania/condiciones-de-uso/web
Source: chromecache_79.13.dr, chromecache_82.13.drString found in binary or memory: https://www.docusign.mx/compania/politica-de-privacidad
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: classification engineClassification label: clean4.winEML@26/43@18/4
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241119T1627210236-7056.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Account Activation.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "232B3E22-7832-4ABB-BB8F-3CE1B02474C6" "1816B496-C878-4E9C-AC1E-3156942D4F74" "7056" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_token%2Fv1%2Fredeem%3Fmtid%3D1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1%26mtsec%3Dg0ZdjUDSmcDg5hiMJqr_CrgwS2PWh7xFCz8MPTgg7bU&data=05%7C02%7Cjminot%40santaclaraca.gov%7C293c1debb86346386e5108dd083f4fec%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638675791173233740%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=zh70XBLyl1Yk%2FobcOIaGGrzaz5on5sHW8pIVGI2mtKI%3D&reserved=0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_token%2Fv1%2Fredeem%3Fmtid%3D1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1%26mtsec%3Dg0ZdjUDSmcDg5hiMJqr_CrgwS2PWh7xFCz8MPTgg7bU&data=05%7C02%7Cjminot%40santaclaraca.gov%7C293c1debb86346386e5108dd083f4fec%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638675791173233740%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=zh70XBLyl1Yk%2FobcOIaGGrzaz5on5sHW8pIVGI2mtKI%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1704 --field-trial-handle=1884,i,11741520992509703267,8091029071197411952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2000,i,4706141409970112763,1385621711572975550,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "232B3E22-7832-4ABB-BB8F-3CE1B02474C6" "1816B496-C878-4E9C-AC1E-3156942D4F74" "7056" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_token%2Fv1%2Fredeem%3Fmtid%3D1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1%26mtsec%3Dg0ZdjUDSmcDg5hiMJqr_CrgwS2PWh7xFCz8MPTgg7bU&data=05%7C02%7Cjminot%40santaclaraca.gov%7C293c1debb86346386e5108dd083f4fec%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638675791173233740%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=zh70XBLyl1Yk%2FobcOIaGGrzaz5on5sHW8pIVGI2mtKI%3D&reserved=0Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_token%2Fv1%2Fredeem%3Fmtid%3D1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1%26mtsec%3Dg0ZdjUDSmcDg5hiMJqr_CrgwS2PWh7xFCz8MPTgg7bU&data=05%7C02%7Cjminot%40santaclaraca.gov%7C293c1debb86346386e5108dd083f4fec%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638675791173233740%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=zh70XBLyl1Yk%2FobcOIaGGrzaz5on5sHW8pIVGI2mtKI%3D&reserved=0Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1704 --field-trial-handle=1884,i,11741520992509703267,8091029071197411952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2000,i,4706141409970112763,1385621711572975550,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: Google Drive.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		1
Process Injection		LSASS Memory12
System Information Discovery		Remote Desktop ProtocolData from Removable Media3
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive4
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1558883 Sample: Account Activation.eml Startdate: 19/11/2024 Architecture: WINDOWS Score: 4 6 OUTLOOK.EXE 69 127 2->6         started        process3 8 chrome.exe 8 6->8         started        11 chrome.exe 6->11         started        13 ai.exe 6->13         started        dnsIp4 20 192.168.2.16, 138, 443, 49709 unknown unknown 8->20 22 239.255.255.250 unknown Reserved 8->22 15 chrome.exe 8->15         started        18 chrome.exe 11->18         started        process5 dnsIp6 24 gcc02.safelinks.eop-tm2.outlook.com 104.47.64.28, 443, 49721, 49722 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 15->24 26 www.google.com 142.250.184.196, 443, 49729 GOOGLEUS United States 15->26 28 5 other IPs or domains 15->28

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://gcc02.safelin=0%Avira URL Cloudsafe
https://docucdn-a.a=0%Avira URL Cloudsafe
https://gcc02.safelinks=0%Avira URL Cloudsafe
https://gcc02.safelinks.pro=0%Avira URL Cloudsafe
https://gcc02.sa=0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
gcc02.safelinks.eop-tm2.outlook.com
104.47.64.28
truefalse
    		high
    www.google.com
    		142.250.184.196
    		truefalse
      		high
      account.docusign.com
      		unknown
      		unknownfalse
        		high
        telemetry.docusign.net
        		unknown
        		unknownfalse
          		high
          docucdn-a.akamaihd.net
          		unknown
          		unknownfalse
            		high
            na.account.docusign.com
            		unknown
            		unknownfalse
              		high
              gcc02.safelinks.protection.outlook.com
              		unknown
              		unknownfalse
                		high

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                https://account.docusign.com/v2/usertoaccountinvite/tokenhandlerfalse
                  		high
                  https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_token%2Fv1%2Fredeem%3Fmtid%3D1afd3250-63ab-4ef4-bd0c-9b9f82e9d0a1%26mtsec%3Dg0ZdjUDSmcDg5hiMJqr_CrgwS2PWh7xFCz8MPTgg7bU&data=05%7C02%7Cjminot%40santaclaraca.gov%7C293c1debb86346386e5108dd083f4fec%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638675791173233740%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=zh70XBLyl1Yk%2FobcOIaGGrzaz5on5sHW8pIVGI2mtKI%3D&reserved=0false
                    		high

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drfalse
                      		high
                      https://gcc02.safelin=Account Activation.emlfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://www.docusign.fr/conditions-generales-d-utilisationchromecache_79.13.dr, chromecache_82.13.drfalse
                        		high
                        https://www.docusign.es/empresa/condiciones-de-uso/webchromecache_79.13.dr, chromecache_82.13.drfalse
                          		high
                          https://gcc02.safelinks.protection.outlook.com/?=Account Activation.emlfalse
                            		high
                            https://github.com/zloirock/core-jschromecache_82.13.drfalse
                              		high
                              https://www.docusign.jp/company/privacy-policychromecache_79.13.dr, chromecache_82.13.drfalse
                                		high
                                https://www.docusign.com.br/termos-usochromecache_79.13.dr, chromecache_82.13.drfalse
                                  		high
                                  https://gcc02.sa=Account Activation.emlfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://www.docusign.fr/societe/politique-de-confidentialitechromecache_79.13.dr, chromecache_82.13.drfalse
                                    		high
                                    https://github.com/zloirock/core-js/blob/v3.36.1/LICENSEchromecache_82.13.drfalse
                                      		high
                                      https://www.docusign.ca/company/terms-and-conditions/webchromecache_79.13.dr, chromecache_82.13.drfalse
                                        		high
                                        https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.docusign.com%2Ffeatures-and-be~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drfalse
                                          		high
                                          https://gist.github.com/1129031chromecache_69.13.dr, chromecache_80.13.drfalse
                                            		high
                                            https://www.docusign.es/empresa/politica-de-privacidadchromecache_79.13.dr, chromecache_82.13.drfalse
                                              		high
                                              https://NA3.docusign.net/Member/Image.aspx?i=3Dlogo&amp;l=3Ddfc210ae-23=Account Activation.emlfalse
                                                		high
                                                https://www.docusign.com.br/politica-de-privacidadechromecache_79.13.dr, chromecache_82.13.drfalse
                                                  		high
                                                  https://docucdn-a.a=Account Activation.emlfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://na.account.docusign.com/managed_t=Account Activation.emlfalse
                                                    		high
                                                    https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fcommuni=Account Activation.emlfalse
                                                      		high
                                                      https://www.docusign.com.au/company/privacy-policychromecache_79.13.dr, chromecache_82.13.drfalse
                                                        		high
                                                        https://www.docusign.com/features-and-benefits/mob=Account Activation.emlfalse
                                                          		high
                                                          https://www.docusign.co.uk/company/privacy-policychromecache_79.13.dr, chromecache_82.13.drfalse
                                                            		high
                                                            https://www.docusign.mx/compania/condiciones-de-uso/webchromecache_79.13.dr, chromecache_82.13.drfalse
                                                              		high
                                                              https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.docusign.com%2Fesignatur~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drfalse
                                                                		high
                                                                https://www.docusign.jp/company/terms-and-conditions/webchromecache_79.13.dr, chromecache_82.13.drfalse
                                                                  		high
                                                                  https://NA3.docusign.net/member/Images/email/accountActivation-white.png~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drfalse
                                                                    		high
                                                                    https://www.docusign.com/company/privacy-policychromecache_82.13.drfalse
                                                                      		high
                                                                      https://www.docusign.ca/company/privacy-policychromecache_79.13.dr, chromecache_82.13.drfalse
                                                                        		high
                                                                        https://www.docusign.mx/compania/politica-de-privacidadchromecache_79.13.dr, chromecache_82.13.drfalse
                                                                          		high
                                                                          https://gcc02.safelinks=Account Activation.emlfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://www.docusign.de/unternehmen/agbchromecache_79.13.dr, chromecache_82.13.drfalse
                                                                            		high
                                                                            https://www.docusign.com/company/terms-and-conditions/webchromecache_82.13.drfalse
                                                                              		high
                                                                              https://www.docusign.com.au/company/terms-and-conditions/webchromecache_79.13.dr, chromecache_82.13.drfalse
                                                                                		high
                                                                                https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2=Account Activation.emlfalse
                                                                                  		high
                                                                                  https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-te=Account Activation.emlfalse
                                                                                    		high
                                                                                    https://support.docusign.com/s/ar=Account Activation.emlfalse
                                                                                      		high
                                                                                      https://community.docusign.com/esignature-=Account Activation.emlfalse
                                                                                        		high
                                                                                        http://schema.org/EmailMessageAccount Activation.emlfalse
                                                                                          		high
                                                                                          https://NA3.docusign.net/Member/Image.aspx?i=logo&l=dfc210ae-23d7-43b0-a87f-9d7897b9775f~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drfalse
                                                                                            		high
                                                                                            https://github.com/zloirock/core-js/blob/v3.25.0/LICENSEchromecache_82.13.drfalse
                                                                                              		high
                                                                                              https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna.account.docusign.com%2Fmanaged_~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drfalse
                                                                                                		high
                                                                                                https://aka.ms/LearnAboutSenderIdentificationAccount Activation.eml, ~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drfalse
                                                                                                  		high
                                                                                                  https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2F&data=05%7C~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drfalse
                                                                                                    		high
                                                                                                    https://NA3.docusign.net/Member/Image.aspx?i=3Dlogo&l=3Ddfc210ae-=Account Activation.emlfalse
                                                                                                      		high
                                                                                                      https://www.docusign.de/unternehmen/datenschutzchromecache_79.13.dr, chromecache_82.13.drfalse
                                                                                                        		high
                                                                                                        https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-a=Account Activation.emlfalse
                                                                                                          		high
                                                                                                          https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F=Account Activation.emlfalse
                                                                                                            		high
                                                                                                            https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2Fs%2Farticle~WRS{C02B5362-29B7-4A97-92C7-9F0222456895}.tmp.1.drfalse
                                                                                                              		high
                                                                                                              https://NA3.docusign.net/member/Imag=Account Activation.emlfalse
                                                                                                                		high
                                                                                                                https://gcc02.safelinks.pro=Account Activation.emlfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://www.docusign.co.uk/company/terms-and-conditions/webchromecache_79.13.dr, chromecache_82.13.drfalse
                                                                                                                  		high
                                                                                                                  http://schema.org/Creat=Account Activation.emlfalse
                                                                                                                    		high
                                                                                                                    http://eligrey.comchromecache_69.13.dr, chromecache_80.13.drfalse
                                                                                                                      		high
                                                                                                                      https://na.account.docusign.com/managed_token/v1/redeem?mtid=3D1afd3=Account Activation.emlfalse
                                                                                                                        		high

                                                                                                                        World Map of Contacted IPs

                                                                                                                        • No. of IPs < 25%
                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                        • 75% < No. of IPs

                                                                                                                        Public IPs

                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                        142.250.184.196
                                                                                                                        		www.google.comUnited States
                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                        239.255.255.250
                                                                                                                        		unknownReserved
                                                                                                                        		unknownunknownfalse
                                                                                                                        104.47.64.28
                                                                                                                        		gcc02.safelinks.eop-tm2.outlook.comUnited States
                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

                                                                                                                        Private

                                                                                                                        IP
                                                                                                                        192.168.2.16

                                                                                                                        General Information

                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                        Analysis ID:1558883
                                                                                                                        Start date and time:2024-11-19 22:26:49 +01:00
                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                        Overall analysis duration:0h 4m 24s
                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                        Report type:full
                                                                                                                        Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                        Number of analysed new started processes analysed:18
                                                                                                                        Number of new started drivers analysed:0
                                                                                                                        Number of existing processes analysed:0
                                                                                                                        Number of existing drivers analysed:0
                                                                                                                        Number of injected processes analysed:0
                                                                                                                        Technologies:
                                                                                                                        • EGA enabled
                                                                                                                        • AMSI enabled
                                                                                                                        Analysis Mode:default
                                                                                                                        Analysis stop reason:Timeout
                                                                                                                        Sample name:Account Activation.eml
                                                                                                                        Detection:CLEAN
                                                                                                                        Classification:clean4.winEML@26/43@18/4
                                                                                                                        Cookbook Comments:
                                                                                                                        • Found application associated with file extension: .eml

                                                                                                                        Warnings

                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                                        • Excluded IPs from analysis (whitelisted): 199.232.214.172, 52.113.194.132, 52.109.68.129, 2.19.126.151, 2.19.126.160, 13.89.179.14, 142.250.186.131, 142.250.184.206, 173.194.76.84, 34.104.35.123, 64.207.216.25, 185.81.100.38, 185.81.100.37, 2.18.64.204, 2.18.64.213, 185.81.101.86, 142.250.184.195
                                                                                                                        • Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, clientservices.googleapis.com, account-na-pin.docusign.com.akadns.net, telemetry-eu.docusign.net.akadns.net, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, account-geo.docusign.com.akadns.net, roaming.officeapps.live.com, a1737.b.akamai.net, clients2.google.com, login.live.com, update.googleapis.com, frc-azsc-000.roaming.officeapps.live.com, a1864.dscd.akamai.net, ecs.office.com, fs.microsoft.com, accounts.google.com, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, docucdn-a.akamaihd.net.edgesuite.net, account-eu.docusign.com.akadns.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, telemetry-geo.docusign.net.akadns.net, onedscolprdcus18.centralus.cloudapp.azure.com, ecs.office.trafficmanager.net, clients.l.google.com, omex.cdn.office
                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                        • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                        • VT rate limit hit for: Account Activation.eml

                                                                                                                        Simulations

                                                                                                                        Behavior and APIs

                                                                                                                        ⊘No simulations