Edit tour

Windows Analysis Report
phish_alert_sp2_2.0.0.0 lazz.msg

Overview

General Information

Sample name:	phish_alert_sp2_2.0.0.0 lazz.msg
Analysis ID:	1568498
MD5:	9f344d12395a40c4778c6d553ef88744
SHA1:	01d010b42b9b9290bbea431fb8f76f0aea9615ee
SHA256:	cd442aa4a33bcb644eea9f45d794106d5b1592db12d4ebe8f7acad3ef5e72943
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6988 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0 lazz.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6404 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "C28447BB-5454-4CB9-8A1F-490E9940EA37" "20A7967B-129E-49DD-8E0E-A560BC5FEC8C" "6988" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 4988 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1896,i,8975072533289051865,12011831519549534772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6988, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it

Joe Sandbox AI: Score: 7 Reasons: The URL 'powerforms.docusign.net' is a subdomain of 'docusign.net', which is associated with DocuSign, a known brand., The brand 'Itancia' is not directly associated with DocuSign, which raises suspicion., The URL uses a legitimate domain 'docusign.net', but the presence of a different brand name 'Itancia' could indicate a phishing attempt., DocuSign is a well-known brand, but 'Itancia' is not widely recognized, leading to potential confusion., The input fields are generic and do not provide specific context to the brand 'Itancia', which could be a tactic to gather personal information. DOM: 1.2.pages.csv

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: powerforms.docusign.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: eu.docusign.net
Source: global traffic	DNS traffic detected: DNS query: api-js.mixpanel.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0 lazz.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "C28447BB-5454-4CB9-8A1F-490E9940EA37" "20A7967B-129E-49DD-8E0E-A560BC5FEC8C" "6988" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "C28447BB-5454-4CB9-8A1F-490E9940EA37" "20A7967B-129E-49DD-8E0E-A560BC5FEC8C" "6988" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1896,i,8975072533289051865,12011831519549534772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1896,i,8975072533289051865,12011831519549534772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
api-js.mixpanel.com	130.211.34.183	true	false	high
www.google.com	172.217.17.36	true	false	high
eu.docusign.net	unknown	unknown	false	high
docucdn-a.akamaihd.net	unknown	unknown	false	high
powerforms.docusign.net	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
130.211.34.183	api-js.mixpanel.com	United States	15169	GOOGLEUS	false
172.217.17.36	www.google.com	United States	15169	GOOGLEUS	false
20.189.173.5	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
23.218.208.109	unknown	United States	6453	AS6453US	false
52.111.252.15	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.16.149.13	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
2.16.149.12	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
216.58.208.234	unknown	United States	15169	GOOGLEUS	false
64.233.164.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.28.46	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
64.207.216.225	unknown	United States	62856	DOCUS-6-PRODUS	false
2.19.198.17	unknown	European Union	16625	AKAMAI-ASUS	false
185.81.100.28	unknown	Germany	62856	DOCUS-6-PRODUS	false
52.109.76.243	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568498
Start date and time:	2024-12-04 17:15:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	phish_alert_sp2_2.0.0.0 lazz.msg
Detection:	MAL
Classification:	mal48.phis.winMSG@17/54@18/123
Cookbook Comments:	Found application associated with file extension: .msg

Input	Output
URL: Email Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Inizia l'apposizione della firma", "prominent_button_name": "Inizia l'apposizione della firma", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Email Model: Joe Sandbox AI	{ "brands": [ "Itancia" ] }
	{ "brands": [ "Itancia" ] }
URL: https://powerforms.docusign.net/8a9cfd80-0a52-4a8b... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This is a standard Webpack runtime initialization script. It's minified but not maliciously obfuscated. The code handles module loading, exports, and dependency management which is typical for bundled JavaScript applications. No suspicious behaviors like eval(), external data transmission, or DOM manipulation are present. The low risk score reflects only the minified nature of the code which slightly reduces readability." }
!function(e){function r(r){for(var n,f,l=r[0],p=r[1],i=r[2],c=0,s=[];c<l.length;c++)f=l[c],Object.prototype.hasOwnProperty.call(o,f)&&o[f]&&s.push(o[f][0]),o[f]=0;for(n in p)Object.prototype.hasOwnProperty.call(p,n)&&(e[n]=p[n]);for(a&&a(r);s.length;)s.shift()();return u.push.apply(u,i\|\|[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,l=1;l<t.length;l++){var p=t[l];0!==o[p]&&(n=!1)}n&&(u.splice(r--,1),e=f(f.s=t[0]))}return e}var n={},o={1:0},u=[];function f(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,f),t.l=!0,t.exports}f.m=e,f.c=n,f.d=function(e,r,t){f.o(e,r)\|\|Object.defineProperty(e,r,{enumerable:!0,get:t})},f.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},f.t=function(e,r){if(1&r&&(e=f(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(f.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)f.d(t,n,function(r){return e[r]}.bind(null,n));return t},f.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return f.d(r,"a",r),r},f.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},f.p="/";var l=this.webpackJsonppowerforms=this.webpackJsonppowerforms\|\|[],p=l.push.bind(l);l.push=r,l=l.slice();for(var i=0;i<l.length;i++)r(l[i]);var a=p;t()}([])
URL: https://powerforms.docusign.net Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://powerforms.docusign.net
URL: https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Dati firmatario PowerForm", "prominent_button_name": "Inizia l'apposizione della firma", "text_input_field_labels": [ "Il tuo nome:", "Il tuo indirizzo e-mail:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://powerforms.docusign.net/static/js/main.60f... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be a legitimate webpack bundle for a PowerForms application. It contains standard application code including locale handling, form submission logic, and sanitization. The code includes security best practices like URL sanitization and safe redirects. No suspicious behaviors or malicious patterns detected." }
(this.webpackJsonppowerforms=this.webpackJsonppowerforms\|\|[]).push([[0],{13:function(e,r,o){"use strict";o.d(r,"p",(function(){return a})),o.d(r,"q",(function(){return i})),o.d(r,"o",(function(){return n})),o.d(r,"a",(function(){return t})),o.d(r,"f",(function(){return l})),o.d(r,"e",(function(){return s})),o.d(r,"b",(function(){return m})),o.d(r,"c",(function(){return d})),o.d(r,"j",(function(){return c})),o.d(r,"m",(function(){return u})),o.d(r,"n",(function(){return _})),o.d(r,"l",(function(){return p})),o.d(r,"i",(function(){return f})),o.d(r,"g",(function(){return g})),o.d(r,"h",(function(){return v})),o.d(r,"k",(function(){return h})),o.d(r,"d",(function(){return b}));const a="SAGA_LOCALE_CHANGE",i="SAGA_POWERFORM_SUBMIT",n="SAGA_INIT_APP",t="CONTEXT_SET",l="MESSAGE_SHOW",s="MESSAGE_HIDE",m="LOADING_START",d="LOADING_STOP",c="POWERFORM_RECIPIENT_UPDATE",u="POWERFORM_VALIDATION_ERROR_SET",_="POWERFORM_VALIDATION_ERROR_UNSET",p="POWERFORM_UPDATE_FROM_API",f="POWERFORM_RECIPIENT_EMPTY_STATE_SET",g="POWERFORM_COLLAPSE",v="POWERFORM_DISABLE_SUBMIT_BUTTON",h="POWERFORM_STATUS_SET",b="LOCALE_SET";function y(e,r){const o={type:e,payload:r};return r instanceof Error&&(o.error=!0),o}const w={initApp:(e,r,o,a)=>y(n,{params:e,query:r,hdnStartValues:o,hdnPersistOriginalValues:a}),changeLocale:e=>y(a,{langCode:e}),submitPowerform:(e,r,o,a,n,t,l,s,m,d,c,u)=>y(i,{server:e,recipients:r,powerformId:o,query:a,hdnStartValues:n,hdnPersistOriginalValues:t,successfullyActivated:l,EnablePowerformsV2_UI_Feature3:s,clientTransactionId:m,FRM_1438_EnablePowerFormsRestAPI:d,createEnvelope:c,accountId:u}),setContext:(e,r,o,a,i)=>y(t,{params:e,query:r,hdnStartValues:o,hdnPersistOriginalValues:a,hasAlreadyPosted:i}),setErrorContext:e=>y(t,{apiError:e}),showMessage:(e,r,o)=>y(l,{id:e,kind:r,text:o}),hideMessage:e=>y(s,{id:e}),startLoading:()=>y(m),stopLoading:()=>y(d),updatePowerFormFromApi:e=>y(p,{powerform:e}),updatePowerFormRecipient:(e,r)=>y(c,{role:e,value:r}),setEmptyStatePowerFormRecipient:(e,r)=>y(f),setPowerFormValidationErrors:e=>y(u,{errors:e}),unsetValidationError:(e,r)=>y(_,{role:e,field:r}),collapseForm:()=>y(g),disableSubmitButton:()=>y(v),setLocale:e=>y(b,e),status:(e,r)=>y(h,{status:e,nextAction:r}),setHasAlreadyPosted:e=>y(t,{hasAlreadyPosted:e})};r.r=w},130:function(e,r,o){"use strict";o.d(r,"b",(function(){return g})),o.d(r,"c",(function(){return b}));var a=o(17),i=o.n(a),n=o(173),t=o.n(n),l=o(381),s=o(132),m=o(310),d=o.n(m);const c="https://apps.dev.docusign.net/",u="https://apps-s.docusign.com/",_="https://apps-d.docusign.com/",p="https://apps.docusign.com/",f=e=>{switch(e){case"hqtest0.dev":case"hqtest1.dev":case"hqtest2.dev":case"hqtest3.dev":case"tk1r1s1":case"tk1r2s1":case"local":case"powerforms01.hqtest.tst":case"powerforms02.hqtest.tst":case"powerforms03.hqtest.tst":return c;case"stage":case"stage-app":return u;case"demo":case"demo-app":return _;default:return p}};d.a.allowedAttributes.p=["style"];const g=()=>{const e=t.a.parse(window.location.search),r=i.a.find(document.cookie.split(";"),(e=>e.indexOf("DocuSignLanguage")>-1));if(e.lang)return e.lang;if(e.recipientLang){const r=s.b[e.recipientLang];if(r)return r}else if(r)return r.split("=")[1];const o=window.navigator.userLanguage\|\|window.navigator.language,a=s.b[o.toLowerCase().replace("_","-")]\|\|s.b[o.replace("_","-").split(/-(.+)/)[0]];return a\|\|"en"},v={...s.a},h={},b=(e,r)=>{i.a.flatten([r]).forEach((r=>{v[r]={...v[r],...e}}))};r.a=(e,r,o,a,i,n)=>(h[r]=h[r]\|\|((e,r)=>Object(l.a)((e=>"en_PS"===r?Object(l.b)(e):v[r]&&v[r][e]\|\|e)))(0,r),o?n?d.a.sanitize(h[r](e),{a:(e,o)=>({tagName:e,attribs:{...o,href:"".concat(f(i),"safe-redirect?source=powerform&context=").concat(a,"&lang=").concat(r,"&url=").concat(encodeURIComponent(o.href))}})}):d.a.sanitize(h[r](e)):h[r](e).replace(/<(.\|\n)*?>/g,"").replace(/[&]nbsp[;]/gi,""))},132:function(e,r,o){"use strict";o.d(r,"b",(function(){return W}));var a=o(88),i=o(244),n=o(581),t=o(582),l=o(583),s=o(584),m=o(585),d=o(586),c=o(587),u=o(588),_=o
URL: https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it Model: Joe Sandbox AI	{ "brands": [ "Itancia" ] }
	{ "brands": [ "Itancia" ] }
URL: https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it Model: Joe Sandbox AI	```json{ "legit_domain": "docusign.com", "classification": "unknown", "reasons": [ "The URL 'powerforms.docusign.net' is a subdomain of 'docusign.net', which is associated with DocuSign, a well-known brand.", "The brand 'Itancia' is not commonly associated with DocuSign, and it is not a well-known brand.", "The URL does not contain any suspicious elements such as misspellings or unusual domain extensions.", "The presence of input fields for name and email is typical for forms, but without further context, it does not indicate phishing.", "The domain 'docusign.net' is a legitimate domain used by DocuSign, but the association with 'Itancia' is unclear." ], "riskscore": 4}
URL: powerforms.docusign.net Brands: Itancia Input Fields: Il tuo nome:, Il tuo indirizzo e-mail:
URL: https://powerforms.docusign.net/static/js/2.a890ce... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be a minified JavaScript bundle from webpack, likely containing UI framework code (based on references to style manipulation and DOM operations). While it uses some DOM manipulation and contains minified/compressed code, these are standard practices for production JavaScript bundles. No malicious patterns or high-risk behaviors are observed." }
/! For license information please see 2.a890cee5.chunk.js.LICENSE.txt / (this.webpackJsonppowerforms=this.webpackJsonppowerforms\|\|[]).push([[2],[function(e,t,r){"use strict";e.exports=r(822)},function(e,t,r){"use strict";r.d(t,"a",(function(){return Ze})),r.d(t,"b",(function(){return Ge})),r.d(t,"c",(function(){return We})),r.d(t,"d",(function(){return qe})),r.d(t,"e",(function(){return Ye}));var n=r(0);var o=function(){function e(e){var t=this;this._insertTag=function(e){var r;r=0===t.tags.length?t.insertionPoint?t.insertionPoint.nextSibling:t.prepend?t.container.firstChild:t.before:t.tags[t.tags.length-1].nextSibling,t.container.insertBefore(e,r),t.tags.push(e)},this.isSpeedy=void 0===e.speedy\|\|e.speedy,this.tags=[],this.ctr=0,this.nonce=e.nonce,this.key=e.key,this.container=e.container,this.prepend=e.prepend,this.insertionPoint=e.insertionPoint,this.before=null}var t=e.prototype;return t.hydrate=function(e){e.forEach(this._insertTag)},t.insert=function(e){this.ctr%(this.isSpeedy?65e3:1)===0&&this._insertTag(function(e){var t=document.createElement("style");return t.setAttribute("data-emotion",e.key),void 0!==e.nonce&&t.setAttribute("nonce",e.nonce),t.appendChild(document.createTextNode("")),t.setAttribute("data-s",""),t}(this));var t=this.tags[this.tags.length-1];if(this.isSpeedy){var r=function(e){if(e.sheet)return e.sheet;for(var t=0;t<document.styleSheets.length;t++)if(document.styleSheets[t].ownerNode===e)return document.styleSheets[t]}(t);try{r.insertRule(e,r.cssRules.length)}catch(i){}}else t.appendChild(document.createTextNode(e));this.ctr++},t.flush=function(){this.tags.forEach((function(e){var t;return null==(t=e.parentNode)?void 0:t.removeChild(e)})),this.tags=[],this.ctr=0},e}(),i="-ms-",a="-moz-",s="-webkit-",c="comm",u="rule",l="decl",f="@keyframes",d=Math.abs,p=String.fromCharCode,h=Object.assign;function g(e,t){return 45^b(e,0)?(((t<<2^b(e,0))<<2^b(e,1))<<2^b(e,2))<<2^b(e,3):0}function m(e){return e.trim()}function v(e,t){return(e=t.exec(e))?e[0]:e}function _(e,t,r){return e.replace(t,r)}function y(e,t){return e.indexOf(t)}function b(e,t){return 0\|e.charCodeAt(t)}function w(e,t,r){return e.slice(t,r)}function S(e){return e.length}function x(e){return e.length}function C(e,t){return t.push(e),e}function E(e,t){return e.map(t).join("")}var A=1,T=1,M=0,k=0,O=0,I="";function R(e,t,r,n,o,i,a){return{value:e,root:t,parent:r,type:n,props:o,children:i,line:A,column:T,length:a,return:""}}function D(e,t){return h(R("",null,null,"",null,null,0),e,{length:-e.length},t)}function L(){return O=k<M?b(I,k++):0,T++,10===O&&(T=1,A++),O}function N(){return b(I,k)}function j(){return k}function B(e,t){return w(I,e,t)}function P(e){switch(e){case 0:case 9:case 10:case 13:case 32:return 5;case 33:case 43:case 44:case 47:case 62:case 64:case 126:case 59:case 123:case 125:return 4;case 58:return 3;case 34:case 39:case 40:case 91:return 2;case 41:case 93:return 1}return 0}function z(e){return A=T=1,M=S(I=e),k=0,[]}function H(e){return I="",e}function F(e){return m(B(k-1,q(91===e?e+2:40===e?e+1:e)))}function U(e){for(;(O=N())&&O<33;)L();return P(e)>2\|\|P(O)>3?"":" "}function V(e,t){for(;--t&&L()&&!(O<48\|\|O>102\|\|O>57&&O<65\|\|O>70&&O<97););return B(e,j()+(t<6&&32==N()&&32==L()))}function q(e){for(;L();)switch(O){case e:return k;case 34:case 39:34!==e&&39!==e&&q(O);break;case 40:41===e&&q(e);break;case 92:L()}return k}function G(e,t){for(;L()&&e+O!==57&&(e+O!==84\|\|47!==N()););return"/"+B(t,k-1)+""+p(47===e?e:L())}function W(e){for(;!P(N());)L();return B(e,k)}function Y(e){return H($("",null,null,null,[""],e=z(e),0,[0],e))}function $(e,t,r,n,o,i,a,s,c){for(var u=0,l=0,f=a,d=0,h=0,g=0,m=1,v=1,w=1,x=0,E="",M=o,R=i,D=n,B=E;v;)switch(g=x,x=L()){case 40:if(108!=g&&58==b(B,f-1)){-1!=y(B+=_(F(x),"&","&\f"),"&\f")&&(w=-1);break}case 34:case 39:case 91:B+=F(x);break;case 9:case 10:case 13:case 32:B+=U(g);break;case 92:B+=V(j()-1,7);continue;case 47:switch(N()){case 42:case 47:C(Z(G(L(),j()),t,r),c);break;default:B+="/"}break;case 123m:s[u++]=S(B)w;
URL: https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Inserire il nome e l'indirizzo e-mail di ciascun firmatario. I firmatari riceveranno un'e-mail di invito a firmare questo documento.", "prominent_button_name": "Inizia l'apposizione della firma", "text_input_field_labels": [ "Il tuo nome: ", "Nome obbligatorio", "Il tuo indirizzo e-mail: ", "E-mail obbligatoria" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it Model: Joe Sandbox AI	{ "brands": [ "Itancia" ] }
	{ "brands": [ "Itancia" ] }
URL: https://powerforms.docusign.net/8a9cfd80-0a52-4a8b-ab04-d0df7438fa47?env=eu&acct=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&accountId=d44dc5b1-71a4-4c3c-bd23-8874f5053d8c&recipientLang=it Model: Joe Sandbox AI	```json{ "legit_domain": "docusign.com", "classification": "known", "reasons": [ "The URL 'powerforms.docusign.net' is a subdomain of 'docusign.net', which is associated with DocuSign, a known brand.", "The brand 'Itancia' is not directly associated with DocuSign, which raises suspicion.", "The URL uses a legitimate domain 'docusign.net', but the presence of a different brand name 'Itancia' could indicate a phishing attempt.", "DocuSign is a well-known brand, but 'Itancia' is not widely recognized, leading to potential confusion.", "The input fields are generic and do not provide specific context to the brand 'Itancia', which could be a tactic to gather personal information." ], "riskscore": 7} Google indexed: False
URL: powerforms.docusign.net Brands: Itancia Input Fields: Il tuo nome: , Nome obbligatorio, Il tuo indirizzo e-mail: , E-mail obbligatoria
URL: https://docusign.net Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://docusign.net

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	231348
Entropy (8bit):	4.389625226608627
Encrypted:	false
SSDEEP:
MD5:	34BC4CBAA377E18261353B9A085C5F1F
SHA1:	FF8A544AF4FA3662E9300D404D6CD4F6A03761C1
SHA-256:	C114180BD224462ACE5EC8CD4957B61B8F38432BC2C1C633B8B50D00479754A1
SHA-512:	72A2C036B85C4F503104CEF7E496FE6CABDAD6212A0F1FF8330AB216256786FE034EEFD8F5E8EA7952879B263D41A48D0382113FF323371F2C5A5C99A3F32859
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ..n.gF......SM01X...,....=.gF..........IPM.Activity...........h...............h............H..h4.o......4:....h.........\..H..h\cal ...pDat...h...0.....o....h.2............h........_`Pk...h'3.@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k_.D.....e.....!h.............. h-.y[......o...#h....8.........$h.\......8....."h.\......0_....'h..=...........1h.2.<.........0h....4....Uk../h....h.....UkH..hP!..p...4.o...-h ........o...+hc-....(.o......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (2163), with no line terminators
Category:	dropped
Size (bytes):	2163
Entropy (8bit):	5.083526072563054
Encrypted:	false
SSDEEP:
MD5:	435F35FD40AE5EFE81B3AFCE1CA24167
SHA1:	18C1D18734ABF8621C21B62787A187F934B3642F
SHA-256:	E5DFF826E33685BDFDA2EE21BF68E506AA1E423431F71C323E665A3663D9DD51
SHA-512:	05E5095B5F71ACAE40B317165EC0479D8FB8EE7F937CE16816B9FF647B94E7E7237318A4D72FD60B2ABFA57F6BB1900C5394CAC5DAA4D01BC3253BFCDC569D1D
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>14</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-12-04T16:15:41Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 4 15:16:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.998223552933169
Encrypted:	false
SSDEEP:
MD5:	C092C33BD44C8FA69E0DCCBBE06FCE37
SHA1:	C1F80ECE89E62F3826241CBAA6C59D3AA9C9DF5E
SHA-256:	0FC8DB995A1765110CFAE7719840A35CEA72731FC6D2865EF0598339C705D2B0
SHA-512:	09B49C20E7650D226E6C9E62D98CE774FC9217CAF0D918DCCC0D052C075DB7E4B5A6E2F9C23BABF7E76A3DECE6892CDA9EA9C698D5244BC8BDA7DF2D228BB8E1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........gF..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........S..z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	4.6232866526013865
TrID:	Outlook Message (71009/1) 50.89% Outlook Form Template (41509/1) 29.75% Microsoft Word document (old ver.) (19008/1) 13.62% Generic OLE2 / Multistream Compound File (8008/1) 5.74%
File name:	phish_alert_sp2_2.0.0.0 lazz.msg
File size:	94'208 bytes
MD5:	9f344d12395a40c4778c6d553ef88744
SHA1:	01d010b42b9b9290bbea431fb8f76f0aea9615ee
SHA256:	cd442aa4a33bcb644eea9f45d794106d5b1592db12d4ebe8f7acad3ef5e72943
SHA512:	6f492de7e3616eddf61951e1c21c7f1b0604a4994b9cd3949d5e3b8aee1532ba2eca0642bfcb8f7945a3c3d58cdf27b670f88ef259cb925644a6f946a9a65863
SSDEEP:	1536:uMkrEjhf2nHSSMCEm8saYOrhJCRtIeDMdWbc4Ew0gFlzmuWKWNmY3:0SSMCEm8saYO+tIeI5xw00zEb3
TLSH:	A893B711BAFA1109F1F79F7685F66553893F7D269E25D90E2084330E19F2E00EC62B6B
File Content Preview:	........................>......................................................................................................................................................................................................................................

Subject:	Documento Amministratore per Store Itancia
From:	servizioclienti <servizioclienti@itancia.com>
To:	"andrea.lazzarino@kireygroup.com" <andrea.lazzarino@kireygroup.com>
Cc:
BCC:
Date:	Wed, 04 Dec 2024 16:39:38 +0100
Communications:
Attachments:	image001.png image002.png image003.png image004.png image005.png image006.png

Key	Value
Received	from AS8P251MB0935.EURP251.PROD.OUTLOOK.COM
15	39:38 +0000
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
h=From	Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass
by AS8PR08MB5877.eurprd08.prod.outlook.com (2603	10a6:20b:291::13) with
2024 15	39:38 +0000
(2603	10a6:209:82::44) with Microsoft SMTP Server (version=TLS1_3,
4 Dec 2024 15	39:42 +0000
Authentication-Results	spf=fail (sender IP is 18.185.115.174)
Received-SPF	Fail (protection.outlook.com: domain of itancia.com does not
via Frontend Transport; Wed, 4 Dec 2024 15	39:42 +0000
for <andrea.lazzarino@kireygroup.com>; Wed, 4 Dec 2024 15	39:39 +0000 (UTC)
X-TM-MAIL-RECEIVED-TIME	1733326779.990000
X-TM-MAIL-UUID	e9feccbd-838e-4a64-a79f-2de4eb60fe51
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed;
by AM9P251MB0173.EURP251.PROD.OUTLOOK.COM (2603	10a6:20b:41e::17) with
([fe80	:5ca1:e45d:5bae:2096%4]) with mapi id 15.20.8207.017; Wed, 4 Dec 2024
From	servizioclienti <servizioclienti@itancia.com>
To	"andrea.lazzarino@kireygroup.com" <andrea.lazzarino@kireygroup.com>
Subject	Documento Amministratore per Store Itancia
Thread-Topic	Documento Amministratore per Store Itancia
Thread-Index	AdtGP5G9PUWuzfKGRGuy0zcV8MAUNQABELNQAATjXcAAAtXZAA==
Date	Wed, 4 Dec 2024 15:39:38 +0000
Message-ID	<AS8P251MB093509592D39799DD01127B891372@AS8P251MB0935.EURP251.PROD.OUTLOOK.COM>
References	<AS8P251MB093543CB8C1D9CD8584110B491372@AS8P251MB0935.EURP251.PROD.OUTLOOK.COM>
In-Reply-To	<AS8P251MB09353A09BB9DDF9FA19E962991372@AS8P251MB0935.EURP251.PROD.OUTLOOK.COM>
Accept-Language	it-IT, en-US
Content-Language	it-IT
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator	Authentication-Results-Original: dkim=none (message not signed)
x-ms-exchange-messagesentrepresentingtype	1
x-ms-traffictypediagnostic	AS8P251MB0935:EE_\|AM9P251MB0173:EE_\|AMS0EPF000001B1:EE_\|AS8PR08MB5877:EE_\|AS8PR08MB6024:EE_
X-MS-Office365-Filtering-Correlation-Id	27038335-f50e-4705-8549-08dd1479df39
x-ms-exchange-senderadcheck	1
x-ms-exchange-antispam-relay	0
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:13230040\|366016\|1800799024\|376014\|8096899003\|38070700018;
X-Microsoft-Antispam-Message-Info-Original	=?us-ascii?Q?PO6cQ9QHn3tNEhq1rvGS6OUMxA+r8A0dLNXb2Xhw8PLnKtl9cLHn31aeuw/C?=
X-Forefront-Antispam-Report-Untrusted	CIP:255.255.255.255;CTRY:;LANG:it;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8P251MB0935.EURP251.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014)(8096899003)(38070700018);DIR:OUT;SFP:1102;
Content-Type	multipart/related;
MIME-Version	1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped	AS8PR08MB5877
X-TM-Received-SPF	Pass (domain of servizioclienti@itancia.com designates
X-TM-Authentication-Results	spf=pass (sender IP address: 40.107.104.119)
X-TM-AS-ERS	40.107.104.119-127.5.21.1
X-TMASE-Version	StarCloud-1.3-9.1.1028-28838.000
X-TMASE-Result	10--26.659000-4.500000
X-TMASE-MatchedRID	7u3eoxEoplARpXdJQyf5BQsSAMq1ugbcY9xoykdyAsPafagkQ8GmrH5+
X-TMASE-SNAP-Result	1.821001.0001-0-1-22:0,28:1,33:0,34:0,42:1-0
X-TMASE-XGENCLOUD	a15d2b86-1afa-4a2f-bac2-525b7f06b521-0-0-200-0
X-TM-Deliver-Signature	461C31272743A816C757A02B2F292CF6
X-TM-Addin-Auth	Y+kdc1D8QyYO9pb+rrKvfIOXLS7yj3UA3HV+hXHrwOwtKK3UNUNu+2ofMBd
X-TM-Addin-ProductCode	EMS
Return-Path	servizioclienti@itancia.com
X-MS-Exchange-Organization-ExpirationStartTime	04 Dec 2024 15:39:42.5165
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	27038335-f50e-4705-8549-08dd1479df39
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	dbcf5543-63e3-46f0-99c1-ff8b22e4521a:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped	AMS0EPF000001B1.eurprd05.prod.outlook.com
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	AMS0EPF000001B1.eurprd05.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id-Prvs	a1ae08d4-561f-4540-5a2b-08dd1479dcb3
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|35042699022\|5063199012\|5073199012\|4073199012\|22003199012\|8096899003;
X-Forefront-Antispam-Report	CIP:18.185.115.174;CTRY:DE;LANG:it;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:inpost.tmes.trendmicro.eu;PTR:inpost.tmes.trendmicro.eu;CAT:NONE;SFS:(13230040)(35042699022)(5063199012)(5073199012)(4073199012)(22003199012)(8096899003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	04 Dec 2024 15:39:42.4228
X-MS-Exchange-CrossTenant-Network-Message-Id	27038335-f50e-4705-8549-08dd1479df39
X-MS-Exchange-CrossTenant-Id	dbcf5543-63e3-46f0-99c1-ff8b22e4521a
X-MS-Exchange-CrossTenant-AuthSource	AMS0EPF000001B1.eurprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-EndToEndLatency	00:00:04.4009242
X-MS-Exchange-Processed-By-BccFoldering	15.20.8207.017
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?qJVMJw7B/D5ef8lM9aE8z959Vq6n6DTR9kf1XEMhgnaubBtXymtVgH7cvA90?=
date	Wed, 04 Dec 2024 16:39:38 +0100

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report phish_alert_sp2_2.0.0.0 lazz.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Montserrat\26023618743.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Montserrat\33107994939.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\941D5E3E-5B70-4E65-AC28-98744CD54DCC

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\849E4F93.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\858E848F.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\95199C78.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A47CD146.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E5CC219.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F4ED6B5A.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{127DE2C4-34AE-4BC5-BA0C-686C6855AE7B}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733328937756494600_9E28777B-F680-41B7-BF24-BDA76734FA73.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733328937757185800_9E28777B-F680-41B7-BF24-BDA76734FA73.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241204T1115370537-6988.etl

C:\Users\user\AppData\Local\Temp\~DF332CACB7349903EC.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Windows Analysis Report
phish_alert_sp2_2.0.0.0 lazz.msg

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre