Edit tour

Windows Analysis Report
http://loginmicrosoftonline.Ssc.qnkproductions.com/cache/css/Ssc/mwoods@ssc.nsw.gov.au

Overview

General Information

Sample URL:	http://loginmicrosoftonline.Ssc.qnkproductions.com/cache/css/Ssc/mwoods@ssc.nsw.gov.au
Analysis ID:	1587113
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious Javascript

AI detected suspicious URL

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Sigma detected: Cloudflared Tunnels Related DNS Requests

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6388 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2460,i,9337243340682880175,7282942331356758864,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://loginmicrosoftonline.Ssc.qnkproductions.com/cache/css/Ssc/mwoods@ssc.nsw.gov.au" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Cloudflared Tunnels Related DNS Requests

Source: DNS query

Author: Nasreddine Bencherchali (Nextron Systems): Data: Image: C:\Program Files\Google\Chrome\Application\chrome.exe, QueryName: ld-elliott-huge-preview.trycloudflare.com

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://loginmlcrosoftonlino365.pages.dev/#?email=mwoods@ssc.nsw.gov.au	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'loginmlcrosoftonlino365.pages.dev' contains misspellings of 'Microsoft' and 'online', which are common phishing tactics., The domain 'pages.dev' is a generic domain often used for hosting various types of content, which can include phishing sites., The presence of '365' in the URL suggests an attempt to mimic Microsoft's Office 365 service, increasing suspicion., The URL does not match the legitimate domain name associated with Microsoft. DOM: 1.4.pages.csv
Source: https://loginmlcrosoftonlino365.pages.dev/#?email=mwoods@ssc.nsw.gov.au	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'loginmlcrosoftonlino365.pages.dev' contains misspellings of 'Microsoft' and 'online', which are common phishing tactics., The domain 'pages.dev' is a generic domain often used for hosting various types of content, which can include phishing sites., The presence of '365' in the URL suggests an attempt to mimic Microsoft's Office 365 service, increasing the likelihood of phishing., The URL does not match the legitimate domain name associated with Microsoft. DOM: 1.6.pages.csv
Source: https://loginmlcrosoftonlino365.pages.dev/#?email=mwoods@ssc.nsw.gov.au	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft services is 'microsoft.com'., The URL 'loginmlcrosoftonlino365.pages.dev' contains misspellings of 'Microsoft' and 'online', which are common phishing tactics., The domain 'pages.dev' is a generic domain often used for hosting various web pages, which is not typically associated with Microsoft., The presence of '365' in the URL suggests an attempt to mimic Microsoft 365 services, increasing suspicion. DOM: 1.5.pages.csv

AI detected suspicious Javascript

Source: 2.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://loginmlcrosoftonlino365.pages.dev/#?email=... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While some of the behaviors may have legitimate purposes, the overall implementation raises significant security concerns.

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: http://loginmicrosoftonline.Ssc.qnkproductions.com
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: http://loginmicrosoftonline.Ssc.qnkproductions.com