Edit tour

Windows Analysis Report
https://url.us.m.mimecastprotect.com/s/si15COYvJJSRLD3svhDSGbOPs?domain=ejfv5thbb.cc.rs6.net

Overview

General Information

Sample URL:	https://url.us.m.mimecastprotect.com/s/si15COYvJJSRLD3svhDSGbOPs?domain=ejfv5thbb.cc.rs6.net
Analysis ID:	1589219
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious Javascript

Detected use of open redirect vulnerability

HTML page contains hidden email address

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1848,i,1023819414230903717,17607305642939854274,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.us.m.mimecastprotect.com/s/si15COYvJJSRLD3svhDSGbOPs?domain=ejfv5thbb.cc.rs6.net" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.5.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://dkjndlsknld-secondary.z13.web.core.windows... This script exhibits several high-risk behaviors, including data exfiltration, dynamic code execution, and redirection to a suspicious domain. The script extracts the user's email from the URL hash, validates it, and then constructs a dynamic URL with the email parameter and 10 random numbers before a base64-encoded domain. This URL is then used to redirect the user, which is a common technique used in phishing and malware campaigns. Additionally, the script uses the `atob` function to decode the base64-encoded domain, which could be used to hide the true destination of the redirect. Overall, the combination of these behaviors suggests a high risk of malicious intent.

Detected use of open redirect vulnerability

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Proxy from: www.applyweb.com/shibboleth/shibboleth.sso/logout?return=https://sharingforsharepoint.z13.web.core.windows.net/ to https://sharingforsharepoint.z13.web.core.windows.net/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Proxy from: www.applyweb.com/shibboleth/shibboleth.sso/logout?return=https://sharingsharepoinonline.z13.web.core.windows.net/ to https://sharingsharepoinonline.z13.web.core.windows.net/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Proxy from: www.applyweb.com/shibboleth/shibboleth.sso/logout?return=https://dkjndlsknld-secondary.z13.web.core.windows.net/ to https://dkjndlsknld-secondary.z13.web.core.windows.net/

HTML page contains hidden email address

Source: https://d3.kihnccf7.sa.com/?t=scott%40lcatterton.com&gclid=EAIaIQobChMIiMTQotWhiQMVAEgdCR0rHgdmEAEYASAAEgIlb_D_BwE&dclid=CNaO6uyo7ooDFeeT_QcdKscRAA

HTTP Parser: scott@lcatterton.com