Edit tour

Windows Analysis Report
https://516jm1zm.r.sa-east-1.awstrack.me/L0/https:%2F%2Fcloud.screenconnect.com.by%2FMMvmajre/1/01030195ed466068-b7faa7cb-1833-4388-bad8-b1418ddcc4cd-000000/XFv4Glw7SIWsIew07KwB0pk-9m0=204

Overview

General Information

Sample URL:	https://516jm1zm.r.sa-east-1.awstrack.me/L0/https:%2F%2Fcloud.screenconnect.com.by%2FMMvmajre/1/01030195ed466068-b7faa7cb-1833-4388-bad8-b1418ddcc4cd-000000/XFv4Glw7SIWsIew07KwB0pk-9m0=204
Analysis ID:	1654035
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious URL

Creates files inside the system directory

Deletes files inside the Windows folder

Detected clear text password fields (password is not hidden)

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1836,i,4517099522123772398,1928466465589598627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2200 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6796 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://516jm1zm.r.sa-east-1.awstrack.me/L0/https:%2F%2Fcloud.screenconnect.com.by%2FMMvmajre/1/01030195ed466068-b7faa7cb-1833-4388-bad8-b1418ddcc4cd-000000/XFv4Glw7SIWsIew07KwB0pk-9m0=204" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-01T21:25:09.793905+0200	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49861	35.211.202.130	443	TCP
2025-04-01T21:25:09.821229+0200	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49863	104.18.27.193	443	TCP
2025-04-01T21:25:10.024921+0200	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49866	34.111.113.62	443	TCP
2025-04-01T21:25:10.379983+0200	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49875	35.211.202.130	443	TCP

ET MALWARE Magecart Loader Javascript

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-01T21:24:58.134093+0200	2043311	2	Potentially Bad Traffic	186.2.165.31	443	192.168.2.4	49733	TCP
2025-04-01T21:24:58.905754+0200	2043311	2	Potentially Bad Traffic	186.2.165.31	443	192.168.2.4	49736	TCP

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://cloud.screenconnect.com.by/#/	Joe Sandbox AI: Score: 8 Reasons: The brand 'ScreenConnect' is known and associated with remote support and access software., The legitimate domain for ScreenConnect is 'screenconnect.com'., The URL 'cloud.screenconnect.com.by' includes the legitimate domain but is followed by an unusual country code top-level domain (ccTLD) '.by', which is not typically associated with ScreenConnect., The presence of 'cloud' as a subdomain is not inherently suspicious, but the additional '.by' extension raises concerns., The URL structure suggests a potential phishing attempt due to the unusual domain extension and possible misuse of the brand name. DOM: 1.4.pages.csv
Source: https://cloud.screenconnect.com.by/#/	Joe Sandbox AI: Score: 7 Reasons: The brand 'ScreenConnect' is known and associated with remote support and access software., The legitimate domain for ScreenConnect is 'screenconnect.com'., The URL 'cloud.screenconnect.com.by' includes the legitimate domain but is appended with an unusual country code top-level domain (ccTLD) '.by', which is not typically associated with ScreenConnect., The presence of 'cloud' as a subdomain is not inherently suspicious, but the additional '.by' extension raises concerns., The URL structure suggests a potential phishing attempt due to the unusual domain extension and possible misuse of the brand name. DOM: 1.7.pages.csv

AI detected suspicious URL

Source: https://cloud.screenconnect.com.by

Joe Sandbox AI: The URL 'https://cloud.screenconnect.com.by' closely resembles the legitimate URL 'https://cloud.screenconnect.com', which is associated with ConnectWise, a known brand providing remote support and access solutions. The addition of the '.by' country code top-level domain (ccTLD) could be an attempt to mislead users into thinking it is a legitimate regional variant of the ConnectWise service. The structural similarity is high due to the identical subdomain and primary domain name. However, the '.by' extension could also indicate a legitimate regional service or unrelated use, which slightly reduces the likelihood of it being a typosquatting attempt. The visual similarity and potential for user confusion are significant, but the context of the '.by' extension needs further investigation to confirm intent.