Windows Analysis Report
https://url.uk.m.mimecastprotect.com/s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com

Overview

General Information

Sample URL: https://url.uk.m.mimecastprotect.com/s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com
Analysis ID: 1524303
Infos:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Stores files to the Windows start menu directory

Classification

Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49724 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com HTTP/1.1Host: url.uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /r/oVmfKtrMaWNW0Ws36O78X_OkOKFuIHUHD3fz7q0tusMdFQdR7TDnm8aybopRegBVFa0fun8jf60zlrCHjmFXWf-EV8YvX6Bxir0QElT0x5MDaJByV7iaxvirocNzwSqJ2_U4_91FKjKJ3R0d1LDPRs9iW641qXHX8EKq7oXNKFj_z_fUC2u9OSaKRXsoNLxOOqa4qArDFFSZpfDji2tw5bTqPI9bmNaG-xY0B9eOHhNSKQxj3uA01up_ounuskoro3uNrT2YyHg1H26ZfccCjXX8-1EHdXSftewHVQ6eR_Q2IOEA1Z_eugsw83gWILgscBIINGDyyzZ8KI6evR2S_uVYYv0IdRr56rVAyHZqemWQq_wzideYC6YczzLiuCssUbZmO43algTCfZ9xqvIgB64EmsxoiXKfCLMM64Vro51Paj3iJVWQqAv67bhu3cPmpd59yNFLkjWnn92djaZBucUagc4Md-kkA2h4mqkaofSa2HpcZRAv6wN206tKwz0pATikgQNqqXyE3GbFYM_ke0ANq6EvzG_C3R96tkIaTtKzON326KECzqRhtPe-QGuUI6eMbVCeVx4ozeO3pPUNPagKvQLmE0XiptLj2FekJFc6h2pwYiZJdOwXaalB72j4vC7mrzv6YM9M8lufek_wNMbNN3IsdK7xsix3OyX9mUAVjjuntwm8WIxJNpa87gSploLQKqMLmCaqW-GaFLzEuEZh9hIK-KMpW_KVktsMubY7A7LSSWu9Za7BdypkYhiBh0dYsQ2YLIMnXESgfdDHRW6_dHpckgUlpBpwb_cmAJ79OPqRtdzJztdM-i7BUYj3B_ZR5S6vI-HgVbklaoZMPGE5qDVDPdrOLzsISyBdKou5yEIC4iHH-rjpgZERSX9LHE7GsC4xtwSrLHYpHgBK_jFJPHOzjjlAf6tJWOgIpeKVYys0GoItilz2M7_vbcPdb1uazFO3rmtVp5o8tgx_9mBxLDY9W8WP3DHTKo2ZJgkg00HhX_VWbYRFsHJdhVV6_Irj3SspM9_Q2XUDvpI8h1FUM5GzIS69AVxE3_bSwp8PJodBXLxn906Zc8C-ibz4S7cRURhLiW6tFoETjNveNxYqQsHu5udAGp_K51_7RHKwiqXSxuhEWPnecamZeNR3YggvAqWhh0YxLdQm4l3FTklzQjV02JxlG6822Nuf_zbvVdQ5PEO-n7MRceplYDHHWzche4ECZC8KTsJFu3oTvDWQSzR8QkVm6FmhG8z7aRkA5YSEbO9pPA-5rSQiPwiQD0iMEcUA5j8qFN54WDsTso11R-9wL3yGI2flRDfAnx3BFwLE0_3MYbtEf7jbKQfQF3pixC1A8YdbpOQUmBGyiUP1fRDwgnN8RLqjkN8lK29q6ivr_zpKdZXzc4PVieD7jpopgRxNRYFqL4_4bzwdd6o47cIpHqhvkt_StBV0H-0KUmkwOzjPPL5cXw1G4e5y8_StIqNUKURjFgNzS0KUbkYrL0Lv8Ckgex7ZVd3AcK5JTpoMRWOweXdMzeBlPHqfeVkE7t95EbxsWpCsjHBEUia0CSST6aa8_ganUaww5UO9tVCOzY3rCZMQ7xqOOg-S8ce5_Ifq1ycZe-nJX6scNQviiKpxgZ3cT_WiV0aNaPoa__c9HlEk8EbpJqg05pahsxhuBWL8nzE9czVQ87Vu5Uano3Ld4hvlYPCaCLzFQ3Qw9xfgmzjAlFPVIdzDf_pd9P9IxGLaFYEUFyL4_UghPfCMmwOz4LFDW8mBWW77g7hHr7Vs8i-UruyYBciy8ojtAd3D0cfN3_5VWjdoK5NTR4HjQkLcj_9FDeGzjDJMvf3T_ZdpwQLKmny7iAPP1sYjk1g_yjltNBPy7dsoG86blE25qbucr9abaJ9rSr72q_1X1d_tng8DEj8ibc-2CF_kKII4zLQb6imx7-qGAxfHrE01WrtwZycla_dz1Hu6jIQw1gVMVPpPJg9uVl_OjKn33h41xWzm586BZTyNwaqqNAgU_GxNZvzxoMtuRmovetcfNaAy7sjn9CazPODtNmhXLARicvA1ftQicqpLmQNXnODws0lP8aEXsl5HnwmMsxeFfy0tmuYvj00Aakgd8wrDkcERxTgWTvw4-GP4TfQEPFjZeXM68HwToqDB25l6F6voQ8AzA8vHsP9dJvAW0P6zXpaUStPxjZoRAuz1uVHtW50Fm5f5X-1u2NiQXG2-7QuVQyqxNgd3bDkRIjK0Z9NuUkVg_8Oqpnf0fJlDNH-R0puMgTVBEbrvC5uTDpdQrWuxODk08MW7yKud1cBw_l9GFYgjwiDpIbv_UKvrpSA83j9yUErNkIubuwBUsbJ0c49_Q67qT4G0ASvJg70VQcO0ORzqcyBXP2BMfgphTqDjhuvcj-bQcWhukLaVX9m3Kigx3qkSklNjTP5cZLtH-x5QS7SmXZMRnSeHuhciF7kKhE2rEuC4m93GAA8FhU9QmXf4-wO3pgbj-P3rppopcK4RQkUlN4hWXYR6xZ1rqlZVjweTZ8DT9qpFFzopZwVxEAnugK3brf6f1SNfboIG4FPuCdhlly73ZslQXALyNCJ1EMgc3gSF918PvmK2oqZXbZjTcW1CzX06UW2_iUTp2iWXx8VmMaK9ONIjYl9wGpdVhA HTTP/1.1Host: url.uk.m.mimecastprotect.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/sign
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /ttpwp HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/runtime.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/polyfills.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/styles.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/main.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2 HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://security-uk.m.mimecastprotect.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://security-uk.m.mimecastprotect.com/ttpwpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/runtime.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/polyfills.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/styles.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/main.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273 HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://security-uk.m.mimecastprotect.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://security-uk.m.mimecastprotect.com/ttpwpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/languages/en.json HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, */*Content-Type: application/jsonx-context-route: ttpwpsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/images/favicon.ico HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/languages/en.json HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /api/ttp/url/get-page-data HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ttpwp/resources/images/favicon.ico HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic DNS traffic detected: DNS query: url.uk.m.mimecastprotect.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: security-uk.m.mimecastprotect.com
Source: unknown HTTP traffic detected: POST /api/ttp/url/get-page-data HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveContent-Length: 173sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, */*Content-Type: application/jsonx-context-route: ttpwpsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://security-uk.m.mimecastprotect.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 15:13:32 GMTContent-Type: text/html; charset=utf-8Content-Length: 180Connection: closex-content-type-options: nosniffx-xss-protection: 1; mode=blockx-frame-options: SAMEORIGINReferrer-Policy: no-referrerX-Robots-Tag: noindex, nofollowStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U"Vary: Accept-Encoding
Source: chromecache_76.6.dr String found in binary or memory: http://www.mimecast.com/
Source: chromecache_76.6.dr String found in binary or memory: https://community.mimecast.com/docs/DOC-241
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49724 version: TLS 1.2
Source: classification engine Classification label: clean0.win@16/34@8/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2024,i,14144066786699680077,1103834911799437713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.uk.m.mimecastprotect.com/s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2024,i,14144066786699680077,1103834911799437713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Google Drive.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1524303 URL: https://url.uk.m.mimecastpr... Startdate: 02/10/2024 Architecture: WINDOWS Score: 0 5 chrome.exe 9 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.10, 138, 443, 49709 unknown unknown 5->13 15 239.255.255.250 unknown Reserved 5->15 10 chrome.exe 5->10         started        process4 dnsIp5 17 195.130.217.89, 443, 49727, 49728 MIMECAST-UKGB United Kingdom 10->17 19 url.uk.m.mimecastprotect.com 91.220.42.235, 443, 49709, 49710 MIMECAST-UKGB United Kingdom 10->19 21 2 other IPs or domains 10->21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.220.42.89
 security-uk.m.mimecastprotect.com United Kingdom
42427 MIMECAST-UKGB false
239.255.255.250
 unknown Reserved
unknown unknown false
91.220.42.235
 url.uk.m.mimecastprotect.com United Kingdom
42427 MIMECAST-UKGB false
195.130.217.89
 unknown United Kingdom
42427 MIMECAST-UKGB false
216.58.206.36
 www.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.10

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
url.uk.m.mimecastprotect.com 91.220.42.235 true
security-uk.m.mimecastprotect.com 91.220.42.89 true
www.google.com 216.58.206.36 true
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com 217.20.57.42 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://security-uk.m.mimecastprotect.com/ttpwp/resources/styles.5257ca6e429949972959.js false
    		unknown
    https://security-uk.m.mimecastprotect.com/ttpwp/resources/runtime.5257ca6e429949972959.js false
      		unknown
      https://security-uk.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273 false
        		unknown
        https://security-uk.m.mimecastprotect.com/ttpwp/resources/languages/en.json false
          		unknown
          https://security-uk.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2 false
            		unknown
            https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/mimecast-logo.png false
              		unknown
              https://security-uk.m.mimecastprotect.com/ttpwp/resources/main.5257ca6e429949972959.js false
                		unknown
                https://security-uk.m.mimecastprotect.com/ttpwp false
                  		unknown
                  https://security-uk.m.mimecastprotect.com/api/ttp/url/get-page-data false
                    		unknown
                    https://security-uk.m.mimecastprotect.com/ttpwp/#/block?key=OAPaJlOWQcvgsrT_iXGbgjqjmbEBF-q-27kltg4x8dCyP-6B1_VS26x_b-3_IKLQqjh-Lh5MBe7BzMhURffLVHCtnhl_FVakOs4kvrR7JeHTZSJ2pGXx3oDPk5DdH_P_ false
                      		unknown
                      https://url.uk.m.mimecastprotect.com/s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com false
                        		unknown
                        https://security-uk.m.mimecastprotect.com/ttpwp/resources/polyfills.5257ca6e429949972959.js false
                          		unknown
                          https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/favicon.ico false
                            		unknown