Windows Analysis Report
https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a

Overview

General Information

Sample URL:	https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a
Analysis ID:	1538484

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.100.72:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.100.72:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49745 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.76
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.76
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.76
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	DNS traffic detected: DNS query: eu.docusign.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.100.72:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.100.72:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49745 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@16/18@10/50

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=1944,i,15766038114611442975,6622158521713803456,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=1944,i,15766038114611442975,6622158521713803456,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
2.16.164.115	unknown	European Union	20940	AKAMAI-ASN1EU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.140	unknown	European Union	16625	AKAMAI-ASUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
185.81.100.28	unknown	Germany	62856	DOCUS-6-PRODUS	false
216.58.206.35	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.16

Contacted Domains

Name	IP	Active
www.google.com	142.250.186.132	true
eu.docusign.net	unknown	unknown
docucdn-a.akamaihd.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://eu.docusign.net/Signing/Error.aspx?e=2bc40c4c-42f4-41a3-ab10-b43acba97a92&scope=f5acd408-933f-44fb-8be4-1fd9f8354c81&la=en-GB	false		unknown

ID:	1538484
Product:	CloudBasic
Start time:	11:51:16
Start date:	21.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	7DD80E15EF595F24A626D42C6C2D6AD9	7E68CE0F0467E5E92F60C3B900E54260F214F1C7	EEEA45B8C645F97F65D531D834B6AACA3B3AE5B59D77E2B71AA0E235A0F7ACC5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B7816EBDF4E3D542EC2EF78990CCECAE	0E67F74FA38A2CF824B5B77284D3726B23ADE211	B220E98E6371D10BCC4AF3A4014EB6763B1613528B787CE884BB54619C8A3CE5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	EE59AA0725AAD09A397EC0424F1C4BD1	AD7826FCE3DB6423E3B98F8E33B57BD0C9B0C4DF	AC21DB16E35A804DEB850C52DB39033CC6756A28CEB9198285C7E0F7D2AC7A8A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	2E960C08C98222463185780B9F0CC927	98776802A8334CAC81623336A1C03743CFA78BE8	DCBCB8636C9E928878DD174D7888719B6F7B4333037CE15CE2FD9F18972CC22A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	15512ADE7DD077EED3F3635CA3A48E3F	B9830984B1A390EB83784BA48294F58BC5AA63B0	4A9F946B5D761DFCC87109B2AC957FD64DB7002BEBF45A93D9181760D2084F98
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B7C5282CE4C932A33E40B35FFBAEB61C	D44B2E5CB0B80C49B75FAEA9ECF4972241AFD08C	BA864BA3066C27F1159175F6E06D46E376E4E5A146BF48AC2C5786978D30BAB1
Chrome Cache Entry: 67	ASCII text, with CRLF line terminators	4B86605C4B80FA75342703878E7DFF13	6EF59F904C58E88B3E143BA3DA464AFE63FDC188	2F186CDFA13B6CA51F69D44BAC8A7D5B69E1D5409A68D21F5768A87C6DFDB3A1
Chrome Cache Entry: 68	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced	C863DB426897325CB4805B2C20F51F30	A426FE43F0CE1A489CE091CC27768CDCC2991210	2A5179B8851C8E3DFC77D7DCB33B3963AFA037608336D6AE412ACAA38AD59D22
Chrome Cache Entry: 69	SVG Scalable Vector Graphics image	855476199961A10981ADCA7432CEC048	7995725A0CAC73EB6A2A1B5A8D5B162DBF47988E	6DD60FAA0E35F2DFE342C452ED414A084D384D11793BD0F0EB03C2B1C6F1405C
Chrome Cache Entry: 70	Web Open Font Format, CFF, length 33752, version 0.0	4DE7535F6F5DF8D5437C21C068DDB0EC	3553204B4624CA41CF1C4F3BD9B37D8C968CBA23	8F6A520A392FF62149E5FC5AA87BFAB9B3816CD6010D4D4FCA194E8683CA498B
Chrome Cache Entry: 71	PNG image data, 643 x 261, 8-bit/color RGB, non-interlaced	5CC1977B21BF780731B87028942FFD6D	80D7113EF2323BC839FC79BF43FD37C4D7E03993	CDFA2C94A06FA985649F2853A1D1BC2C64CD1B487B5EB6EBB2DCFAAEA5DE2FB9
Chrome Cache Entry: 72	ASCII text, with very long lines (65446), with CRLF line terminators	954F70F07F05742168ADCEBA796DDA72	EDF8A6A066F201B1FFAD32C585BD79C9982D4433	4DA87C258ECA460D39CDB0F6158CBF69AF539D05A1D14F1BC011518511D02228
Chrome Cache Entry: 73	ASCII text	CB4FD3AF4DEEBD7277FCD75A576BF633	71A7BC5DE0F92581F2A9F8DCED86578E01B4856C	F6C29AE65E37D866FEFB836DB488C4D044414798EC995B2B69CD067949938DD9
Chrome Cache Entry: 75	Web Open Font Format, CFF, length 34820, version 0.0	FD117C9EB999E35D64BE1515D5B2192D	B0FAE4091AC17A28C47AF531A9D5B73B4C35F6BD	553582BE8A5D2779D1A9E9C3A6698FD4D365E01353D8876A7204DB68FCD1D12D
Chrome Cache Entry: 77	ASCII text, with very long lines (13479), with CRLF line terminators	2779F5D2F1F22353C726240E530016CC	2B3F380F212C8C64E79DB1F47FA25C114AFE6FBB	16496529F57AC8915F194E00479B04AF942C33D7897BCFD9A55DD072BBEC1411
Chrome Cache Entry: 80	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	3165AF715E6BA5CA2B00F9AB5277CC8C	99697540AAC85B979624E1A09483418A4C30BD11	08034C30A67418DD7BFF599A0EA4ECB87315D485ADB3BD1774AFC36B33705317
Chrome Cache Entry: 82	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	AFE00DB89CE086B91A541C227EDBF136	961B2EE6FB39C4D515BDC49EC1BA688B0916F104	E11827C678AF8519E702F364E525AC34509CAD49F8D839677E089949EDDA060E
Chrome Cache Entry: 84	SVG Scalable Vector Graphics image	EC396047518A7FEF11D53D1B4F6BE65B	E3BEC4CDAF5567641517A23019ADBFA2328B0A7F	8F77CFC832517C619BC1B8D82A6A478EE18D97442B4C78B006B0286CEC91E1A8

Windows Analysis Report
https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a