Windows Analysis Report
https://misdgs-my.sharepoint.com/:b:/g/personal/kristen_jepsen_midlothianisd_org/ERXXF8U4F95FjAC9auRgwsEBQzcdSK59c7Rmtysg5hLasw?e=iYGl5y

Overview

General Information

Sample URL: https://misdgs-my.sharepoint.com/:b:/g/personal/kristen_jepsen_midlothianisd_org/ERXXF8U4F95FjAC9auRgwsEBQzcdSK59c7Rmtysg5hLasw?e=iYGl5y
Analysis ID: 1431656

Detection

Score: 21
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Phishing site or detected (based on various text indicators)
Drops files with a non-matching file extension (content does not match file extension)
Phishing site detected (based on OCR NLP Model)
Stores files to the Windows start menu directory

Classification

Phishing
barindex
Phishing site or detected (based on various text indicators)
Source: Chrome DOM: 0.6 OCR Text: Cameron Barcuch.pdf Info 1/1 OneDrive for Business Cameron Barcuch shared a folder with Here' s the folder Cameron Barcuch shared with you. was mt to to sWtive Date created: 04/24/2024 Size 12.3MB_Expiry104/26/2024 Ref: Review 9-ared Dun-ents from Harvey-Cleary. "Click View and Print Online"
Phishing site detected (based on OCR NLP Model)
Source: Chrome DOM: 0.6 ML Model on OCR Text: Matched 98.4% probability on "Cameron Barcuch.pdf Info 1/1 OneDrive for Business Cameron Barcuch shared a folder with Here' s the folder Cameron Barcuch shared with you. was mt to to sWtive Date created: 04/24/2024 Size 12.3MB_Expiry104/26/2024 Ref: Review 9-ared Dun-ents from Harvey-Cleary. "Click View and Print Online" "
Source: unknown HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:50048 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: global traffic DNS traffic detected: DNS query: misdgs-my.sharepoint.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic DNS traffic detected: DNS query: southcentralus1-mediap.svc.ms
Source: global traffic DNS traffic detected: DNS query: pub-ee1102c6dfc849f796419e180217c001.r2.dev
Source: global traffic DNS traffic detected: DNS query: www.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 50434 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50232
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50231
Source: unknown Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50434
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 50232 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50231 -> 443
Source: unknown HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:50048 version: TLS 1.2
Source: classification engine Classification label: sus21.phis.win@16/651@26/239
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://misdgs-my.sharepoint.com/:b:/g/personal/kristen_jepsen_midlothianisd_org/ERXXF8U4F95FjAC9auRgwsEBQzcdSK59c7Rmtysg5hLasw?e=iYGl5y
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1872,i,7721565233012487753,10358329978768054565,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1872,i,7721565233012487753,10358329978768054565,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: Window Recorder Window detected: More than 3 window changes detected
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 943 Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.138.10
 dual-spo-0005.spo-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
23.223.31.18
 unknown United States
16625 AKAMAI-ASUS false
23.76.37.146
 unknown United States
19037 AMXArgentinaSAAR false
13.107.136.10
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
23.59.235.214
 unknown United States
16625 AKAMAI-ASUS false
96.7.218.35
 unknown United States
20940 AKAMAI-ASN1EU false
20.189.173.12
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
20.42.65.88
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
172.253.124.84
 unknown United States
15169 GOOGLEUS false
96.7.218.112
 unknown United States
20940 AKAMAI-ASN1EU false
104.208.16.91
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
52.104.114.39
 192863-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
74.125.136.101
 unknown United States
15169 GOOGLEUS false
142.250.9.95
 unknown United States
15169 GOOGLEUS false
74.125.138.94
 unknown United States
15169 GOOGLEUS false
104.16.124.96
 www.cloudflare.com United States
13335 CLOUDFLARENETUS false
64.233.177.94
 unknown United States
15169 GOOGLEUS false
23.50.120.17
 unknown United States
16625 AKAMAI-ASUS false
23.6.117.27
 unknown United States
20940 AKAMAI-ASN1EU false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
23.223.31.8
 unknown United States
16625 AKAMAI-ASUS false
104.18.2.35
 pub-ee1102c6dfc849f796419e180217c001.r2.dev United States
13335 CLOUDFLARENETUS false
172.253.124.113
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
64.233.177.147
 www.google.com United States
15169 GOOGLEUS false
52.168.117.169
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.16.123.96
 unknown United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
pub-ee1102c6dfc849f796419e180217c001.r2.dev 104.18.2.35 true
dual-spo-0005.spo-msedge.net 13.107.138.10 true
192863-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com 52.104.114.39 true
www.cloudflare.com 104.16.124.96 true
www.google.com 64.233.177.147 true
southcentralus1-mediap.svc.ms unknown unknown
misdgs-my.sharepoint.com unknown unknown
m365cdn.nel.measure.office.net unknown unknown
spo.nel.measure.office.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://misdgs-my.sharepoint.com/personal/kristen_jepsen_midlothianisd_org/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkristen%5Fjepsen%5Fmidlothianisd%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Harvey%2DCleary%2FCameron%20Barcuch%2Epdf&parent=%2Fpersonal%2Fkristen%5Fjepsen%5Fmidlothianisd%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Harvey%2DCleary&ga=1 false
    		unknown
    https://pub-ee1102c6dfc849f796419e180217c001.r2.dev/jamuilink.html false
      		unknown