Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1

Overview

General Information

Sample URL:https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1
Analysis ID:1596300

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected non-DNS traffic on DNS port
HTML body contains low number of good links
HTML title does not match URL
Stores files to the Windows start menu directory
Suspicious form URL found

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 4632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • chrome.exe (PID: 2204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1984,i,8929456659198726693,7205788356387702446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • chrome.exe (PID: 2704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1Avira URL Cloud: detection malicious, Label: phishing
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Number of links: 1
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Title: Empowering Tomorrow Through Innovation does not match URL
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49756 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.18:62030 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:62031 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:62032 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:62033 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.18:62034 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.23.227.215:443 -> 192.168.2.18:62037 version: TLS 1.2
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: global trafficTCP traffic: 192.168.2.18:62029 -> 162.159.36.2:53
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.206
Source: global trafficDNS traffic detected: DNS query: microsoft-teams-download.burleson-appliance.net
Source: global trafficDNS traffic detected: DNS query: code.jquery.com
Source: global trafficDNS traffic detected: DNS query: image.ibb.co
Source: global trafficDNS traffic detected: DNS query: cookieconsent.popupsmart.com
Source: global trafficDNS traffic detected: DNS query: i.ibb.co
Source: global trafficDNS traffic detected: DNS query: netdna.bootstrapcdn.com
Source: global trafficDNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global trafficDNS traffic detected: DNS query: unpkg.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62066 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62037 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62032
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62033
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62034
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62035
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62036
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62037
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62038
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62068 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62031 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 62034 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62066
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62068
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62030 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62033 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49679 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62036 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62032 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62035 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62030
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62031
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 62038 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49756 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.18:62030 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:62031 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:62032 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:62033 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.18:62034 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.23.227.215:443 -> 192.168.2.18:62037 version: TLS 1.2
Source: classification engineClassification label: mal48.win@18/47@26/256
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1984,i,8929456659198726693,7205788356387702446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1984,i,8929456659198726693,7205788356387702446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Drive-by Compromise
Windows Management Instrumentation1
Registry Run Keys / Startup Folder
1
Process Injection
1
Masquerading
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder
1
Process Injection
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Obfuscated Files or Information
Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1100%Avira URL Cloudphishing
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
cdn.jsdelivr.net.cdn.cloudflare.net
104.18.187.31
truefalse
    high
    netdna.bootstrapcdn.com
    104.18.11.207
    truefalse
      high
      code.jquery.com
      151.101.130.137
      truefalse
        high
        microsoft-teams-download.burleson-appliance.net
        104.21.16.1
        truefalse
          unknown
          cookieconsent.popupsmart.com
          104.26.6.46
          truefalse
            unknown
            image.ibb.co
            91.134.10.182
            truefalse
              unknown
              www.google.com
              142.250.185.164
              truefalse
                high
                unpkg.com
                104.17.246.203
                truefalse
                  high
                  i.ibb.co
                  91.134.10.168
                  truefalse
                    high
                    cdn.jsdelivr.net
                    unknown
                    unknownfalse
                      high
                      206.23.85.13.in-addr.arpa
                      unknown
                      unknownfalse
                        high
                        NameMaliciousAntivirus DetectionReputation
                        https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1true
                          unknown
                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs
                          IPDomainCountryFlagASNASN NameMalicious
                          142.250.185.99
                          unknownUnited States
                          15169GOOGLEUSfalse
                          142.250.186.67
                          unknownUnited States
                          15169GOOGLEUSfalse
                          142.250.185.206
                          unknownUnited States
                          15169GOOGLEUSfalse
                          104.18.187.31
                          cdn.jsdelivr.net.cdn.cloudflare.netUnited States
                          13335CLOUDFLARENETUSfalse
                          104.26.6.46
                          cookieconsent.popupsmart.comUnited States
                          13335CLOUDFLARENETUSfalse
                          142.250.181.234
                          unknownUnited States
                          15169GOOGLEUSfalse
                          151.101.130.137
                          code.jquery.comUnited States
                          54113FASTLYUSfalse
                          74.125.206.84
                          unknownUnited States
                          15169GOOGLEUSfalse
                          142.250.185.164
                          www.google.comUnited States
                          15169GOOGLEUSfalse
                          104.21.96.1
                          unknownUnited States
                          13335CLOUDFLARENETUSfalse
                          142.250.184.227
                          unknownUnited States
                          15169GOOGLEUSfalse
                          108.181.22.211
                          unknownCanada
                          852ASN852CAfalse
                          142.250.186.74
                          unknownUnited States
                          15169GOOGLEUSfalse
                          142.250.184.202
                          unknownUnited States
                          15169GOOGLEUSfalse
                          104.17.246.203
                          unpkg.comUnited States
                          13335CLOUDFLARENETUSfalse
                          142.250.185.67
                          unknownUnited States
                          15169GOOGLEUSfalse
                          104.21.16.1
                          microsoft-teams-download.burleson-appliance.netUnited States
                          13335CLOUDFLARENETUSfalse
                          1.1.1.1
                          unknownAustralia
                          13335CLOUDFLARENETUSfalse
                          91.134.10.182
                          image.ibb.coFrance
                          16276OVHFRfalse
                          104.18.11.207
                          netdna.bootstrapcdn.comUnited States
                          13335CLOUDFLARENETUSfalse
                          239.255.255.250
                          unknownReserved
                          unknownunknownfalse
                          142.250.186.142
                          unknownUnited States
                          15169GOOGLEUSfalse
                          142.250.186.100
                          unknownUnited States
                          15169GOOGLEUSfalse
                          91.134.10.168
                          i.ibb.coFrance
                          16276OVHFRfalse
                          IP
                          192.168.2.18
                          Joe Sandbox version:42.0.0 Malachite
                          Analysis ID:1596300
                          Start date and time:2025-01-21 22:58:39 +01:00
                          Joe Sandbox product:CloudBasic
                          Overall analysis duration:
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Cookbook file name:defaultwindowsinteractivecookbook.jbs
                          Sample URL:https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1
                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                          Number of analysed new started processes analysed:16
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • EGA enabled
                          Analysis Mode:stream
                          Analysis stop reason:Timeout
                          Detection:MAL
                          Classification:mal48.win@18/47@26/256
                          • Exclude process from analysis (whitelisted): svchost.exe
                          • Excluded IPs from analysis (whitelisted): 2.23.242.162, 142.250.185.99, 142.250.186.142, 74.125.206.84, 142.250.186.110, 216.58.212.174, 142.250.181.234, 142.250.186.67, 142.250.184.206, 142.250.184.202, 216.58.206.74, 216.58.206.42, 172.217.18.10, 172.217.16.202, 142.250.186.170, 142.250.185.170, 142.250.186.138, 142.250.184.234, 142.250.186.74, 172.217.23.106, 142.250.185.106, 172.217.18.106, 142.250.74.202, 142.250.185.202, 142.250.186.42
                          • Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, redirector.gvt1.com, e16604.g.akamaiedge.net, clients.l.google.com, prod.fs.microsoft.com.akadns.net
                          • Not all processes where analyzed, report is missing behavior information
                          • VT rate limit hit for: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1