Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1

Overview

General Information

Sample URL:https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1
Analysis ID:1596300

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Creates files inside the system directory
Deletes files inside the Windows folder
HTML body contains low number of good links
HTML title does not match URL
Suspicious form URL found

Classification

  • System is w11x64_office
  • chrome.exe (PID: 6188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 290DF23002E9B52249B5549F0C668A86)
    • chrome.exe (PID: 2576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1956,i,5890527656967956097,7500726405433405734,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2244 /prefetch:11 MD5: 290DF23002E9B52249B5549F0C668A86)
  • chrome.exe (PID: 4576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1" MD5: 290DF23002E9B52249B5549F0C668A86)
  • cleanup
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1Avira URL Cloud: detection malicious, Label: phishing
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Number of links: 1
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Title: Empowering Tomorrow Through Innovation does not match URL
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Form action: order.php
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: Iframe src: https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d193595.25280024676!2d-74.1444870506823!3d40.697631233268204!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x89c24fa5d33f083b%3A0xc80b8f06e177fe62!2sNew%20York%2C%20NY%2C%20USA!5e0!3m2!1sen!2snl!4v1687183542876!5m2!1sen!2snl
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No favicon
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="author".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1HTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.24:63194 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.24:63195 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 18MB later: 36MB
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Cache-Control: max-age = 3600Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 12 Feb 2024 22:07:27 GMTIf-None-Match: "65ca969f-2cd"User-Agent: Microsoft-CryptoAPI/10.0Host: x1.c.lencr.org
Source: global trafficDNS traffic detected: DNS query: microsoft-teams-download.burleson-appliance.net
Source: global trafficDNS traffic detected: DNS query: code.jquery.com
Source: global trafficDNS traffic detected: DNS query: image.ibb.co
Source: global trafficDNS traffic detected: DNS query: cookieconsent.popupsmart.com
Source: global trafficDNS traffic detected: DNS query: netdna.bootstrapcdn.com
Source: global trafficDNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global trafficDNS traffic detected: DNS query: unpkg.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: i.ibb.co
Source: unknownNetwork traffic detected: HTTP traffic on port 63180 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63178 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63171
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63173
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63172
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63175
Source: unknownNetwork traffic detected: HTTP traffic on port 63184 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63165 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63194 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63165
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63201
Source: unknownNetwork traffic detected: HTTP traffic on port 63175 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63203
Source: unknownNetwork traffic detected: HTTP traffic on port 63171 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63180
Source: unknownNetwork traffic detected: HTTP traffic on port 63181 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63181
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63184
Source: unknownNetwork traffic detected: HTTP traffic on port 63177 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63183
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63186
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63185
Source: unknownNetwork traffic detected: HTTP traffic on port 63185 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63203 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63195 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63177
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63176
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63179
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63178
Source: unknownNetwork traffic detected: HTTP traffic on port 63153 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63193
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63192
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63195
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63194
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63153
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63230
Source: unknownNetwork traffic detected: HTTP traffic on port 63186 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63163 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63192 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63189 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63230 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63187
Source: unknownNetwork traffic detected: HTTP traffic on port 63173 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63189
Source: unknownNetwork traffic detected: HTTP traffic on port 63179 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63183 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63162
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63163
Source: unknownNetwork traffic detected: HTTP traffic on port 63162 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63187 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63193 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63201 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63176 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63172 -> 443
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.24:63194 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.24:63195 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\scoped_dir6188_1414432323
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile deleted: C:\Windows\SystemTemp\scoped_dir6188_1414432323
Source: classification engineClassification label: mal48.win@18/41@26/226
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1956,i,5890527656967956097,7500726405433405734,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2244 /prefetch:11
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1956,i,5890527656967956097,7500726405433405734,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2244 /prefetch:11
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Drive-by Compromise
Windows Management InstrumentationPath Interception1
Process Injection
1
Masquerading
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Extra Window Memory Injection
1
Process Injection
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Obfuscated Files or Information
Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
File Deletion
NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer
Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Extra Window Memory Injection
LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1100%Avira URL Cloudphishing
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
jsdelivr.map.fastly.net
151.101.65.229
truefalse
    high
    netdna.bootstrapcdn.com
    104.18.10.207
    truefalse
      high
      code.jquery.com
      151.101.130.137
      truefalse
        high
        microsoft-teams-download.burleson-appliance.net
        104.21.80.1
        truefalse
          high
          cookieconsent.popupsmart.com
          104.26.6.46
          truefalse
            unknown
            image.ibb.co
            91.134.82.79
            truefalse
              unknown
              www.google.com
              142.250.186.100
              truefalse
                high
                unpkg.com
                104.17.248.203
                truefalse
                  high
                  i.ibb.co
                  91.134.82.79
                  truefalse
                    high
                    cdn.jsdelivr.net
                    unknown
                    unknownfalse
                      high
                      NameMaliciousAntivirus DetectionReputation
                      https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1true
                        unknown
                        • No. of IPs < 25%
                        • 25% < No. of IPs < 50%
                        • 50% < No. of IPs < 75%
                        • 75% < No. of IPs
                        IPDomainCountryFlagASNASN NameMalicious
                        104.21.48.1
                        unknownUnited States
                        13335CLOUDFLARENETUSfalse
                        142.250.186.67
                        unknownUnited States
                        15169GOOGLEUSfalse
                        104.18.10.207
                        netdna.bootstrapcdn.comUnited States
                        13335CLOUDFLARENETUSfalse
                        142.250.186.170
                        unknownUnited States
                        15169GOOGLEUSfalse
                        216.58.206.74
                        unknownUnited States
                        15169GOOGLEUSfalse
                        172.217.16.138
                        unknownUnited States
                        15169GOOGLEUSfalse
                        104.17.248.203
                        unpkg.comUnited States
                        13335CLOUDFLARENETUSfalse
                        104.26.6.46
                        cookieconsent.popupsmart.comUnited States
                        13335CLOUDFLARENETUSfalse
                        104.21.80.1
                        microsoft-teams-download.burleson-appliance.netUnited States
                        13335CLOUDFLARENETUSfalse
                        216.58.206.36
                        unknownUnited States
                        15169GOOGLEUSfalse
                        151.101.130.137
                        code.jquery.comUnited States
                        54113FASTLYUSfalse
                        91.134.82.79
                        image.ibb.coFrance
                        16276OVHFRfalse
                        142.250.184.206
                        unknownUnited States
                        15169GOOGLEUSfalse
                        172.217.18.10
                        unknownUnited States
                        15169GOOGLEUSfalse
                        142.250.185.67
                        unknownUnited States
                        15169GOOGLEUSfalse
                        1.1.1.1
                        unknownAustralia
                        13335CLOUDFLARENETUSfalse
                        142.250.186.163
                        unknownUnited States
                        15169GOOGLEUSfalse
                        151.101.65.229
                        jsdelivr.map.fastly.netUnited States
                        54113FASTLYUSfalse
                        216.58.206.46
                        unknownUnited States
                        15169GOOGLEUSfalse
                        151.101.2.137
                        unknownUnited States
                        54113FASTLYUSfalse
                        142.250.186.106
                        unknownUnited States
                        15169GOOGLEUSfalse
                        64.233.184.84
                        unknownUnited States
                        15169GOOGLEUSfalse
                        142.250.186.100
                        www.google.comUnited States
                        15169GOOGLEUSfalse
                        172.217.16.195
                        unknownUnited States
                        15169GOOGLEUSfalse
                        172.217.16.131
                        unknownUnited States
                        15169GOOGLEUSfalse
                        IP
                        192.168.2.24
                        Joe Sandbox version:42.0.0 Malachite
                        Analysis ID:1596300
                        Start date and time:2025-01-21 23:01:45 +01:00
                        Joe Sandbox product:CloudBasic
                        Overall analysis duration:
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Cookbook file name:defaultwindowsinteractivecookbook.jbs
                        Sample URL:https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1
                        Analysis system description:Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
                        Run name:Potential for more IOCs and behavior
                        Number of analysed new started processes analysed:12
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • EGA enabled
                        Analysis Mode:stream
                        Analysis stop reason:Timeout
                        Detection:MAL
                        Classification:mal48.win@18/41@26/226
                        • Exclude process from analysis (whitelisted): svchost.exe
                        • Excluded IPs from analysis (whitelisted): 104.18.38.233, 172.64.149.23
                        • Excluded domains from analysis (whitelisted): crt.comodoca.com.cdn.cloudflare.net, crt.comodoca.com
                        • Not all processes where analyzed, report is missing behavior information
                        • VT rate limit hit for: https://microsoft-teams-download.burleson-appliance.net/?msclkid=405ba02277c21a93ebbac7ad905a34e1