Analysis Report https://partnersinhealth.sharepoint.com/:x:/s/COVIDCommunityTeam-Massachusetts-EIU-EpidemicIntelligenceUnit/Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ?email=Bill.Sparrow%4099restaurants.com&e=4%3atJjRLx&at=9

Overview

General Information

Sample URL: https://partnersinhealth.sharepoint.com/:x:/s/COVIDCommunityTeam-Massachusetts-EIU-EpidemicIntelligenceUnit/Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ?email=Bill.Sparrow%4099restaurants.com&e=4%3atJjRLx&at=9
Analysis ID: 338878

Most interesting Screenshot:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Queries the volume information (name, serial number etc) of a device

Classification

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: msapplication.xml0.3.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x68a89723,0x01d6e992</date><accdate>0x68a89723,0x01d6e992</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.3.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x68a89723,0x01d6e992</date><accdate>0x68aaf93e,0x01d6e992</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.3.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x68ad5b87,0x01d6e992</date><accdate>0x68ad5b87,0x01d6e992</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.3.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x68ad5b87,0x01d6e992</date><accdate>0x68ad5b87,0x01d6e992</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.3.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x68afbdec,0x01d6e992</date><accdate>0x68afbdec,0x01d6e992</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.3.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x68afbdec,0x01d6e992</date><accdate>0x68afbdec,0x01d6e992</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: partnersinhealth.sharepoint.com
Source: msapplication.xml.3.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.3.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.3.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.3.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.3.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.3.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.3.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.3.dr String found in binary or memory: http://www.youtube.com/
Source: Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ@email=Bill.Sparrow@99restaurants.com&e=4%3AtJjRLx&at=9.2.dr String found in binary or memory: https://az741266.vo.msecnd.net/files/odsp-next-prod-amd_2020-12-04-sts_20201208.001/
Source: spoguestaccess-a0017cc2[1].js.4.dr String found in binary or memory: https://github.com/microsoft/fluentui/wiki/Using-icons
Source: wget.exe, 00000002.00000002.212219619.00000000014B6000.00000004.00000040.sdmp, cmdline.out.2.dr String found in binary or memory: https://partnersinhealth.sharepoint.com/:x:/s/COVIDCommunityTeam-Massachusetts-EIU-EpidemicIntellige
Source: Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ@email=Bill.Sparrow@99restaurants.com&e=4%3AtJjRLx&at=9.2.dr String found in binary or memory: https://partnersinhealth.sharepoint.com/sites/COVIDCommunityTeam-Massachusetts-EIU-EpidemicIntellige
Source: Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ@email=Bill.Sparrow@99restaurants.com&e=4%3AtJjRLx&at=9.2.dr String found in binary or memory: https://spoprod-a.akamaihd.net
Source: spoguestaccess-a0017cc2[1].js.4.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/fabric-cdn-prod_20201008.001/assets/item-types/
Source: Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ@email=Bill.Sparrow@99restaurants.com&e=4%3AtJjRLx&at=9.2.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: spoguestaccess-a0017cc2[1].js.4.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49682 -> 443
Source: classification engine Classification label: clean0.win@7/18@3/2
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\Desktop\cmdline.out Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4792:120:WilError_01
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF3A4ED906E2C2A4CC.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://partnersinhealth.sharepoint.com/:x:/s/COVIDCommunityTeam-Massachusetts-EIU-EpidemicIntelligenceUnit/Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ?email=Bill.Sparrow%4099restaurants.com&e=4%3atJjRLx&at=9' > cmdline.out 2>&1
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://partnersinhealth.sharepoint.com/:x:/s/COVIDCommunityTeam-Massachusetts-EIU-EpidemicIntelligenceUnit/Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ?email=Bill.Sparrow%4099restaurants.com&e=4%3atJjRLx&at=9'
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' C:\Users\user\Desktop\download\Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ@email=Bill.Sparrow@99restaurants.com&e=4%3AtJjRLx&at=9.html
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:464 CREDAT:17410 /prefetch:2
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://partnersinhealth.sharepoint.com/:x:/s/COVIDCommunityTeam-Massachusetts-EIU-EpidemicIntelligenceUnit/Ec_oHive0IlGh0zKWdNWJqwBv4CGuicjIXG6ZM__kHKiUQ?email=Bill.Sparrow%4099restaurants.com&e=4%3atJjRLx&at=9' Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:464 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\wget.exe Queries volume information: C:\Users\user\Desktop\download VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 338878 URL: https://partnersinhealth.sh... Startdate: 13/01/2021 Architecture: WINDOWS Score: 0 5 iexplore.exe 2 84 2->5         started        8 cmd.exe 2 2->8         started        dnsIp3 17 192.168.2.1 unknown unknown 5->17 10 iexplore.exe 31 5->10         started        13 wget.exe 3 8->13         started        15 conhost.exe 8->15         started        process4 dnsIp5 19 spoprod-a.akamaihd.net 10->19 21 partnersinhealth.sharepoint.com 10->21 27 2 other IPs or domains 10->27 23 18164-ipv4.farm.prod.aa-rt.sharepoint.com 40.108.137.41, 443, 49682, 49685 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 13->23 25 partnersinhealth.sharepoint.com 13->25 29 2 other IPs or domains 13->29
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
40.108.137.41
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
18164-ipv4.farm.prod.aa-rt.sharepoint.com 40.108.137.41 true
partnersinhealth.sharepoint.com unknown unknown
spoprod-a.akamaihd.net unknown unknown