Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://na2.docusign.net/Signing/EmailStart.aspx?a=91c094aa-160d-4756-b8b7-0f3428ae2124&acct=e9c112fa-3eae-493c-8bfc-d97737244948&er=7fde1f21-6f07-4a5d-8217-7c1e45a31ab1

Overview

General Information

Sample URL:https://na2.docusign.net/Signing/EmailStart.aspx?a=91c094aa-160d-4756-b8b7-0f3428ae2124&acct=e9c112fa-3eae-493c-8bfc-d97737244948&er=7fde1f21-6f07-4a5d-8217-7c1e45a31ab1
Analysis ID:756305

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

No high impact signatures.

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 3652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na2.docusign.net/Signing/EmailStart.aspx?a=91c094aa-160d-4756-b8b7-0f3428ae2124&acct=e9c112fa-3eae-493c-8bfc-d97737244948&er=7fde1f21-6f07-4a5d-8217-7c1e45a31ab1 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)
    • chrome.exe (PID: 4072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1796,i,12823625518947830979,6690553971199126096,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)
  • cleanup
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\GoogleUpdater
Source: unknownDNS traffic detected: queries for: na2.docusign.net
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 49694 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49694
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49691
Source: unknownNetwork traffic detected: HTTP traffic on port 49691 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.186.67
Source: classification engineClassification label: clean0.win@25/0@10/139
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\GoogleUpdater
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na2.docusign.net/Signing/EmailStart.aspx?a=91c094aa-160d-4756-b8b7-0f3428ae2124&acct=e9c112fa-3eae-493c-8bfc-d97737244948&er=7fde1f21-6f07-4a5d-8217-7c1e45a31ab1
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1796,i,12823625518947830979,6690553971199126096,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1796,i,12823625518947830979,6690553971199126096,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\GoogleUpdater
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath Interception1
Process Injection
2
Masquerading
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium2
Encrypted Channel
Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
Non-Application Layer Protocol
Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
Application Layer Protocol
Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
https://na2.docusign.net/Signing/EmailStart.aspx?a=91c094aa-160d-4756-b8b7-0f3428ae2124&acct=e9c112fa-3eae-493c-8bfc-d97737244948&er=7fde1f21-6f07-4a5d-8217-7c1e45a31ab10%Avira URL Cloudsafe
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
accounts.google.com
172.217.16.205
truefalse
    high
    www.google.com
    142.250.186.36
    truefalse
      high
      api.mixpanel.com
      107.178.240.159
      truefalse
        high
        clients.l.google.com
        142.250.185.206
        truefalse
          high
          arya-1323461286.us-west-2.elb.amazonaws.com
          52.89.240.141
          truefalse
            high
            clients2.google.com
            unknown
            unknownfalse
              high
              a.docusign.com
              unknown
              unknownfalse
                high
                docucdn-a.akamaihd.net
                unknown
                unknownfalse
                  high
                  na2.docusign.net
                  unknown
                  unknownfalse
                    high
                    NameMaliciousAntivirus DetectionReputation
                    https://na2.docusign.net/Signing/?ti=0887c2ccf2404f13b8802110625d2cbafalse
                      high
                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs
                      IPDomainCountryFlagASNASN NameMalicious
                      23.213.161.134
                      unknownUnited States
                      20940AKAMAI-ASN1EUfalse
                      142.250.186.67
                      unknownUnited States
                      15169GOOGLEUSfalse
                      142.250.185.206
                      clients.l.google.comUnited States
                      15169GOOGLEUSfalse
                      34.104.35.123
                      unknownUnited States
                      15169GOOGLEUSfalse
                      142.250.186.36
                      www.google.comUnited States
                      15169GOOGLEUSfalse
                      172.217.16.205
                      accounts.google.comUnited States
                      15169GOOGLEUSfalse
                      52.89.240.141
                      arya-1323461286.us-west-2.elb.amazonaws.comUnited States
                      16509AMAZON-02USfalse
                      142.250.186.106
                      unknownUnited States
                      15169GOOGLEUSfalse
                      107.178.240.159
                      api.mixpanel.comUnited States
                      15169GOOGLEUSfalse
                      239.255.255.250
                      unknownReserved
                      unknownunknownfalse
                      172.217.23.99
                      unknownUnited States
                      15169GOOGLEUSfalse
                      162.248.185.47
                      unknownUnited States
                      62856DOCUS-6-PRODUSfalse
                      142.250.186.100
                      unknownUnited States
                      15169GOOGLEUSfalse
                      IP
                      192.168.2.1
                      127.0.0.1
                      Joe Sandbox Version:36.0.0 Rainbow Opal
                      Analysis ID:756305
                      Start date and time:2022-11-30 00:25:02 +01:00
                      Joe Sandbox Product:CloudBasic
                      Overall analysis duration:
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                      Sample URL:https://na2.docusign.net/Signing/EmailStart.aspx?a=91c094aa-160d-4756-b8b7-0f3428ae2124&acct=e9c112fa-3eae-493c-8bfc-d97737244948&er=7fde1f21-6f07-4a5d-8217-7c1e45a31ab1
                      Analysis system description:Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
                      Number of analysed new started processes analysed:13
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • EGA enabled
                      Analysis Mode:stream
                      Analysis stop reason:Timeout
                      Detection:CLEAN
                      Classification:clean0.win@25/0@10/139
                      • Exclude process from analysis (whitelisted): svchost.exe
                      • Excluded IPs from analysis (whitelisted): 172.217.23.99, 162.248.185.47, 34.104.35.123, 23.213.161.134, 23.213.161.145, 142.250.186.106, 142.250.184.202, 142.250.186.138, 142.250.184.234, 172.217.18.10, 142.250.74.202, 142.250.186.170, 172.217.16.202, 216.58.212.170, 142.250.185.170, 142.250.186.42, 172.217.18.106, 172.217.23.106, 142.250.186.74, 142.250.181.234, 142.250.185.234
                      • Excluded domains from analysis (whitelisted): na2-west.docusign.net.akadns.net, a1737.b.akamai.net, fs.microsoft.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, login.live.com, clientservices.googleapis.com, na2-geo.docusign.net.akadns.net, docucdn-a.akamaihd.net.edgesuite.net
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtWriteVirtualMemory calls found.
                      No created / dropped files found
                      No static file info