hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001fXALXKW-uUbUeA7LEpAnnL-HJOgHOhRU2-bPHps4SNAWZdRxUXaI0mSvCDZt0D0kNA2yk526mPaQkJi_D3E3WQPaCc-RGgu3AHw8lF5gAdn01NmoGVCX3Y95P8f2PCBm-iZOqCNeiALgJh323R3TT7gwIyXLnRr1wdIbZCYjUbyh4er1jzFQvQ==&c=TPXX3pARoeylo8Q_UkuH8hAmOhAFIDx33jj3H_z6ECJEt-CbunRq4A==&ch=TeaDruSpF1LX8MfS7CSa7yJqeqTSHBeSvoHZaYtne-iOc_H_Ec3bkw==&__=matthew[.]spina@wba[.]com Unknown April 14, 2023 2[:]30 PM 39@89397 April 14, 2023 2[:]31 PM 243@89397 April 14, 2023, 2[:]30 PM 1 CrowdStrike Falcon Intel v2, MISP V3 CrowdStrike Falcon Intel v2, MISP V3 Active May 14, 2023, 2[:]31 PM URL hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001fXALXKW-uUbUeA7LEpAnnL-HJOgHOhRU2-bPHps4SNAWZdRxUXaI0mSvCDZt0D0kNA2yk526mPaQkJi_D3E3WQPaCc-RGgu3AHw8lF5gAdn01NmoGVCX3Y95P8f2PCB

General

Target

https://r20.rs6.net/tn.jsp?f=001fXALXKW-uUbUeA7LEpAnnL-HJOgHOhRU2-bPHps4SNAWZdRxUXaI0mSvCDZt0D0kNA2yk526mPaQkJi_D3E3WQPaCc-RGgu3AHw8lF5gAdn01NmoGVCX3Y95P8f2PCBm-iZOqCNeiALgJh323R3TT7gwIyXLnRr1wdIbZCYjUbyh4er1jzFQvQ==&c=TPXX3pARoeylo8Q_UkuH8hAmOhAFIDx33jj3H_z6ECJEt-CbunRq4A==&ch=TeaDruSpF1LX8MfS7CSa7yJqeqTSHBeSvoHZaYtne-iOc_H_Ec3bkw==&__=matthew.spina@wba.com Unknown April 14, 2023 2:30 PM 39@89397 April 14, 2023 2:31 PM 243@89397 April 14, 2023, 2:30 PM 1 CrowdStrike Falcon Intel v2, MISP V3 CrowdStrike Falcon Intel v2, MISP V3 Active May 14, 2023, 2:31 PM URL https://r20.rs6.net/tn.jsp?f=001fXALXKW-uUbUeA7LEpAnnL-HJOgHOhRU2-bPHps4SNAWZdRxUXaI0mSvCDZt0D0kNA2yk526mPaQkJi_D3E3WQPaCc-RGgu3AHw8lF5gAdn01NmoGVCX3Y95P8f2PCB
Sample

230414-y891kabf96

Score

1^/10

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact