hxxps://secure-web[.]cisco[.]com/1pcOxCIaMkL7_wyFxW2mIeCDQ3Gnx6kD-oOK1UZe93rmWnoBtU1XvDCbONS4GgkhqJlSQMmIXKZiGlNVLMOv7PApO-MQ6vyzTMjyrQaTJpDi4GfFHj_Ej4lTFK28REC6J6FiZxO99T8Lze7mKHCTn9jRpjJ7qumoWs5BugnPbzfwJ0SOp6JmHadclvAM1ueUiGR__1DYG36Yr-G5hSXcydnDBh9tZjvM1Wf61bNSwLYJQXKwYXjaozMbukiRnbGPic3lQFgktza4RRUx9AHNkKJwIstSQSYpYavGmrDnMOYTJYNqkDrxAiThpJfz9MDaqNWQvqAKI4MYiG9hcX2stNsAA2RPxv7IOlxwC4D2wY6w/https%3A%2F%2Fmessaginganalytics[.]athena[.]io%2F%3Fevent%3D%257B%2522user_id%2522%3A%2522eyJjdHhJZCI6IjE5MDM1IiwiY21wSWQiOiJjbS1wcm9kLTEwMC0xMi4wLXN1Yi0xIiwicG9wSWQiOiJkMDU1NGZjMy01YTI5LTRiZmItOTY3Yy00Mzc2MDA4ODAxZjgiLCJub2RlSWQiOiJlbWFpbCIsImNvbk10ZCI6IkVNQUlMIiwibGR0IjoiMjAyNC0wMy0yNVQwMjoyODo1Ni4zMDJaW1VUQ10ifQ%3D%3D%2522%2C%2522user_properties%2522%3A%257B%2522messagetype%2522%3A%2522GUESTPAY%2522%2C%2522messagesubtype%2522%3A%2522newCharge%2522%2C%2522messageaudience%2522%3A%2522LD-SEGMENT%2522%2C%2522tenant%2522%3A%2522Default%2522%2C%2522source%2522%3A%2522%2522%2C%2522contextid%2522%3A%252219035%2522%2C%2522language%2522%3A%2522en%2522%2C%2522hasinstructionalmessage%2522%3Afalse%2C%2522delayDay%2522%3A6%2C%2522clickaction%2522%3A%2522payment%2520app%2520p%2520unappliedN%2522%257D%2C%2522event_properties%2522%3A%257B%2522Messagetype%2522%3A%2522GUESTPAY%2522%2C%2522Messagesubtype%2522%3A%2522newCharge%2522%2C%2522Messageaudience%2522%3A%2522LD-SEGMENT%2522%2C%2522Tenant%2522%3A%2522Default%2522%2C%2522Source%2522%3A%2522%2522%2C%2522ContextID%2522%3A%252219035%2522%2C%2522TemplateVersionNumber%2522%3A%252240becbcc-e56f-43d4-927e-0804c1112b24%2522%2C%2522ExperimentId%2522%3Anull%2C%2522Language%2522%3A%2522en%2522%2C%2522HasInstructionalMessage%2522%3Afalse%2C%2522Delayday%2522%3A6%2C%2522ClickAction%2522%3A%2522payment%2520app%2520p%2520unappliedN%2522%257D%2C%2522event_type%2522%3A%2522EMAIL_LINK_CLICKED%2522%257D%26redirect%3Dhttps%3A%2F%2Fpayment[.]patient[.]athenahealth[.]com%2Fnotification%2F%3Ftoken%3DhoIq52GDEnJuId6ROR-34N0qbfanS3mdWy85a_3r

Sharing

Behavioral task

behavioral1

Sample

https://secure-web.cisco.com/1pcOxCIaMkL7_wyFxW2mIeCDQ3Gnx6kD-oOK1UZe93rmWnoBtU1XvDCbONS4GgkhqJlSQMmIXKZiGlNVLMOv7PApO-MQ6vyzTMjyrQaTJpDi4GfFHj_Ej4lTFK28REC6J6FiZxO99T8Lze7mKHCTn9jRpjJ7qumoWs5BugnPbzfwJ0SOp6JmHadclvAM1ueUiGR__1DYG36Yr-G5hSXcydnDBh9tZjvM1Wf61bNSwLYJQXKwYXjaozMbukiRnbGPic3lQFgktza4RRUx9AHNkKJwIstSQSYpYavGmrDnMOYTJYNqkDrxAiThpJfz9MDaqNWQvqAKI4MYiG9hcX2stNsAA2RPxv7IOlxwC4D2wY6w/https%3A%2F%2Fmessaginganalytics.athena.io%2F%3Fevent%3D%257B%2522user_id%2522%3A%2522eyJjdHhJZCI6IjE5MDM1IiwiY21wSWQiOiJjbS1wcm9kLTEwMC0xMi4wLXN1Yi0xIiwicG9wSWQiOiJkMDU1NGZjMy01YTI5LTRiZmItOTY3Yy00Mzc2MDA4ODAxZjgiLCJub2RlSWQiOiJlbWFpbCIsImNvbk10ZCI6IkVNQUlMIiwibGR0IjoiMjAyNC0wMy0yNVQwMjoyODo1Ni4zMDJaW1VUQ10ifQ%3D%3D%2522%2C%2522user_properties%2522%3A%257B%2522messagetype%2522%3A%2522GUESTPAY%2522%2C%2522messagesubtype%2522%3A%2522newCharge%2522%2C%2522messageaudience%2522%3A%2522LD-SEGMENT%2522%2C%2522tenant%2522%3A%2522Default%2522%2C%2522source%2522%3A%2522%2522%2C%2522contextid%2522%3A%252219035%2522%2C%2522language%2522%3A%2522en%2522%2C%2522hasinstructionalmessage%2522%3Afalse%2C%2522delayDay%2522%3A6%2C%2522clickaction%2522%3A%2522payment%2520app%2520p%2520unappliedN%2522%257D%2C%2522event_properties%2522%3A%257B%2522Messagetype%2522%3A%2522GUESTPAY%2522%2C%2522Messagesubtype%2522%3A%2522newCharge%2522%2C%2522Messageaudience%2522%3A%2522LD-SEGMENT%2522%2C%2522Tenant%2522%3A%2522Default%2522%2C%2522Source%2522%3A%2522%2522%2C%2522ContextID%2522%3A%252219035%2522%2C%2522TemplateVersionNumber%2522%3A%252240becbcc-e56f-43d4-927e-0804c1112b24%2522%2C%2522ExperimentId%2522%3Anull%2C%2522Language%2522%3A%2522en%2522%2C%2522HasInstructionalMessage%2522%3Afalse%2C%2522Delayday%2522%3A6%2C%2522ClickAction%2522%3A%2522payment%2520app%2520p%2520unappliedN%2522%257D%2C%2522event_type%2522%3A%2522EMAIL_LINK_CLICKED%2522%257D%26redirect%3Dhttps%3A%2F%2Fpayment.patient.athenahealth.com%2Fnotification%2F%3Ftoken%3DhoIq52GDEnJuId6ROR-34N0qbfanS3mdWy85a_3r

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

General

Target

https://secure-web.cisco.com/1pcOxCIaMkL7_wyFxW2mIeCDQ3Gnx6kD-oOK1UZe93rmWnoBtU1XvDCbONS4GgkhqJlSQMmIXKZiGlNVLMOv7PApO-MQ6vyzTMjyrQaTJpDi4GfFHj_Ej4lTFK28REC6J6FiZxO99T8Lze7mKHCTn9jRpjJ7qumoWs5BugnPbzfwJ0SOp6JmHadclvAM1ueUiGR__1DYG36Yr-G5hSXcydnDBh9tZjvM1Wf61bNSwLYJQXKwYXjaozMbukiRnbGPic3lQFgktza4RRUx9AHNkKJwIstSQSYpYavGmrDnMOYTJYNqkDrxAiThpJfz9MDaqNWQvqAKI4MYiG9hcX2stNsAA2RPxv7IOlxwC4D2wY6w/https%3A%2F%2Fmessaginganalytics.athena.io%2F%3Fevent%3D%257B%2522user_id%2522%3A%2522eyJjdHhJZCI6IjE5MDM1IiwiY21wSWQiOiJjbS1wcm9kLTEwMC0xMi4wLXN1Yi0xIiwicG9wSWQiOiJkMDU1NGZjMy01YTI5LTRiZmItOTY3Yy00Mzc2MDA4ODAxZjgiLCJub2RlSWQiOiJlbWFpbCIsImNvbk10ZCI6IkVNQUlMIiwibGR0IjoiMjAyNC0wMy0yNVQwMjoyODo1Ni4zMDJaW1VUQ10ifQ%3D%3D%2522%2C%2522user_properties%2522%3A%257B%2522messagetype%2522%3A%2522GUESTPAY%2522%2C%2522messagesubtype%2522%3A%2522newCharge%2522%2C%2522messageaudience%2522%3A%2522LD-SEGMENT%2522%2C%2522tenant%2522%3A%2522Default%2522%2C%2522source%2522%3A%2522%2522%2C%2522contextid%2522%3A%252219035%2522%2C%2522language%2522%3A%2522en%2522%2C%2522hasinstructionalmessage%2522%3Afalse%2C%2522delayDay%2522%3A6%2C%2522clickaction%2522%3A%2522payment%2520app%2520p%2520unappliedN%2522%257D%2C%2522event_properties%2522%3A%257B%2522Messagetype%2522%3A%2522GUESTPAY%2522%2C%2522Messagesubtype%2522%3A%2522newCharge%2522%2C%2522Messageaudience%2522%3A%2522LD-SEGMENT%2522%2C%2522Tenant%2522%3A%2522Default%2522%2C%2522Source%2522%3A%2522%2522%2C%2522ContextID%2522%3A%252219035%2522%2C%2522TemplateVersionNumber%2522%3A%252240becbcc-e56f-43d4-927e-0804c1112b24%2522%2C%2522ExperimentId%2522%3Anull%2C%2522Language%2522%3A%2522en%2522%2C%2522HasInstructionalMessage%2522%3Afalse%2C%2522Delayday%2522%3A6%2C%2522ClickAction%2522%3A%2522payment%2520app%2520p%2520unappliedN%2522%257D%2C%2522event_type%2522%3A%2522EMAIL_LINK_CLICKED%2522%257D%26redirect%3Dhttps%3A%2F%2Fpayment.patient.athenahealth.com%2Fnotification%2F%3Ftoken%3DhoIq52GDEnJuId6ROR-34N0qbfanS3mdWy85a_3r

Sharing

General

Malware Config

Signatures

Files