Analysis Overview

score

8^/10

Threat Level: Likely malicious

The file https://cxone.niceincontact.com/ua/v1/callback%22,%22scope%22:%22openid%22,%22response_type%22:%22code%22,%22client_id%22:%220b697ebb-4ea2-4052-b12b-d3cf12a53eca%22,%22tenantId%22:%2211e9f552-54e5-8747-8222-befd4dfdf454%22,%22userId%22:%2211e9f552-30a7-ab89-8222-befd4dfdf454%22,%22userName%22:%[email protected]%22%7D,%22userId%22:%2211e9f552-30a7-ab89-8222-befd4dfdf454%22,%22code%22:%2226b2d1d13000400fa6a7cf1dc9c529a0.us-west-2%22,%22iat%22:1718200053,%22exp%22:1718203653%7D%5E%EF%BF%BD%E3%8A%9B%EF%BF%BDu%EF%BF%BDM%EF%BF%BD%EF%BF%BD%EF%BF%BD1n%EF%BF%BD%CB%88$%EF%BF%BD%EF%BF%BD3%EF%BF%BD%22%EF%BF%BD~%EF%BF%BD%1Dw%EF%BF%BD!%EF%BF%BD%1D%EF%BF%BD3%EF%BF%BDXw/9kF%EF%BF%BD=%08%EF%BF%BD%12%EF%BF%BD%EF%BF%BD1%EF%BF%BD%20%EF%BF%BD%EF%BF%BD%17%1DN%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BDs%EF%BF%BD%EF%BF%BDX%EF%BF%BD%EF%BF%BD%13%EF%BF%BD%EF%BF%BD%EF%BF%BD%0F%03%EF%BF%BD2z%EF%BF%BD.%7DV:FE%EF%BF%BD%DB%BE%EF%BF%BD%02%08%EF%BF%BD%0E+%EF%BF%BDk%16%EF%BF%BD%EF%BF%BD%EF%BF%BDP%EF%BF%BD.%EF%BF%BD%EF%BF%BD%07%EF%BF%BD%04%EF%BF%BD5%EF%BF%BD%EF%BF%BD%EF%BF%BD%11%EF%BF%BD%0F%EF%BF%BD%22%EF%BF%BD%19%EF%BF%BD%EF%BF%BD%C3%87e was found to be: Likely malicious.

Malicious Activity Summary

phishing

A potential corporate email address has been identified in the URL: callbackscopeopenidresponsetypecodeclientid0b697ebb4ea24052b12bd3cf12a53ecatenantId11e9f55254e587478222befd4dfdf454userId11e9f55230a7ab898222befd4dfdf454userNametljackson@evolent.comuserId11e9f55230a7ab898222befd4dfdf454code26b2d1d13000400fa6a7cf1dc9c529a0.uswest2iat1718200053exp1718203653uM1n3w3Xw

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V13

System Information Discovery

Analysis: static1

Detonation Overview

Reported

2024-06-12 18:05

Signatures

phishing

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 18:05

Reported

2024-06-12 18:08

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cxone.niceincontact.com/ua/v1/callback%22,%22scope%22:%22openid%22,%22response_type%22:%22code%22,%22client_id%22:%220b697ebb-4ea2-4052-b12b-d3cf12a53eca%22,%22tenantId%22:%2211e9f552-54e5-8747-8222-befd4dfdf454%22,%22userId%22:%2211e9f552-30a7-ab89-8222-befd4dfdf454%22,%22userName%22:%[email protected]%22%7D,%22userId%22:%2211e9f552-30a7-ab89-8222-befd4dfdf454%22,%22code%22:%2226b2d1d13000400fa6a7cf1dc9c529a0.us-west-2%22,%22iat%22:1718200053,%22exp%22:1718203653%7D%5E%EF%BF%BD%E3%8A%9B%EF%BF%BDu%EF%BF%BDM%EF%BF%BD%EF%BF%BD%EF%BF%BD1n%EF%BF%BD%CB%88$%EF%BF%BD%EF%BF%BD3%EF%BF%BD%22%EF%BF%BD~%EF%BF%BD%1Dw%EF%BF%BD!%EF%BF%BD%1D%EF%BF%BD3%EF%BF%BDXw/9kF%EF%BF%BD=%08%EF%BF%BD%12%EF%BF%BD%EF%BF%BD1%EF%BF%BD%20%EF%BF%BD%EF%BF%BD%17%1DN%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BDs%EF%BF%BD%EF%BF%BDX%EF%BF%BD%EF%BF%BD%13%EF%BF%BD%EF%BF%BD%EF%BF%BD%0F%03%EF%BF%BD2z%EF%BF%BD.%7DV:FE%EF%BF%BD%DB%BE%EF%BF%BD%02%08%EF%BF%BD%0E+%EF%BF%BDk%16%EF%BF%BD%EF%BF%BD%EF%BF%BDP%EF%BF%BD.%EF%BF%BD%EF%BF%BD%07%EF%BF%BD%04%EF%BF%BD5%EF%BF%BD%EF%BF%BD%EF%BF%BD%11%EF%BF%BD%0F%EF%BF%BD%22%EF%BF%BD%19%EF%BF%BD%EF%BF%BD%C3%87e