hxxps://forms[.]office[.]com/?redirecturl=https%3a%2f%2fforms[.]office[.]com%2fPages%2fAdminPhishingReviewPage[.]aspx%3fid%3du05GxO1HskqrVXTvNQB8KkltOHnw5T1JtcqjHqz0Oo1UNDBWS0FVNDQxVTBZUERFRjkwN0JLVktPMS4u%26source%3dUnifiedAlertPage

Resubmissions

06/08/2024, 22:45

240806-2pv9vatakk 9

06/08/2024, 22:38

240806-2kerassgrq 5

Sharing

Copy URL Twitter E-mail

General

Target

https://forms.office.com/?redirecturl=https%3a%2f%2fforms.office.com%2fPages%2fAdminPhishingReviewPage.aspx%3fid%3du05GxO1HskqrVXTvNQB8KkltOHnw5T1JtcqjHqz0Oo1UNDBWS0FVNDQxVTBZUERFRjkwN0JLVktPMS4u%26source%3dUnifiedAlertPage
Sample

240806-2pv9vatakk

Score

9^/10

Malware Config

Targets

- Target
  
  https://forms.office.com/?redirecturl=https%3a%2f%2fforms.office.com%2fPages%2fAdminPhishingReviewPage.aspx%3fid%3du05GxO1HskqrVXTvNQB8KkltOHnw5T1JtcqjHqz0Oo1UNDBWS0FVNDQxVTBZUERFRjkwN0JLVktPMS4u%26source%3dUnifiedAlertPage
Score

9^/10

microsoft credential_access discovery phishing stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Credentials from Password Stores: Credentials from Web Browsers

Detected potential entity reuse from brand microsoft.

MITRE ATT&CK Enterprise v15

Tasks

static1

urlscan1

behavioral1