General
- Target https://account.proton.me/drive/signup?ref=drsignp&mode=sps&plan=free¤cy=CHF&externalInvitationID=E_hh8neC8f1z9MzgSWGChQ&email=teresa.klein%40dot.wi.gov&preVerifiedAddressToken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3ODcyMjYyNjQuMzgyNTA5OSwiZXhwIjoxNzg5ODE4MjY0LCJFbWFpbCI6Im5DT0RBWGpZUlg1eUFzbmpsdGtzSjFjYkF2NmFxKzJzOWdVeWJpNnF1NW89IiwiaXNzIjoicHJvdG9uLm1lIiwiYXVkIjoicHJvdG9uLm1lIiwiVHlwZSI6Nn0.xWxUps-64gyvLRIS6rqPGFp53jzZI5gFo_F4d3e5l4c
- Sample260820-pv1ejaxckd
Score
7/10
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://account.proton.me/drive/signup?ref=drsignp&mode=sps&plan=free¤cy=CHF&externalInvitationID=E_hh8neC8f1z9MzgSWGChQ&email=teresa.klein%40dot.wi.gov&preVerifiedAddressToken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3ODcyMjYyNjQuMzgyNTA5OSwiZXhwIjoxNzg5ODE4MjY0LCJFbWFpbCI6Im5DT0RBWGpZUlg1eUFzbmpsdGtzSjFjYkF2NmFxKzJzOWdVeWJpNnF1NW89IiwiaXNzIjoicHJvdG9uLm1lIiwiYXVkIjoicHJvdG9uLm1lIiwiVHlwZSI6Nn0.xWxUps-64gyvLRIS6rqPGFp53jzZI5gFo_F4d3e5l4c
Resource
win11-20260513-en
11 signatures
300 seconds
Malware Config
Targets
-
- Target https://account.proton.me/drive/signup?ref=drsignp&mode=sps&plan=free¤cy=CHF&externalInvitationID=E_hh8neC8f1z9MzgSWGChQ&email=teresa.klein%40dot.wi.gov&preVerifiedAddressToken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3ODcyMjYyNjQuMzgyNTA5OSwiZXhwIjoxNzg5ODE4MjY0LCJFbWFpbCI6Im5DT0RBWGpZUlg1eUFzbmpsdGtzSjFjYkF2NmFxKzJzOWdVeWJpNnF1NW89IiwiaXNzIjoicHJvdG9uLm1lIiwiYXVkIjoicHJvdG9uLm1lIiwiVHlwZSI6Nn0.xWxUps-64gyvLRIS6rqPGFp53jzZI5gFo_F4d3e5l4c
Score7/10-
A potential corporate email address has been identified in the URL: [email protected]
-
Drops desktop.ini file(s)