Overview

overview

7

Static

static

7

URLScan

urlscan

1

https://login.live.c...

android-15-x64

5

https://login.live.c...

macos-10.15-amd64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://login.live.com/oauth20_authorize.srf?client_id=81feaced-5ddd-41e7-8bef-3e20a2689bb7&scope=https%3a%2f%2faccount.microsoft.com%2fhbi_sa+openid+profile+offline_access&redirect_uri=https%3a%2f%2faccount.microsoft.com%2fauth%2fcomplete-signin-oauth&response_type=code&state=H4sIAAAAAAAEAA3NO2KCMAAA0Lt0dYBIoHRwCCWRgEDKRwgbHxGVAEpBzenbd4H38TsQTT8vR9vvbKOMJPaF3ovCtHJ3gYNK7uhAbvgh4TCHitFo8hS0OgFVm6mslqgyNlG3h-Wc4sxqxhhxHV9gUFQW5cpFSvE-q2HXN7d01SuXKg-2JX7mDw4ej-W2ppuCXk1zNpJoHNaimvLrK0QRUtFnnpv2ez4k7zqsrWIOgO2UMRAJLJpuov4JCyxRnKiE8_8zTif7Se-XhrkCdy0dptHrSOBUz3jpdfYIPV9PI8B6wKPFNnKvZTPLX3TVvjvA3Tix6hwr4P4VzFUCFzM1A83FvtM3RjltFKdST9Q8CLDOAgKs8WIJeEMk2_uwN9gz-fHYTaBFZJQOUYZ2u48_q2AqO1oBAAA&login_hint=lucyash07%40gmail.com&x-client-SKU=MSAL.Desktop&x-client-Ver=4.83.1.0&uaid=87175710c07c4663b018f9aa42039984&msproxy=1&issuer=mso&tenant=common&ui_locales=en-GB&client_info=1&epctrc=g6nWSJV09GidhR%2btBv2%2b1eZqLSS%2b4cDHFaQQHyQDF60%3d9%3a1%3aCANARY%3aOOeUZyRL6LxMwBXag73SiNMvm89xiMxUPum3j5pNTGc%3d&epct=PBgABDgEAAAA9VeaV3ywaSLp1O3c4_Et5RXZvU3RzQXJ0aWZhY3RzCAAAAAAAj88WcLZPJHho6ttVJp9QsUh66VsEMngCVfC06xHTPWta2klJ6uRSVMhDsPUfbixAXArdkpsEHzPf_klpsSHohLVMdWIzZObNN49dzChH40G96iotURKjV-XJaJWV0dsKLPZXEcOf1Vmzhazky4OktNWdQxzxfvFP9QsFtKqVEQutnof8eEecK1UZaWIgPBwhfdW1dzx7ZPmY42NKhjHD4dmxYn-sc-bSrnv8X0xp6sp419V_geyWh9m8b8ULGPnT_px-IZ0JNL3qb1b4zrfJVGohob0p8BOgqPaQlKr7E14akIiWvQSUX2gY1aeXplkuTlJr_-bp6JjqKKK5r7HiCd1sNktHAuWz2ePh78cp-jBHYbAMN4dbNbYO-gt4S2HWcmLCwkbjjkM5ZmpbKxIaQAKNjA7XdgLkVZUj4apzpSm62VrtrnJ0j0RVyKrG0yTHtzTL5GaCp7XnbD2kS2UYjTahDD-177-3i5p-zAFOOyBjuMvO2t4as6sVfDZUqT_-kDwDECt_-g6GlHLCMPJbtLctkLsuBJfd7uda9jXZptfAASkDan8OkRWNkZg_P87C8sjcpk4VJyHXzce_-ACTNAfT30iuxkWDrb280563SDZMFXGNXR9a3N31yyfPIZl5XuHRs3Hur5uILLY4JDCelh-vTipbe93t3Z1vNjvWjilw9kkHrKjHSiAKFaj_dmRqsLKRu-ewMGvFV0F0N7heHu-_oyJYwB9h1_I51kUj7Jdtzbx4TluYTHAffmeWckwxIAA&jshs=0
  • Sample261005-d2z7kasdma
Score
7/10
androidmicrosoftdefense_evasiondiscoverymacosphishing

Malware Config

Targets

    • Target
      https://login.live.com/oauth20_authorize.srf?client_id=81feaced-5ddd-41e7-8bef-3e20a2689bb7&scope=https%3a%2f%2faccount.microsoft.com%2fhbi_sa+openid+profile+offline_access&redirect_uri=https%3a%2f%2faccount.microsoft.com%2fauth%2fcomplete-signin-oauth&response_type=code&state=H4sIAAAAAAAEAA3NO2KCMAAA0Lt0dYBIoHRwCCWRgEDKRwgbHxGVAEpBzenbd4H38TsQTT8vR9vvbKOMJPaF3ovCtHJ3gYNK7uhAbvgh4TCHitFo8hS0OgFVm6mslqgyNlG3h-Wc4sxqxhhxHV9gUFQW5cpFSvE-q2HXN7d01SuXKg-2JX7mDw4ej-W2ppuCXk1zNpJoHNaimvLrK0QRUtFnnpv2ez4k7zqsrWIOgO2UMRAJLJpuov4JCyxRnKiE8_8zTif7Se-XhrkCdy0dptHrSOBUz3jpdfYIPV9PI8B6wKPFNnKvZTPLX3TVvjvA3Tix6hwr4P4VzFUCFzM1A83FvtM3RjltFKdST9Q8CLDOAgKs8WIJeEMk2_uwN9gz-fHYTaBFZJQOUYZ2u48_q2AqO1oBAAA&login_hint=lucyash07%40gmail.com&x-client-SKU=MSAL.Desktop&x-client-Ver=4.83.1.0&uaid=87175710c07c4663b018f9aa42039984&msproxy=1&issuer=mso&tenant=common&ui_locales=en-GB&client_info=1&epctrc=g6nWSJV09GidhR%2btBv2%2b1eZqLSS%2b4cDHFaQQHyQDF60%3d9%3a1%3aCANARY%3aOOeUZyRL6LxMwBXag73SiNMvm89xiMxUPum3j5pNTGc%3d&epct=PBgABDgEAAAA9VeaV3ywaSLp1O3c4_Et5RXZvU3RzQXJ0aWZhY3RzCAAAAAAAj88WcLZPJHho6ttVJp9QsUh66VsEMngCVfC06xHTPWta2klJ6uRSVMhDsPUfbixAXArdkpsEHzPf_klpsSHohLVMdWIzZObNN49dzChH40G96iotURKjV-XJaJWV0dsKLPZXEcOf1Vmzhazky4OktNWdQxzxfvFP9QsFtKqVEQutnof8eEecK1UZaWIgPBwhfdW1dzx7ZPmY42NKhjHD4dmxYn-sc-bSrnv8X0xp6sp419V_geyWh9m8b8ULGPnT_px-IZ0JNL3qb1b4zrfJVGohob0p8BOgqPaQlKr7E14akIiWvQSUX2gY1aeXplkuTlJr_-bp6JjqKKK5r7HiCd1sNktHAuWz2ePh78cp-jBHYbAMN4dbNbYO-gt4S2HWcmLCwkbjjkM5ZmpbKxIaQAKNjA7XdgLkVZUj4apzpSm62VrtrnJ0j0RVyKrG0yTHtzTL5GaCp7XnbD2kS2UYjTahDD-177-3i5p-zAFOOyBjuMvO2t4as6sVfDZUqT_-kDwDECt_-g6GlHLCMPJbtLctkLsuBJfd7uda9jXZptfAASkDan8OkRWNkZg_P87C8sjcpk4VJyHXzce_-ACTNAfT30iuxkWDrb280563SDZMFXGNXR9a3N31yyfPIZl5XuHRs3Hur5uILLY4JDCelh-vTipbe93t3Z1vNjvWjilw9kkHrKjHSiAKFaj_dmRqsLKRu-ewMGvFV0F0N7heHu-_oyJYwB9h1_I51kUj7Jdtzbx4TluYTHAffmeWckwxIAA&jshs=0
    Score
    6/10
    microsoftphishingdefense_evasiondiscovery

    • Gatekeeper Bypass

      Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.

      defense_evasion

    • Detected potential entity reuse from brand MICROSOFT.

      phishingmicrosoft

    • File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.

      defense_evasion

    • Probable phishing domain

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks