hxxps://login[.]microsoft[.]com/common/oauth2/v2[.]0/authorize?state=Z2F1ZGllbC5hbnRvbmlvQHRyZW1lYy5jb20=&scope=openid+profile+https%253A%252F%252Fgraph[.]microsoft[.]com%252FUser[.]Read&prompt=none&client_id=3f6a436b-cf86-4960-a6f7-ae13157a8d6b&ref=6f9d4313e8e84ed07e204e628f6628d1&uri=https%252525252525252525252525252525252525252525252525253A%252525252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252525252Flogin[.]microsoftonline[.]com%252525252525252525252525252525252525252525252525252Fcommon%252525252525252525252525252525252525252525252525252Foauth2%252525252525252525252525252525252525252525252525252Fv2[.]0%252525252525252525252525252525252525252525252525252Fauthorize%252525252525252525252525252525252525252525252525253Fclient_id%252525252525252525252525252525252525252525252525253D3f6a436b-cf86-4960-a6f7-ae13157a8d6b%2525252525252525252525252525252525252525252525252526response_type%252525252525252525252525252525252525252525252525253Dcode%2525252525252525252525252525252525252525252525252526response_mode%252525252525252525252525252525252525252525252525253Dquery%2525252525252525252525252525252525252525252525252526scope%252525252525252525252525252525252525252525252525253Dopenid%252525252525252525252525252525252525252525252525252Bprofile%252525252525252525252525252525252525252525252525252Bemail%252525252525252525252525252525252525252525252525252Bhttps%25252525252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252525252Fgraph[.]microsoft[.]com%25252525252525252525252525252525252525252525252525252FUser[.]Read%2525252525252525252525252525252525252525252525252526prompt%252525252525252525252525252525252525252525252525253Dnone%2525252525252525252525252525252525252525252525252526state%252525252525252525252525252525252525252525252525253D%252525252525252525252525252525252525252525252525257BRECIPIENT_BASE64_EMAIL%252525252525252525252525252525252525252525252525257D%250A

Sharing

Behavioral task

behavioral1

Sample

https://login.microsoft.com/common/oauth2/v2.0/authorize?state=Z2F1ZGllbC5hbnRvbmlvQHRyZW1lYy5jb20=&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=3f6a436b-cf86-4960-a6f7-ae13157a8d6b&ref=6f9d4313e8e84ed07e204e628f6628d1&uri=https%252525252525252525252525252525252525252525252525253A%252525252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252525252Flogin.microsoftonline.com%252525252525252525252525252525252525252525252525252Fcommon%252525252525252525252525252525252525252525252525252Foauth2%252525252525252525252525252525252525252525252525252Fv2.0%252525252525252525252525252525252525252525252525252Fauthorize%252525252525252525252525252525252525252525252525253Fclient_id%252525252525252525252525252525252525252525252525253D3f6a436b-cf86-4960-a6f7-ae13157a8d6b%2525252525252525252525252525252525252525252525252526response_type%252525252525252525252525252525252525252525252525253Dcode%2525252525252525252525252525252525252525252525252526response_mode%252525252525252525252525252525252525252525252525253Dquery%2525252525252525252525252525252525252525252525252526scope%252525252525252525252525252525252525252525252525253Dopenid%252525252525252525252525252525252525252525252525252Bprofile%252525252525252525252525252525252525252525252525252Bemail%252525252525252525252525252525252525252525252525252Bhttps%25252525252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252525252Fgraph.microsoft.com%25252525252525252525252525252525252525252525252525252FUser.Read%2525252525252525252525252525252525252525252525252526prompt%252525252525252525252525252525252525252525252525253Dnone%2525252525252525252525252525252525252525252525252526state%252525252525252525252525252525252525252525252525253D%252525252525252525252525252525252525252525252525257BRECIPIENT_BASE64_EMAIL%252525252525252525252525252525252525252525252525257D%250A

Resource

win10v2004-20260911-en

windows10-2004-x64

11 signatures

150 seconds

discovery phishing

General

Target
https://login.microsoft.com/common/oauth2/v2.0/authorize?state=Z2F1ZGllbC5hbnRvbmlvQHRyZW1lYy5jb20=&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=3f6a436b-cf86-4960-a6f7-ae13157a8d6b&ref=6f9d4313e8e84ed07e204e628f6628d1&uri=https%252525252525252525252525252525252525252525252525253A%252525252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252525252Flogin.microsoftonline.com%252525252525252525252525252525252525252525252525252Fcommon%252525252525252525252525252525252525252525252525252Foauth2%252525252525252525252525252525252525252525252525252Fv2.0%252525252525252525252525252525252525252525252525252Fauthorize%252525252525252525252525252525252525252525252525253Fclient_id%252525252525252525252525252525252525252525252525253D3f6a436b-cf86-4960-a6f7-ae13157a8d6b%2525252525252525252525252525252525252525252525252526response_type%252525252525252525252525252525252525252525252525253Dcode%2525252525252525252525252525252525252525252525252526response_mode%252525252525252525252525252525252525252525252525253Dquery%2525252525252525252525252525252525252525252525252526scope%252525252525252525252525252525252525252525252525253Dopenid%252525252525252525252525252525252525252525252525252Bprofile%252525252525252525252525252525252525252525252525252Bemail%252525252525252525252525252525252525252525252525252Bhttps%25252525252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252525252Fgraph.microsoft.com%25252525252525252525252525252525252525252525252525252FUser.Read%2525252525252525252525252525252525252525252525252526prompt%252525252525252525252525252525252525252525252525253Dnone%2525252525252525252525252525252525252525252525252526state%252525252525252525252525252525252525252525252525253D%252525252525252525252525252525252525252525252525257BRECIPIENT_BASE64_EMAIL%252525252525252525252525252525252525252525252525257D%250A
Sample261020-hty2rawyht

Score

7^/10

phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Sharing

General

Malware Config

Signatures

File Explorer