URL:

https://www.docusign.net/Signing/EmailStart.aspx?etti=43&m=b901cae2-1f82-4df8-aef0-67eaf30d2822

Full analysis: https://app.any.run/tasks/11b17a78-6bdd-4e45-a9c3-1f55b74dd2ba
Verdict: Malicious activity
Analysis date: January 10, 2025, 20:54:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
phishing
Indicators:
MD5:

A414E4CC53949E423FA1495A06E62CF1

SHA1:

671A392EBAF5E51929769FDFC515AD07EB21825C

SHA256:

A22E2198DF8E833B25669166543CEFDA1B02AF72328CCCCC863C081D5CCA5437

SSDEEP:

3:N8DSLVSTEBjIYit2VgBIdAqSr:2OLV2kliaOqSr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PHISHING has been detected (SURICATA)

      • msedge.exe (PID: 7172)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
#PHISHING msedge.exe

Process information

PID
CMD
Path
Indicators
Parent process
7172"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --webtransport-developer-mode --no-appcompat-clear --mojo-platform-channel-handle=2496 --field-trial-handle=2204,i,13280900864495260754,3672259324373187194,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
102
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF295329.TMPbinary
MD5:D2615E0C4F6C46045EDB3EAA0ACE252A
SHA256:48EFA073914F67BCCE305DECBC121BE7FA6D343982BE00A666B4C5FB6A30A7A9
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecuritybinary
MD5:38571DC57ABC19E09C646B83204C95CF
SHA256:968E9EF21E8714EBB0890A3E638B146B33BEB558AE27B54C59CBCF72E1C5246F
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fbbinary
MD5:311F1298863858C8334BD7A8A0E34014
SHA256:846351F83ED17838A1DE223EAD4E9900D1E127B3243695DAF5A4988E965C44CC
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent Statebinary
MD5:8A58A18292187656D2B884F9B1B5650B
SHA256:9C364CCFA98E4D2A0EB52C36EEF63265AE126BA633E6355AD2C08F128E1509EB
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF29810f.TMPbinary
MD5:38571DC57ABC19E09C646B83204C95CF
SHA256:968E9EF21E8714EBB0890A3E638B146B33BEB558AE27B54C59CBCF72E1C5246F
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF29ba30.TMPbinary
MD5:2F57311CAEE954BE47F1E360B4A82F76
SHA256:DD897AE9AE73B4F2F47574E535B8CD086CE66A66812A4333ADF341BAB1A24931
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e53c6eb4-da39-411a-98bf-c0cdaf2acd55.tmpbinary
MD5:8A58A18292187656D2B884F9B1B5650B
SHA256:9C364CCFA98E4D2A0EB52C36EEF63265AE126BA633E6355AD2C08F128E1509EB
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fcbinary
MD5:31C4AA9CAE6645087327880A00EC599C
SHA256:8F59F3AC8B9F87A9A88F28238E34526F37831C1B356E26FEC28C6CB868D1C710
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4469ceca-5935-4fc1-83c3-5766518b0f3c.tmpbinary
MD5:38571DC57ABC19E09C646B83204C95CF
SHA256:968E9EF21E8714EBB0890A3E638B146B33BEB558AE27B54C59CBCF72E1C5246F
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF296d1a.TMPbinary
MD5:D0453075479429FE52D8FB780A7DA8E9
SHA256:574112CCCB36E004E93B2BCBBA7F6CEB8FF3B12E3E462BEF80F1B57044E035B1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
279
TCP/UDP connections
168
DNS requests
228
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3024
svchost.exe
HEAD
200
23.32.238.105:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736814430&P2=404&P3=2&P4=PVg42MPTsArmQ0V8APASj97iDt7LxwhoToytG%2fb%2fRrp2YnYmO81mNh%2fqZZxCcL1xkePhGHzHFyG7U56IN1XAxA%3d%3d
unknown
—
—
whitelisted
—
—
GET
302
184.30.21.171:443
https://go.microsoft.com/fwlink/?linkid=2133855&bucket=18
unknown
—
—
—
3024
svchost.exe
GET
206
23.32.238.105:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736814430&P2=404&P3=2&P4=PVg42MPTsArmQ0V8APASj97iDt7LxwhoToytG%2fb%2fRrp2YnYmO81mNh%2fqZZxCcL1xkePhGHzHFyG7U56IN1XAxA%3d%3d
unknown
—
—
whitelisted
—
—
GET
200
204.79.197.239:443
https://edge.microsoft.com/neededge/v1?bucket=18
unknown
xml
741 Kb
whitelisted
—
—
GET
302
162.248.184.179:443
https://www.docusign.net/Signing/EmailStart.aspx?etti=43&m=b901cae2-1f82-4df8-aef0-67eaf30d2822
unknown
html
226 b
whitelisted
—
—
GET
200
185.81.100.37:443
https://account.docusign.com/ReactApp/src/vendor/html-domparser.js
unknown
binary
1.08 Kb
whitelisted
—
—
POST
200
13.107.21.239:443
https://edge.microsoft.com/componentupdater/api/v1/update?cup2key=7:F9Wm-h5W7X6SUqd2lwgY1zENcVCr1IQs0DkMASPrNos&cup2hreq=bfac8ff60494f3843edf44fcd8d484c58b0788812744219736c67aaa971ee5cc
unknown
text
18.4 Kb
whitelisted
—
—
GET
200
185.81.100.37:443
https://account.docusign.com/ReactApp/src/vendor/html-domparser.js
unknown
binary
1.08 Kb
whitelisted
—
—
GET
200
20.103.156.88:443
https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=13&OPSYS=WIN10&locale=en-US&country=US&edgeid=4286224394064939872&ACHANNEL=4&ABUILD=122.0.6261.70&poptin=0&devosver=10.0.19045.4046&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=122&AMINOR=0&ABLD=6261&APATCH=70
unknown
binary
2.08 Kb
whitelisted
—
—
GET
302
162.248.184.179:443
https://www.docusign.net/Signing/EmailStart.aspx?etti=43&m=b901cae2-1f82-4df8-aef0-67eaf30d2822&AspxAutoDetectCookieSupport=1&persistent_auth_token=no_client_token
unknown
html
804 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
whitelisted
3664
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3080
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7340
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7172
msedge.exe
224.0.0.251:5353
—
—
—
unknown
7172
msedge.exe
162.248.184.179:443
www.docusign.net
DOCUS-6-PROD
US
whitelisted
7172
msedge.exe
185.81.100.37:443
account.docusign.com
DOCUS-6-PROD
US
whitelisted
3080
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7340
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7172
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.docusign.net
  • 162.248.184.179
whitelisted
account.docusign.com
  • 185.81.100.37
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
msedge.b.tlu.dl.delivery.mp.microsoft.com
  • 23.32.238.105
  • 23.32.238.152
  • 23.32.238.121
  • 23.32.238.99
  • 2.19.198.41
  • 2.19.198.57
  • 199.232.214.172
  • 199.232.210.172
  • 2.16.168.112
  • 2.16.168.108
whitelisted
docucdn-a.akamaihd.net
  • 2.21.74.107
  • 2.21.74.17
  • 2.19.126.135
  • 2.19.126.140
  • 2.16.168.107
  • 2.16.168.100
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.178
  • 104.126.37.185
  • 104.126.37.154
  • 104.126.37.160
  • 104.126.37.144
  • 104.126.37.163
  • 104.126.37.153
  • 104.126.37.155
  • 2.23.227.208
  • 2.23.227.215
  • 104.126.37.137
  • 104.126.37.186
  • 104.126.37.170
  • 104.126.37.161
  • 104.126.37.176
  • 104.126.37.177
  • 104.126.37.179
  • 104.126.37.130
  • 104.126.37.129
  • 104.126.37.139
  • 104.126.37.147
whitelisted

Threats

PID
Process
Class
Message
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected phishing based on domain name abuse (docusign)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected phishing based on domain name abuse (docusign)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected phishing based on domain name abuse (docusign)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.docusign.net/Signing/EmailStart.aspx?etti=43&m=b901cae2-1f82-4df8-aef0-67eaf30d2822