Microsoft Tech Support Kit 0589be7

A Microsoft Tech support kit containing an audio file used across many different domains. As well as a JS function that is used to get the phone number from the URL parameters.

References

Recent Detections

  • hxxps://layercores[.]site/code4048masg
  • hxxps://f704eb93-0493-41ab-94da-6c9b47b575f6[.]s3[.]ap-northeast...
  • hxxps://caretakes[.]site/code4048masg
  • hxxps://whorparks[.]xyz/code2908masg/JaC0deJdfd008f0d0CH888Err0r...
  • hxxps://newusa[.]s3[.]us-west-1[.]amazonaws[.]com/AmC00FrdEr00d0...
  • hxxps://f704eb93-0493-41ab-94da-6c9b47b575f6[.]s3[.]ap-northeast...
  • hxxp://silvhornautomotivev[.]ml/
  • hxxp://www[.]windowsonline2[.]xyz/ENJdfdfdDEfShafd0CH888Error8DK...
  • hxxps://jhonnyworks[.]xyz/code4048masg
  • hxxps://jellyfish-app-xf3y7[.]ondigitalocean[.]app/

IOK Rule (edit)

title: Microsoft Tech Support Kit 0589be7
description: |
  A Microsoft Tech support kit containing an audio file used across many different domains.
  As well as a JS function that is used to get the phone number from the URL parameters.
references:
  - https://urlscan.io/search/#hash%3A0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
  - https://urlscan.io/result/810e4051-a6bf-4853-808b-8cb9283a36fe
  
detection:

  audioFileName:
    js|contains: 'wa0lDErtm0s.mp3'
    
  otherAudioFileName:
    html|contains: '0wa0rni0ng0.mp3'
    
  getPhoneNumberFunction:
    html|contains: "getVariableFromURl('phone');"
    
  condition: (audioFileName and getPhoneNumberFunction) or (otherAudioFileName and getPhoneNumberFunction)
  
tags:
  - target.microsoft