Microsoft Tech Support Kit 0589be7

A Microsoft Tech support kit containing an audio file used across many different domains. As well as a JS function that is used to get the phone number from the URL parameters.

References

Recent Detections

  • hxxps://soepqwoab134[.]ga/JP0_NE0W_s0fh0s0-inf0hyV09171Er012new1...
  • hxxps://shooonikuduniya[.]azurewebsites[.]net
  • hxxps://syndicateglobnet453[.]ml/hfewu4sdf-rwsi3de0wos5df-e0o6s-...
  • hxxps://syndicateglobnet453[.]ml/hfewu4sdf-rwsi3de0wos5df-e0o6s-...
  • hxxps://syndicateglobnet453[.]ml/hfewu4sdf-rwsi3de0wos5df-e0o6s-...
  • hxxps://segmentedglobweb245[.]ga/freisd-df0r0ifr0wosd-fe0os-fwoi...
  • hxxps://segmentedglobweb245[.]ga/freisd-df0r0ifr0wosd-fe0os-fwoi...
  • hxxps://shooonikuduniya[.]azurewebsites[.]net/
  • hxxps://segmentedglobweb245[.]ga/freisd-df0r0ifr0wosd-fe0os-fwoi...
  • hxxps://retrievalingwebnote552[.]ml/hfrwi4sdsf-re0ieosdde-0fewps...

IOK Rule (edit)

title: Microsoft Tech Support Kit 0589be7
description: |
  A Microsoft Tech support kit containing an audio file used across many different domains.
  As well as a JS function that is used to get the phone number from the URL parameters.
references:
  - https://urlscan.io/search/#hash%3A0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
  - https://urlscan.io/result/810e4051-a6bf-4853-808b-8cb9283a36fe
  
detection:

  audioFileName:
    js|contains: 'wa0lDErtm0s.mp3'
    
  getPhoneNumberFunction:
    html|contains: "getVariableFromURl('phone');"
    
  condition: audioFileName and getPhoneNumberFunction
  
tags:
  - target.microsoft