Windows Analysis Report
https://u43197812.ct.sendgrid.net/ls/click?upn=u001.TgFW-2BQD-2FE7yMaclzIJQwn2gZp4Ko57ZbhEbMldWWuXI-3DsNV1_rO-2FlG9aNEfOODMQQnJrFgo3hymD2kiOmvLq7huX3fN-2FZMOiELWg6xPIPz3yjjvNM3yZjYDXC6aChn5P-2B-2FMZ75G5bwfWuf0DsrgRzZRIDIV-2B6FR6V7O4vQhAMDldMBz-2F8lWrt7xt0TZZJbnB8Ol21hU4FjlBQUqNUb7Jc6a70xKxYMThtW-2Fs

Overview

General Information

Sample URL:	https://u43197812.ct.sendgrid.net/ls/click?upn=u001.TgFW-2BQD-2FE7yMaclzIJQwn2gZp4Ko57ZbhEbMldWWuXI-3DsNV1_rO-2FlG9aNEfOODMQQnJrFgo3hymD2kiOmvLq7huX3fN-2FZMOiELWg6xPIPz3yjjvNM3yZjYDXC6aChn5P-2B-2FMZ75
Analysis ID:	1417072

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://u43197812.ct.sendgrid.net/ls/click?upn=u001.TgFW-2BQD-2FE7yMaclzIJQwn2gZp4Ko57ZbhEbMldWWuXI-3DsNV1_rO-2FlG9aNEfOODMQQnJrFgo3hymD2kiOmvLq7huX3fN-2FZMOiELWg6xPIPz3yjjvNM3yZjYDXC6aChn5P-2B-2FMZ75G5bwfWuf0DsrgRzZRIDIV-2B6FR6V7O4vQhAMDldMBz-2F8lWrt7xt0TZZJbnB8Ol21hU4FjlBQUqNUb7Jc6a70xKxYMThtW-2FsIJGX9OPGqP2rnBFwFkJXenK1ZR8bwkSjT-2FKaCPzz2NADjwJrvwhuWO-2FY-3D

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49712 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.21.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: unknown

DNS traffic detected: queries for: u43197812.ct.sendgrid.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49712 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@13/8@4/11

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://u43197812.ct.sendgrid.net/ls/click?upn=u001.TgFW-2BQD-2FE7yMaclzIJQwn2gZp4Ko57ZbhEbMldWWuXI-3DsNV1_rO-2FlG9aNEfOODMQQnJrFgo3hymD2kiOmvLq7huX3fN-2FZMOiELWg6xPIPz3yjjvNM3yZjYDXC6aChn5P-2B-2FMZ75G5bwfWuf0DsrgRzZRIDIV-2B6FR6V7O4vQhAMDldMBz-2F8lWrt7xt0TZZJbnB8Ol21hU4FjlBQUqNUb7Jc6a70xKxYMThtW-2FsIJGX9OPGqP2rnBFwFkJXenK1ZR8bwkSjT-2FKaCPzz2NADjwJrvwhuWO-2FY-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1968,i,7207384205308198880,2207463515112844000,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1968,i,7207384205308198880,2207463515112844000,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.253.122.106	www.google.com	United States	15169	GOOGLEUS	false
167.89.123.147	u43197812.ct.sendgrid.net	United States	11377	SENDGRIDUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.115.101	unknown	United States	15169	GOOGLEUS	false
172.253.62.84	unknown	United States	15169	GOOGLEUS	false
142.251.163.94	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
www.google.com	172.253.122.106	true
u43197812.ct.sendgrid.net	167.89.123.147	true

ID:	1417072
Product:	CloudBasic
Start time:	15:23:27
Start date:	28.03.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:23:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	437E823C155AACE67C382CB364AD7A8D	ADC0F15D04F82A72235E9BB17706648324C97B84	61E786096303C4FDA8F7C3868FD041B25BAA31DDFB7666AB3D81B333E7DEB203
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:23:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6DA3F21D88ED7BB9C0F3A7763F2E3A7C	FF5E1AA33ED2516DE31B2E997595873126E944D6	8A3FC5F5951860B20ED3392FDAEDF73E0BFF530CE487BCEA1DA9F191C3EB6061
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	4864C4E346BEBA00C382CA472750764A	14B83F0044FD865CA8483684E6067C42EE966FDD	7690C09E92D3F0F25C3144F7B815738C07D59DF28C924B1E2C416579337CE7A6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:23:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6F60AE2964CA24837E76F090BD8E6C9C	5D12AC065A06AC7067C669567BE7F98D8484184B	BD81C69CB688701DD48D1293262E3CC2669D85A4D10F0E887D1E0F3D4A4998D3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:23:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	31A8F831FC668EE080DBFE5BF4D55F5A	9EC60F31027B20AEDA81E8DBE1CE11CEEACE3CB9	044B0ABC26A52B5A81E7DBFA84CBE665DF4153C6D78109CD70435D45CF1E508E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:23:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	4426EF28F808CFEC458D5D2466133CF1	082DDBF272D3B8C4D53298E0FC7AC9EE8D4005F4	98FEAC8A61A1F5AF3251E3B44112DABA3E3F0343F6D25E25CF5D2A25C9D48584
Chrome Cache Entry: 46	HTML document, ASCII text, with CRLF line terminators	8E325DC2FEA7C8900FC6C4B8C6C394FE	1B3291D4EEA179C84145B2814CB53E6A506EC201	0B52C5338AF355699530A47683420E48C7344E779D3E815FF9943CBFDC153CF2
Chrome Cache Entry: 47	HTML document, ASCII text, with no line terminators	310E794861855F03DACD1A6BD12A5D26	7B1E76A469D9B35349C242A1C7EB5FE5E1F8AA92	6F25D08A0DA028A31DB3CB3FD36FC6AA36ED01BF44058520DC8689763A1B0F6A

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains