Windows Analysis Report
https://u43197812.ct.sendgrid.net/ls/click?upn=u001.TgFW-2BQD-2FE7yMaclzIJQwn9qZF3-2FXzpRvXEX0tzW6EB6gW8DDwAKUWABjk0Cpq-2Fdz4M57xGIo5-2F6KKAb29fluuw-3D-3DTs77_rO-2FlG9aNEfOODMQQnJrFgo3hymD2kiOmvLq7huX3fN9kYkz1gV86mx1on2uqoUekik3S0U5MQ-2BxcTxAAAQVsKocjCr5fk64t9c-2BiBkNJXy814oSZh73tt0nhb1jvW2xtial-2FO

Overview

General Information

Sample URL:	https://u43197812.ct.sendgrid.net/ls/click?upn=u001.TgFW-2BQD-2FE7yMaclzIJQwn9qZF3-2FXzpRvXEX0tzW6EB6gW8DDwAKUWABjk0Cpq-2Fdz4M57xGIo5-2F6KKAb29fluuw-3D-3DTs77_rO-2FlG9aNEfOODMQQnJrFgo3hymD2kiOmvLq7huX
Analysis ID:	1417101

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://u43197812.ct.sendgrid.net/ls/click?upn=u001.TgFW-2BQD-2FE7yMaclzIJQwn9qZF3-2FXzpRvXEX0tzW6EB6gW8DDwAKUWABjk0Cpq-2Fdz4M57xGIo5-2F6KKAb29fluuw-3D-3DTs77_rO-2FlG9aNEfOODMQQnJrFgo3hymD2kiOmvLq7huX3fN9kYkz1gV86mx1on2uqoUekik3S0U5MQ-2BxcTxAAAQVsKocjCr5fk64t9c-2BiBkNJXy814oSZh73tt0nhb1jvW2xtial-2FOsgz3g0mSHtIRCFl5GrdLWROfg4NHudyZFT9PzdpDy9ws7m-2FBCMZU8k2-2B1CQBE7tuMnHvmEFc-2BemeBWNkvmjrwhbxK-2FKMSGu6rwTB3Y-3D

HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49706 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: unknown

DNS traffic detected: queries for: u43197812.ct.sendgrid.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown

HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49706 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@13/8@4/19

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://u43197812.ct.sendgrid.net/ls/click?upn=u001.TgFW-2BQD-2FE7yMaclzIJQwn9qZF3-2FXzpRvXEX0tzW6EB6gW8DDwAKUWABjk0Cpq-2Fdz4M57xGIo5-2F6KKAb29fluuw-3D-3DTs77_rO-2FlG9aNEfOODMQQnJrFgo3hymD2kiOmvLq7huX3fN9kYkz1gV86mx1on2uqoUekik3S0U5MQ-2BxcTxAAAQVsKocjCr5fk64t9c-2BiBkNJXy814oSZh73tt0nhb1jvW2xtial-2FOsgz3g0mSHtIRCFl5GrdLWROfg4NHudyZFT9PzdpDy9ws7m-2FBCMZU8k2-2B1CQBE7tuMnHvmEFc-2BemeBWNkvmjrwhbxK-2FKMSGu6rwTB3Y-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1976,i,4353144744606916921,267135791406568542,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1976,i,4353144744606916921,267135791406568542,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.16.113	unknown	United States	15169	GOOGLEUS	false
167.89.115.54	u43197812.ct.sendgrid.net	United States	11377	SENDGRIDUS	false
142.251.167.99	www.google.com	United States	15169	GOOGLEUS	false
172.253.115.94	unknown	United States	15169	GOOGLEUS	false
142.251.163.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
www.google.com	142.251.167.99	true
u43197812.ct.sendgrid.net	167.89.115.54	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://u43197812.ct.sendgrid.net/ls/click?upn=u001.TgFW-2BQD-2FE7yMaclzIJQwn9qZF3-2FXzpRvXEX0tzW6EB6gW8DDwAKUWABjk0Cpq-2Fdz4M57xGIo5-2F6KKAb29fluuw-3D-3DTs77_rO-2FlG9aNEfOODMQQnJrFgo3hymD2kiOmvLq7huX3fN9kYkz1gV86mx1on2uqoUekik3S0U5MQ-2BxcTxAAAQVsKocjCr5fk64t9c-2BiBkNJXy814oSZh73tt0nhb1jvW2xtial-2FOsgz3g0mSHtIRCFl5GrdLWROfg4NHudyZFT9PzdpDy9ws7m-2FBCMZU8k2-2B1CQBE7tuMnHvmEFc-2BemeBWNkvmjrwhbxK-2FKMSGu6rwTB3Y-3D	false		high

ID:	1417101
Product:	CloudBasic
Start time:	16:04:32
Start date:	28.03.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 14:04:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6FD68B0B64518596C8834B66DCD7AD56	07D3742F5F756D3624BB96B9CF5D0100B8DE46C5	7E5BC7EBD8B2EA6C50E8A9D811EFE5D1EF8A672D1A724BEA6C45A1CD7FA7A7A3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 14:04:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	195E17FA912279643E0FF215735B073F	9724579E1203BE1A79B3AAFDAD156BF24773C0B9	01E827198F03B744B4ECEBFE392C4C87BDC00B39960B2B04A456BFD90414CA0B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	52299E7E25581574F84A66D27538DEC0	86BA48648EE2CAAE0AA984551D360FA15886D2C4	F48AEA75F473416B552613D6C4EBC5744588915D4116ED2F11D3313E9ECA4ABF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 14:04:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7B01BAD5653EE2320FB81B623476B4E0	D1510CBBF5046494BAD51A6B7F1E78CB7F0C062C	5C2ED8BED43F11DEEAD90D3C40AD32E1F9F4258D6771561427906E607A273B5E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 14:04:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3A94F62396DF7AE41189DE3232D0FCB7	8DD3AE609CBF0D3D005A64569FA9E44EE06AD4B2	CFCB7F3676A519D6817F641CFF0138EAEFE20343E5A446DAFB4CE71D255A940A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 14:04:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C2FC2374B7A1ABC5010D84150EC07F80	99E6308C1613D164318512D62AC2C608402BDEB6	981AFE3E4CCD8255E4E778D33AD87FB8820E241B87868BC84F9DE7C52E3545A0
Chrome Cache Entry: 46	HTML document, ASCII text, with CRLF line terminators	8E325DC2FEA7C8900FC6C4B8C6C394FE	1B3291D4EEA179C84145B2814CB53E6A506EC201	0B52C5338AF355699530A47683420E48C7344E779D3E815FF9943CBFDC153CF2
Chrome Cache Entry: 47	HTML document, ASCII text, with no line terminators	310E794861855F03DACD1A6BD12A5D26	7B1E76A469D9B35349C242A1C7EB5FE5E1F8AA92	6F25D08A0DA028A31DB3CB3FD36FC6AA36ED01BF44058520DC8689763A1B0F6A

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs