Analysis Report https://theumg.io/sendy/l/VW1gAgapdPzbdYRlrDKGfg/jIGbD9oIL71s0OhPRyHYIA/8v8Gu9q6f7m64yYP6Fjp4A

Overview

General Information

Sample URL: https://theumg.io/sendy/l/VW1gAgapdPzbdYRlrDKGfg/jIGbD9oIL71s0OhPRyHYIA/8v8Gu9q6f7m64yYP6Fjp4A
Analysis ID: 385480
Infos:

Most interesting Screenshot:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

No high impact signatures.

Classification

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 167.86.77.111:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.86.77.111:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: theumg.io
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown HTTPS traffic detected: 167.86.77.111:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.86.77.111:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: classification engine Classification label: clean0.win@3/6@1/1
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6E19B87B-9B92-11EB-90EB-ECF4BBEA1588}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFEDC4065D0C93F2A6.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6472 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6472 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 385480 URL: https://theumg.io/sendy/l/V... Startdate: 12/04/2021 Architecture: WINDOWS Score: 0 5 iexplore.exe 1 54 2->5         started        process3 7 iexplore.exe 24 5->7         started        dnsIp4 10 theumg.io 167.86.77.111, 443, 49727, 49728 CONTABODE Germany 7->10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
167.86.77.111
 theumg.io Germany
51167 CONTABODE false

Contacted Domains

Name IP Active
theumg.io 167.86.77.111 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
false
    		low