Analysis Report https://theumg.io/sendy/l/VW1gAgapdPzbdYRlrDKGfg/jkZXej7lRHyHDOvMzNt5kA/8v8Gu9q6f7m64yYP6Fjp4A

Overview

General Information

Sample URL: https://theumg.io/sendy/l/VW1gAgapdPzbdYRlrDKGfg/jkZXej7lRHyHDOvMzNt5kA/8v8Gu9q6f7m64yYP6Fjp4A
Analysis ID: 385482
Infos:

Most interesting Screenshot:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

No high impact signatures.

Classification

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 167.86.77.111:443 -> 192.168.2.7:49684 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.86.77.111:443 -> 192.168.2.7:49685 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: theumg.io
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown HTTPS traffic detected: 167.86.77.111:443 -> 192.168.2.7:49684 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.86.77.111:443 -> 192.168.2.7:49685 version: TLS 1.2
Source: classification engine Classification label: clean0.win@3/6@1/1
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{15DB888A-9BDE-11EB-90E6-ECF4BB82F7E0}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user~1\AppData\Local\Temp\~DF7972584DD7ADBB05.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5328 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5328 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 385482 URL: https://theumg.io/sendy/l/V... Startdate: 12/04/2021 Architecture: WINDOWS Score: 0 5 iexplore.exe 2 52 2->5         started        process3 7 iexplore.exe 22 5->7         started        dnsIp4 10 theumg.io 167.86.77.111, 443, 49684, 49685 CONTABODE Germany 7->10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
167.86.77.111
 theumg.io Germany
51167 CONTABODE false

Contacted Domains

Name IP Active
theumg.io 167.86.77.111 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
false
    		low