Analysis Report http://com-thebigwillow-prod1.collector.snplow.net

Overview

General Information

Sample URL:	http://com-thebigwillow-prod1.collector.snplow.net
Analysis ID:	385487
Infos:
Most interesting Screenshot:
Errors URL not reachable

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: com-thebigwillow-prod1.collector.snplow.netConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: clientconfig.passport.net

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 12 Apr 2021 13:28:38 GMTContent-Type: text/plain; charset=UTF-8Content-Length: 13Connection: keep-aliveServer: akka-http/10.1.12Data Raw: 34 30 34 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 not found

Source: ~DFA1656558CC95E706.TMP.1.dr	String found in binary or memory: http://com-thebigwillow-prod1.collector.snplow.net/
Source: {6B362ED4-9BDE-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: http://com-thebigwillow-prod1.collector.snplow.net/Root

Source: classification engine

Classification label: unknown0.win@3/14@2/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6B362ED2-9BDE-11EB-90E6-ECF4BB82F7E0}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DFAB0354CC41CB8B27.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:772 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:772 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
174.129.44.103	sp-2020021318235372500000000a-763988400.us-east-1.elb.amazonaws.com	United States		14618	AMAZON-AESUS	false

Contacted Domains

Name	IP	Active
sp-2020021318235372500000000a-763988400.us-east-1.elb.amazonaws.com	174.129.44.103	true
clientconfig.passport.net	unknown	unknown
com-thebigwillow-prod1.collector.snplow.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://com-thebigwillow-prod1.collector.snplow.net/	false	Avira URL Cloud: safe	unknown

ID:	385487
Product:	CloudBasic
Start time:	15:27:49
Start date:	12.04.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6B362ED2-9BDE-11EB-90E6-ECF4BB82F7E0}.dat	Microsoft Word Document	0C8516561D101D66476A96C6AFBE80FB	397BD69EA22F7D9BAE1A8822AA3D2E5D58D67D55	EC0CB7E6297D640BE6B8B2EC17F2BC4BA377E47368F98619239C742AC90640FA
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6B362ED4-9BDE-11EB-90E6-ECF4BB82F7E0}.dat	Microsoft Word Document	78EFFD19F281F78A976F1D1059CEAE80	38F6EA6E0255E5BFE2B3E3F8CA990BA7679C2CE5	D91D92BBFA9D8E7EE205CAA90CDC3BE8A4E3A08026D8B9AF90CE8011FA3568C8
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6B362ED5-9BDE-11EB-90E6-ECF4BB82F7E0}.dat	Microsoft Word Document	D1D8A4DC82368A882F094B4FB3B08223	F8C32653B85645DDFE818AEDDF13F9E4469CB82C	974F558A9ABF3A5DFAC5D2598CBE6F5BC00C3089956E12216FDAF4FE56099745
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\ErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	F4FE1CB77E758E1BA56B8A8EC20417C5	F4EDA06901EDB98633A686B11D02F4925F827BF0	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\bullet[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	26F971D87CA00E23BD2D064524AEF838	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\http_404[1]	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	F65C729DC2D457B7A1093813F1253192	5006C9B50108CF582BE308411B157574E5A893FC	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\info_48[1]	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced	5565250FCC163AA3A79F0B746416CE69	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\background_gradient[1]	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3	20F0110ED5E4E0D5384A496E4880139B	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Temp\~DFA1656558CC95E706.TMP	data	C4A3BE5C948B7B2B364189C5C9E490FF	42743A5076DB7F8392806D59AC9D9ED8F14CA5D4	A548A98480037E23A434891E0EB6D6FFFE19E8677D0D7298B2CEC7E6B9DBE25D
C:\Users\user\AppData\Local\Temp\~DFAB0354CC41CB8B27.TMP	data	1F3CC3066AA38F1797A4561B61441EB7	BFD1846F533D0E8146BAEFB4B05654A425F5439E	EBFF65657CB8ACE09D0FEA48C146EA40C2E0B038737740AD53089BD75C54053C
C:\Users\user\AppData\Local\Temp\~DFE26F6D6E858AB126.TMP	data	9BC5EDFBF2955DB6D56961D7D7FD3CB2	51C7736C95CDFF677748116E6C61566F8F3649C3	9300418C23BCBCFE8F447A1E45345C0180B5B6D812A5C5882A9DBAFF2187E95E

Analysis Report http://com-thebigwillow-prod1.collector.snplow.net

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs