Analysis Report http://codepoints.net/static/js/codepoint.js!3c67217e710120291b75e8c13546e320?_=1618365050047

Overview

General Information

Sample URL: http://codepoints.net/static/js/codepoint.js!3c67217e710120291b75e8c13546e320?_=1618365050047
Analysis ID: 392889
Infos:

Most interesting Screenshot:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Found WSH timer for Javascript or VBS script (likely evasive script)
Potential browser exploit detected (process start blacklist hit)

Classification

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 172.67.132.46:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.132.46:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: Binary string: wscript.pdbGCTL source: wscript.exe, 0000000D.00000002.904846709.00000209375B0000.00000002.00000001.sdmp
Source: Binary string: wscript.pdb source: wscript.exe, 0000000D.00000002.904846709.00000209375B0000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Potential browser exploit detected (process start blacklist hit)
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Windows\System32\wscript.exe
Source: unknown DNS traffic detected: queries for: codepoints.net
Source: wscript.exe, 0000000D.00000003.729131342.00000209392D1000.00000004.00000001.sdmp String found in binary or memory: https://use.typekit.net
Source: wscript.exe, 0000000D.00000003.729206190.000002093930D000.00000004.00000001.sdmp String found in binary or memory: https://use.typekit.net:G
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown HTTPS traffic detected: 172.67.132.46:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.132.46:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: classification engine Classification label: clean1.win@5/9@1/1
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BACD341B-A159-11EB-90EB-ECF4BBEA1588}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFF181345E7CC054BD.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6892 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\codepoint.js'
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6892 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\codepoint.js' Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: Binary string: wscript.pdbGCTL source: wscript.exe, 0000000D.00000002.904846709.00000209375B0000.00000002.00000001.sdmp
Source: Binary string: wscript.pdb source: wscript.exe, 0000000D.00000002.904846709.00000209375B0000.00000002.00000001.sdmp
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: wscript.exe, 0000000D.00000002.904918744.0000020937A80000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: wscript.exe, 0000000D.00000002.904918744.0000020937A80000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: wscript.exe, 0000000D.00000002.904918744.0000020937A80000.00000002.00000001.sdmp Binary or memory string: Progman
Source: wscript.exe, 0000000D.00000002.904918744.0000020937A80000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 392889 URL: http://codepoints.net/stati... Startdate: 19/04/2021 Architecture: WINDOWS Score: 1 5 iexplore.exe 4 57 2->5         started        process3 7 iexplore.exe 28 5->7         started        10 wscript.exe 5->10         started        dnsIp4 12 codepoints.net 172.67.132.46, 443, 49741, 49742 CLOUDFLARENETUS United States 7->12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.132.46
 codepoints.net United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
codepoints.net 172.67.132.46 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
0 false low