Analysis Report http://track.coronavirusworldupdatesmail.com

Overview

General Information

Sample URL:	http://track.coronavirusworldupdatesmail.com
Analysis ID:	410043
Infos:
Most interesting Screenshot:
Errors URL not reachable

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: track.coronavirusworldupdatesmail.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: track.coronavirusworldupdatesmail.com

Source: ~DFB97230778D1EAE58.TMP.1.dr	String found in binary or memory: http://track.coronavirusworldupdatesmail.com/
Source: {7A85CA46-B1B8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: http://track.coronavirusworldupdatesmail.com/Root

Source: classification engine

Classification label: unknown0.win@3/14@1/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7A85CA44-B1B8-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF3D13E0183C10DE39.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6496 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6496 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.73.52	track.coronavirusworldupdatesmail.com	United States		13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
track.coronavirusworldupdatesmail.com	104.21.73.52	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://track.coronavirusworldupdatesmail.com/	false	Avira URL Cloud: safe	unknown

ID:	410043
Product:	CloudBasic
Start time:	19:51:37
Start date:	10.05.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7A85CA44-B1B8-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	5718AA8AA71BB896D3DCC4ABCDC52091	CD888A095008A56241176C7A651C561C54DC9B09	B97192C637861C2E9D7B7DAF37CCF733F79E8EE2D005D320AE8DCB2FF00A5DCD
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7A85CA46-B1B8-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	0E70266AE2055BBB714416A7E88D7EDB	F3E4D4F2B9A9988D5817F5AE4D0D5850CC7BCF43	61E4442F01C513B1BF7276B4910CA86D7F7E690E299CEBB8D952B01815357527
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7A85CA47-B1B8-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	38BB92002CD59575B3800BA818570EE8	F6CE14E67B9623EDB51D701810A3595EF748490F	D9CE70CA96BA3857744B983195D1E562BA6D6435C8D0AA18329BCC98A000132F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\http_400[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	1960097B221E608A79D278C7959B3C59	10C261310CA68C5624185C4F6FEF8AF44EA6FBAF	1BCAF35CA02140D731E6A3AE3D3D6A5EA49CE7E552728457F790919A540AEC78
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\info_48[1]	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced	5565250FCC163AA3A79F0B746416CE69	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\background_gradient[1]	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3	20F0110ED5E4E0D5384A496E4880139B	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	F4FE1CB77E758E1BA56B8A8EC20417C5	F4EDA06901EDB98633A686B11D02F4925F827BF0	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\bullet[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	26F971D87CA00E23BD2D064524AEF838	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
C:\Users\user\AppData\Local\Temp\~DF3D13E0183C10DE39.TMP	data	5F23E63CC2B54B719F394FE1F5750B22	1C4ABBE2992DCFDC4AAAC48CE44F76A3353C4E15	F48FCDE14D5FA8018D23F48F359480B8CD8B2290285CC46F663AE2A0D72A28C1
C:\Users\user\AppData\Local\Temp\~DF7F138E5C72101DFB.TMP	data	2FACC511D0FF8EC3975247F164FB7377	C831153DE1F556A1551322A544C84B46454E6590	DDE18210B3750BED105E1027CCA4F442EF83E3200C1280B86F1BF7076D4FB549
C:\Users\user\AppData\Local\Temp\~DFB97230778D1EAE58.TMP	data	7AA9A15AE5E61A1F80B480136F2AA836	26253D721E1EBA2331539B2C1117D739B07D9E72	A7C2ED474DB5812BAC8244405B460EA66B4BF24D308FF876BE5886F2025DF151

Analysis Report http://track.coronavirusworldupdatesmail.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs