Analysis Report http://ia.51.la/go1?id=341763&rt=1621300016852&rl=1536*865&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=%25E6%259C%25AC%25E9%25A1%25B5%25E4%25B8%25BA%25E6%2582%25A8%25E6%258F%2590%25E4%25BE%259B%25E3%2580%258A%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E3%2580%258B%25E9%2592%25A2%25E7%2590%25B4%25E8%25B0%25B1%25E3%2580%2582%25E6%25BC%2594%25E5%2594%25B1%25E8%2580%2585%2520%25EF%25BC%258C%25E7%2594%25B1%25E4%25B9%2590%25E5%258F%258B&ing=1&ekc=&sid=1621300016852&tt=%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1_%25E9%2592%25A2%25E7%2590%25B4%25E8%25B0%25B1_%25E6%2590%259C%25E8%25B0%25B1%25E7%25BD%2591&kw=%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E9%2592%25A2%25E7%2590%25B4%25E8%25B0%25B1%25EF%25BC%258C%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E6%25AD%258C%25E8%25B0%25B1%25EF%25BC%258C%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E4%25B9%2590%25E8%25B0%25B1%25EF%25BC%258C%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E6%259B%25B2%25E8%25B0%25B1&cu=http%253A%252F%252Fwww.sooopu.com%252Fhtml%252F300%252F300917.html&pu=https%253A%252F%252Fwww.google.com%252F

Overview

General Information

Sample URL:	http://ia.51.la/go1?id=341763&rt=1621300016852&rl=1536*865&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=%25E6%259C%25AC%25E9%25A1%25B5%25E4%25B8%25BA%25E6%2582%25A8%25E6%258F%2590%25E4%25BE%259B%25E3%2580%258A%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E3%2580%258B%25E9%2592%25A2%25E7%2590%25B4%25E8%25B0%25B1%25E3%2580%2582%25E6%25BC%2594%25E5%2594%25B1%25E8%2580%2585%2520%25EF%25BC%258C%25E7%2594%25B1%25E4%25B9%2590%25E5%258F%258B&ing=1&ekc=&sid=1621300016852&tt=%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1_%25E9%2592%25A2%25E7%2590%25B4%25E8%25B0%25B1_%25E6%2590%259C%25E8%25B0%25B1%25E7%25BD%2591&kw=%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E9%2592%25A2%25E7%2590%25B4%25E8%25B0%25B1%25EF%25BC%258C%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E6%25AD%258C%25E8%25B0%25B1%25EF%25BC%258C%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E4%25B9%2590%25E8%25B0%25B1%25EF%25BC%258C%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E6%259B%25B2%25E8%25B0%25B1&cu=http%253A%252F%252Fwww.sooopu.com%252Fhtml%252F300%252F300917.html&pu=https%253A%252F%252Fwww.google.com%252F
Analysis ID:	419707
Infos:
Most interesting Screenshot:
Errors URL not reachable

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: global traffic

HTTP traffic detected: GET /go1?id=341763&rt=1621300016852&rl=1536*865&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=%25E6%259C%25AC%25E9%25A1%25B5%25E4%25B8%25BA%25E6%2582%25A8%25E6%258F%2590%25E4%25BE%259B%25E3%2580%258A%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E3%2580%258B%25E9%2592%25A2%25E7%2590%25B4%25E8%25B0%25B1%25E3%2580%2582%25E6%25BC%2594%25E5%2594%25B1%25E8%2580%2585%2520%25EF%25BC%258C%25E7%2594%25B1%25E4%25B9%2590%25E5%258F%258B&ing=1&ekc=&sid=1621300016852&tt=%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1_%25E9%2592%25A2%25E7%2590%25B4%25E8%25B0%25B1_%25E6%2590%259C%25E8%25B0%25B1%25E7%25BD%2591&kw=%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E9%2592%25A2%25E7%2590%25B4%25E8%25B0%25B1%25EF%25BC%258C%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E6%25AD%258C%25E8%25B0%25B1%25EF%25BC%258C%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E4%25B9%2590%25E8%25B0%25B1%25EF%25BC%258C%25E7%25AC%25AC14%25E9%25A6%2596%2520-%25E7%259C%259F%25E7%25A5%259E%25E4%25B9%258B%25E7%2588%25B1%25E6%259B%25B2%25E8%25B0%25B1&cu=http%253A%252F%252Fwww.sooopu.com%252Fhtml%252F300%252F300917.html&pu=https%253A%252F%252Fwww.google.com%252F HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ia.51.laConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: ia.51.la

Source: {45DD82B8-BA8A-11EB-90E5-ECF4BB570DC9}.dat.1.dr, ~DFD8FD46EAA6015FBE.TMP.1.dr

String found in binary or memory: http://ia.51.la/go1?id=341763&rt=1621300016852&rl=1536

Source: classification engine

Classification label: unknown0.win@3/11@1/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{45DD82B6-BA8A-11EB-90E5-ECF4BB570DC9}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF28E974976F96915B.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5440 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5440 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
183.131.207.66	d2cb5ad7002c4066.huaweisafedns.com	China		136190	CHINATELECOM-ZHEJIANG-JINHUA-IDCJINHUAZHEJIANGProvince	false

Contacted Domains

Name	IP	Active
d2cb5ad7002c4066.huaweisafedns.com	183.131.207.66	true
ia.51.la	unknown	unknown

ID:	419707
Product:	CloudBasic
Start time:	16:13:33
Start date:	21.05.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{45DD82B6-BA8A-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	25136B1D075123065D49DDEDC3450AC4	31A75DB26386985987E44C894439545CCD671E7A	6829FE98D5A1B2735C08702063360AC74CF3ED6D8D6A4EEEBFA5F99F308E17DC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{45DD82B8-BA8A-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	82B927FFCCDE1C3DEF14991F4FAC3C48	784F31AD416167FA6827A62EBA1D503B76141991	BFAC308ED964318F4D6CC5A1FB95DF43935D0C8E1A844EEE86EC1D64AADFDD00
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{45DD82B9-BA8A-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	24BDB73D12EA601A5BE98400E3BEC95B	8DF291C171CE9339460B55D9BD85CF718413865E	516FA5F25DC70E88B13FB7704A3098362145696DFE2D3EA4996593B5CCF06D48
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Temp\~DF28E974976F96915B.TMP	data	177C0C770349C08DBB3C167DC0BE90C0	11E436676E5B1221AD4193D859117730B5136A81	8DE88AAB3811CC8050C5F30E4452495E81B831FA75698072CCA358B8997A55E3
C:\Users\user\AppData\Local\Temp\~DF2905C06762E8E591.TMP	data	7EAE894A9F6EFFAB9FE283B83508462F	69D6E3EE69ADEFD7AF3B6952EC5734BCC88EA32E	0F214BFA005869D482365CA9A2EFB7C8CD10D0A031B9FE0C11C01D32F633F341
C:\Users\user\AppData\Local\Temp\~DFD8FD46EAA6015FBE.TMP	data	B4438CAB77DDBFF5E73C95CBA390CFE4	88E089E3C36213039E3B098F23967D1EE706C89C	C9AF3AD2D6FB49692028B2B2FAEE50111EE9F1D1F82EDFF245E404C294D21BCE

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains