Analysis Report https://www.corona-impftermine.net/

Overview

General Information

Sample URL: https://www.corona-impftermine.net/
Analysis ID: 423643
Infos:

Most interesting Screenshot:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Contains capabilities to detect virtual machines
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device

Classification

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 206.189.50.60:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 206.189.50.60:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.65.48.84:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.65.48.84:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.164.24:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.164.24:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: www.corona-impftermine.net
Source: 77EC63BDA74BD0D0E0426DC8F8008506.3.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: bootstrap.min[1].css.3.dr String found in binary or memory: http://getbootstrap.com)
Source: bootstrap.min[1].css.3.dr String found in binary or memory: http://getbootstrap.com/customize/?id=92d2ac1b31978642b6b6)
Source: b979d43d3560770a058a4e5c8365a89b7a34bd97[1].js.3.dr String found in binary or memory: http://jeffry.in)
Source: jquery-ui.min[1].js.3.dr String found in binary or memory: http://jqueryui.com
Source: widget-frame[1].js.3.dr String found in binary or memory: http://my.opera.com/emoller/blog/2011/12/20/requestanimationframe-for-smart-er-animating
Source: widget-frame[1].js.3.dr String found in binary or memory: http://paulirish.com/2011/requestanimationframe-for-smart-animating/
Source: 2D85F72862B55C4EADD9E66E06947F3D.3.dr String found in binary or memory: http://x1.i.lencr.org/
Source: analytics[1].js.3.dr String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: init[1].js.3.dr String found in binary or memory: https://app.stackbit.com
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://cdn4.telesco.pe/file/If4Zr2ttuL_7uT0wdXVMydXgy_Nja4zvrsxqDp6LlQb7RMEdm67uWKgfvm7NECHzJIYx40X
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://cdn4.telesco.pe/file/LfekFXXO2DQSrc3ldOK4ODQ_elHefA0r6trM-qwkMHrTlH1dZMnG3fGqkm_0LtpGUipVaY7
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://cdn4.telesco.pe/file/W64IsBmmsFuC9_GQAxZjWJM2xi_VDAdUZWx5uPYuDtdljMogWKJ6Ml4ZIRjw9UiHxwGyP00
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://cdn4.telesco.pe/file/lCVK3nG1WQZ2PlqPX2EgfYssz-2u_Ih8AK1GV_WiJLXKs8fTJCLPFTELhERyPjmktublhsE
Source: augsburg[1].htm.3.dr String found in binary or memory: https://coronavirus.nrw/neues/
Source: augsburg[1].htm.3.dr, hamburg[1].htm.3.dr, nurnberg[1].htm.3.dr, munchen[1].htm.3.dr, W7YU039Z.htm.3.dr String found in binary or memory: https://d33wubrfki0l68.cloudfront.net/011e84784814d6cc0b2d8fe255786117680fc476/557b6/images/majestic
Source: augsburg[1].htm.3.dr, hamburg[1].htm.3.dr, nurnberg[1].htm.3.dr, munchen[1].htm.3.dr, W7YU039Z.htm.3.dr String found in binary or memory: https://d33wubrfki0l68.cloudfront.net/bundles/b979d43d3560770a058a4e5c8365a89b7a34bd97.js
Source: W7YU039Z.htm.3.dr String found in binary or memory: https://d33wubrfki0l68.cloudfront.net/css/f32e8963c988162755fb15c930cba39355a7da17/_next/static/css/
Source: augsburg[1].htm.3.dr, W7YU039Z.htm.3.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Lora:ital
Source: corona_impftermine_muc[1].htm.3.dr, corona_impftermine_nue[1].htm.3.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: css2[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI6MX1D_JOuGQbT0gvTJPa787weuyJF.woff)
Source: css2[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI6MX1D_JOuGQbT0gvTJPa787z5vCJF.woff)
Source: css2[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI8MX1D_JOuMw_hLdO6T2wV9KnW-C0Ckqs.woff)
Source: css2[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI8MX1D_JOuMw_hLdO6T2wV9KnW-MoFkqs.woff)
Source: css[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc-.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: bootstrap.min[1].css.3.dr String found in binary or memory: https://gist.github.com/92d2ac1b31978642b6b6
Source: b979d43d3560770a058a4e5c8365a89b7a34bd97[1].js.3.dr String found in binary or memory: https://github.com/dollarshaveclub/reframe.js#readme
Source: bootstrap.min[1].css.3.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://onlinetermine.zollsoft.de/patientenTermine.php?uniqueident=607feb7a343fb
Source: telegram[1].css.3.dr String found in binary or memory: https://osx.tlgr.org/updates/site/artboard.png)
Source: telegram[1].css.3.dr String found in binary or memory: https://osx.tlgr.org/updates/site/artboard_2x.png);
Source: analytics[1].js.3.dr String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: augsburg[1].htm.3.dr String found in binary or memory: https://t.me/corona_impftermine_agb
Source: augsburg[1].htm.3.dr String found in binary or memory: https://t.me/corona_impftermine_ber
Source: augsburg[1].htm.3.dr String found in binary or memory: https://t.me/corona_impftermine_cgn
Source: augsburg[1].htm.3.dr String found in binary or memory: https://t.me/corona_impftermine_dus
Source: augsburg[1].htm.3.dr String found in binary or memory: https://t.me/corona_impftermine_ffm
Source: augsburg[1].htm.3.dr, hamburg[1].htm.3.dr String found in binary or memory: https://t.me/corona_impftermine_hh
Source: augsburg[1].htm.3.dr, munchen[1].htm.3.dr String found in binary or memory: https://t.me/corona_impftermine_muc
Source: augsburg[1].htm.3.dr, nurnberg[1].htm.3.dr String found in binary or memory: https://t.me/corona_impftermine_nue
Source: augsburg[1].htm.3.dr String found in binary or memory: https://t.me/corona_impftermine_str
Source: analytics[1].js.3.dr String found in binary or memory: https://tagassistant.google.com/
Source: augsburg[1].htm.3.dr String found in binary or memory: https://telegram.org/apps
Source: corona_impftermine_nue[1].htm.3.dr String found in binary or memory: https://tttttt.me/cdn4/file/P7FovyAGrMzdIdkvULg3nvuBJd0NxOw5MKIMZjgd-15vXz4c8tE0SMtW6-lkZjh3t1CaK2iD
Source: corona_impftermine_hh[1].htm.3.dr String found in binary or memory: https://tttttt.me/cdn4/file/WMPWzsM8W37tnne6-j1xjcoxulxwfB2wwds_UyVJOQ8yH9ng3jtjihpzXs1AWj23fkkYir6-
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/10
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/11
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/12
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/13
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/14
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/15
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/16
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/17
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/18
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/19
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/20
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/21
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/22
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/3
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/4
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/5
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/6
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/7
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/8
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_agb/9
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr, corona_impftermine_hh[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_hh
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/570
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/571
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/572
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/573
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/574
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/575
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/576
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/577
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/578
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/579
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/580
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/581
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/582
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/583
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/584
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/585
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/586
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/587
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/588
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_muc/589
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr, corona_impftermine_nue[1].htm.3.dr String found in binary or memory: https://tttttt.me/corona_impftermine_nue
Source: augsburg[1].htm.3.dr String found in binary or memory: https://web.tel.onl/
Source: init[1].js.3.dr String found in binary or memory: https://widget.stackbit.com
Source: augsburg[1].htm.3.dr String found in binary or memory: https://www.baden-wuerttemberg.de/de/service/presse/pressemitteilung/pid/priorisierung-in-arztpraxen
Source: W7YU039Z.htm.3.dr String found in binary or memory: https://www.buymeacoffee.com/maxritter
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr, augsburg[1].htm.3.dr, ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr, ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/#content
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: https://www.corona-impftermine.net/$Corona
Source: augsburg[1].htm.3.dr String found in binary or memory: https://www.corona-impftermine.net/.
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: https://www.corona-impftermine.net/Root
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: https://www.corona-impftermine.net/augsburg/
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: https://www.corona-impftermine.net/augsburg/6Corona
Source: ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/augsburg/z
Source: ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/content
Source: ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/contentUser
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: https://www.corona-impftermine.net/h
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: https://www.corona-impftermine.net/hamburg/
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: https://www.corona-impftermine.net/hamburg/4Corona
Source: ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/hamburg/x
Source: ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/hamburg/z
Source: imagestore.dat.3.dr String found in binary or memory: https://www.corona-impftermine.net/images/Download.png
Source: W7YU039Z.htm.3.dr String found in binary or memory: https://www.corona-impftermine.net/images/corona.jpg
Source: augsburg[1].htm.3.dr, hamburg[1].htm.3.dr, nurnberg[1].htm.3.dr, munchen[1].htm.3.dr, W7YU039Z.htm.3.dr String found in binary or memory: https://www.corona-impftermine.net/imprint
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr, ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/munchen/
Source: ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/munchen/.corona-impftermine.net/munchen/
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: https://www.corona-impftermine.net/munchen/4Corona
Source: ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/munchen/x
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr, ~DFF1CF27BECECB5F3A.TMP.1.dr String found in binary or memory: https://www.corona-impftermine.net/nurnberg/
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: https://www.corona-impftermine.net/nurnberg/6Corona
Source: augsburg[1].htm.3.dr, hamburg[1].htm.3.dr, nurnberg[1].htm.3.dr, munchen[1].htm.3.dr, W7YU039Z.htm.3.dr String found in binary or memory: https://www.corona-impftermine.net/privacy-policy
Source: augsburg[1].htm.3.dr, hamburg[1].htm.3.dr, nurnberg[1].htm.3.dr, munchen[1].htm.3.dr, W7YU039Z.htm.3.dr String found in binary or memory: https://www.corona-impftermine.net/terms-and-conditions
Source: corona_impftermine_agb[1].htm.3.dr String found in binary or memory: https://www.doctolib.de/gemeinschaftspraxis/aichach/aerzte-aichach?pid=practice-115296
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://www.doctolib.de/gemeinschaftspraxis/muenchen/fuchs-hierl?pid=practice-25230
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://www.doctolib.de/medizinisches-versorgungszentrum-mvz/muenchen/medizinisches-versorgungszentr
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://www.doctolib.de/praxis/muenchen/hausarztpraxis-dr-grassl?pid=practice-116543
Source: corona_impftermine_muc[1].htm.3.dr String found in binary or memory: https://www.doctolib.de/praxis/muenchen/hausarztpraxis-muenchen?pid=practice-106858
Source: augsburg[1].htm.3.dr String found in binary or memory: https://www.generateprivacypolicy.com/).
Source: analytics[1].js.3.dr String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.3.dr String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.3.dr String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: analytics[1].js.3.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: augsburg[1].htm.3.dr String found in binary or memory: https://www.kvberlin.de/fuer-patienten/corona/corona-impfungen
Source: augsburg[1].htm.3.dr String found in binary or memory: https://www.kvhessen.de/coronavirus/coronaimpfungen/
Source: augsburg[1].htm.3.dr, W7YU039Z.htm.3.dr String found in binary or memory: https://www.kvhh.net/de/praxis/aktuelle-meldungen.html
Source: augsburg[1].htm.3.dr, hamburg[1].htm.3.dr, nurnberg[1].htm.3.dr, munchen[1].htm.3.dr, W7YU039Z.htm.3.dr String found in binary or memory: https://www.maxritter.net/
Source: augsburg[1].htm.3.dr, W7YU039Z.htm.3.dr String found in binary or memory: https://www.stmgp.bayern.de/presse/holetschek-priorisierung-fuer-corona-impfungen-in-arztpraxen-aufg
Source: augsburg[1].htm.3.dr String found in binary or memory: https://www.termsandconditionsgenerator.com/)
Source: augsburg[1].htm.3.dr String found in binary or memory: https://www.wissenschaft.de
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr, augsburg[1].htm.3.dr String found in binary or memory: https://xn--r1a.website/s/corona_impftermine_agb
Source: augsburg[1].htm.3.dr String found in binary or memory: https://xn--r1a.website/s/corona_impftermine_ber
Source: augsburg[1].htm.3.dr String found in binary or memory: https://xn--r1a.website/s/corona_impftermine_cgn
Source: augsburg[1].htm.3.dr String found in binary or memory: https://xn--r1a.website/s/corona_impftermine_dus
Source: augsburg[1].htm.3.dr String found in binary or memory: https://xn--r1a.website/s/corona_impftermine_ffm
Source: augsburg[1].htm.3.dr String found in binary or memory: https://xn--r1a.website/s/corona_impftermine_hh
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr, augsburg[1].htm.3.dr, munchen[1].htm.3.dr String found in binary or memory: https://xn--r1a.website/s/corona_impftermine_muc
Source: {4A1F861A-BD75-11EB-90E5-ECF4BB2D2496}.dat.1.dr, augsburg[1].htm.3.dr, nurnberg[1].htm.3.dr String found in binary or memory: https://xn--r1a.website/s/corona_impftermine_nue
Source: augsburg[1].htm.3.dr String found in binary or memory: https://xn--r1a.website/s/corona_impftermine_str
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown HTTPS traffic detected: 206.189.50.60:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 206.189.50.60:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.84.15:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.65.48.84:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.65.48.84:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.95.65:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.164.24:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.164.24:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: classification engine Classification label: clean1.win@5/56@11/6
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4A1F8618-BD75-11EB-90E5-ECF4BB2D2496}.dat Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6164:120:WilError_01
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF5FDD67D587003693.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5792 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5792 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\OpenWith.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains capabilities to detect virtual machines
Source: C:\Windows\System32\OpenWith.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Source: OpenWith.exe, 0000000D.00000003.495953389.0000023CE5AA6000.00000004.00000001.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}vr

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11712.1001.23.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200.png VolumeInformation Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 423643 URL: https://www.corona-impfterm... Startdate: 25/05/2021 Architecture: WINDOWS Score: 1 15 www.corona-impftermine.net 2->15 6 iexplore.exe 9 59 2->6         started        8 OpenWith.exe 16 2->8         started        10 OpenWith.exe 2->10         started        process3 process4 12 iexplore.exe 3 86 6->12         started        dnsIp5 17 cdn4.telesco.pe 149.154.164.24, 443, 49756, 49757 TELEGRAMRU United Kingdom 12->17 19 xn--r1a.website 95.216.186.40, 443, 49748, 49749 HETZNER-ASDE Germany 12->19 21 8 other IPs or domains 12->21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.225.84.15
 d33wubrfki0l68.cloudfront.net United States
16509 AMAZON-02US false
95.216.186.40
 tlgr.org Germany
24940 HETZNER-ASDE false
149.154.164.24
 cdn4.telesco.pe United Kingdom
62041 TELEGRAMRU false
206.189.50.60
 www.corona-impftermine.net United States
14061 DIGITALOCEAN-ASNUS false
3.65.48.84
 widget.stackbit.com United States
16509 AMAZON-02US false
104.16.95.65
 cloudflareinsights.com United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
tlgr.org 95.216.186.40 true
tttttt.me 95.216.186.40 true
www.corona-impftermine.net 206.189.50.60 true
cloudflareinsights.com 104.16.95.65 true
static.cloudflareinsights.com 104.16.95.65 true
cdn4.telesco.pe 149.154.164.24 true
xn--r1a.website 95.216.186.40 true
d33wubrfki0l68.cloudfront.net 13.225.84.15 true
widget.stackbit.com 3.65.48.84 true
x1.i.lencr.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.corona-impftermine.net/augsburg/ false
    		unknown
    https://www.corona-impftermine.net/hamburg/ false
      		unknown
      https://www.corona-impftermine.net/nurnberg/ false
        		unknown