Windows Analysis Report
http://wjssrschlrp.info

Overview

General Information

Sample URL:	http://wjssrschlrp.info
Analysis ID:	1483422

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:63018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:63019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:63023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:63024 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 24MB later: 34MB

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:63002 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: wjssrschlrp.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lander HTTP/1.1Host: wjssrschlrp.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://wjssrschlrp.info/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: wjssrschlrp.info
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: btloader.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com

Source: unknown	Network traffic detected: HTTP traffic on port 63023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63010
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63022
Source: unknown	Network traffic detected: HTTP traffic on port 63028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63024
Source: unknown	Network traffic detected: HTTP traffic on port 63007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63007
Source: unknown	Network traffic detected: HTTP traffic on port 63020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63028
Source: unknown	Network traffic detected: HTTP traffic on port 63024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63020
Source: unknown	Network traffic detected: HTTP traffic on port 63018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 63008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63018

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:63018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:63019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:63023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:63024 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@20/8@14/136

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://wjssrschlrp.info/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1928,i,5462799184357337235,5951723917656998442,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1928,i,5462799184357337235,5951723917656998442,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
142.250.186.174	unknown	United States	15169	GOOGLEUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
64.233.166.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.22.74.216	btloader.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
23.38.98.78	unknown	United States	16625	AKAMAI-ASUS	false
3.33.130.190	wjssrschlrp.info	United States	8987	AMAZONEXPANSIONGB	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
wjssrschlrp.info	3.33.130.190	true
www.google.com	142.250.184.196	true
btloader.com	104.22.74.216	true
img1.wsimg.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://wjssrschlrp.info/lander	false	Avira URL Cloud: safe	unknown
https://wjssrschlrp.info/lander	false		unknown
http://wjssrschlrp.info/	false		unknown

ID:	1483422
Product:	CloudBasic
Start time:	11:45:56
Start date:	27.07.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jul 27 08:46:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7D12495EC4652FCBD4B28EE4AD8C6F4B	20370E1B9B875BA25E46EF230F83A3F208094FA4	703F2BFA53D6FA7B16B1AA7D3289E76BD0DF6F628839365C500124D9604BF73C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jul 27 08:46:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	AA810B62A3475B271A587FEB26BFCEFA	D492B4037FA1FB162526B38F0A55DEF17FCAACB7	581AC820D39CC1909EFFAAE7C24FED5D30921844366C0B106A13F2F152C3041B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2D86F2E32C449F820A8A5260738F8248	0322B866229E281C547FCA406183BF6CF5AEBBCD	9288BDEEBA61A76A4BF90718E48CB0BAC18B8C5BACC5B257B2F41A47449ADBC0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jul 27 08:46:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B675E158933718695DBEB3085344C6EF	CA1CB5A2D8179B35A5CF1FEC25E79F2FB4F1CC37	447D84BAC954B888485E8341E7B1C3AB984BD8CE82146F93CE62240454870A7B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jul 27 08:46:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6547256B5505840BB74AEE12D9444354	A02904FDC8ACDBB85D772AA3B030EA9B1E4A9584	3FE9E7291888F9A0672E95D6A1D9B0ADA947F25C07D1D953B2DD8BFB0D950C9A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jul 27 08:46:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	62EDAC64DC12A017F6B28E32442ADB38	A51CEDE435E882CC31327BD86DE20C43A2CED68D	824300FE48A7D11EAE345ED72E1012C263AD08984543D026AA1D77CF8AFAE69A
Chrome Cache Entry: 119	HTML document, ASCII text, with no line terminators	E89F75F918DBDCEE28604D4E09DD71D7	F9D9055E9878723A12063B47D4A1A5F58C3EB1E9	6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
Chrome Cache Entry: 120	HTML document, ASCII text, with very long lines (619)	B805B9795DD98FCF771093995791E580	160A1F0AC072740FA11617B4D66CB211B3E1466A	91B8E0F7554C6F705CF552CBBC09D96B25D913349FB27906E22F7C6C4130BAFA

Windows Analysis Report
http://wjssrschlrp.info

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://wjssrschlrp.info

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://wjssrschlrp.info