URL:

http://dl.elitechus.com/ElitechLog%20Windows.exe

Full analysis: https://app.any.run/tasks/6159da04-31f8-4ec8-8723-495d53bd50f5
Verdict: Malicious activity
Analysis date: January 21, 2019, 03:50:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

428A24406081FB572F3885FB8E274035

SHA1:

12EA29D570DA7FE913BC70C570298C041479AC03

SHA256:

692EC28252285FDC7E6FE7F0507EF137315729CE3DBB9582E1CC888FBA062D54

SSDEEP:

3:N1KaJ5hIOAGNaPrA:CaJ5hIOxaPrA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SETUP.exe (PID: 3812)
      • DL.exe (PID: 640)

    • Application was dropped or rewritten from another process

      • CP210xVCPInstaller_x86.exe (PID: 3412)
      • SETUP.exe (PID: 3812)
      • DL.exe (PID: 640)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SETUP.exe (PID: 3812)
      • ElitechLog%20Windows[1].tmp (PID: 2480)
      • ElitechLog%20Windows[1].exe (PID: 2776)
      • ElitechLog%20Windows[1].exe (PID: 3828)
      • DrvInst.exe (PID: 3032)
      • CP210xVCPInstaller_x86.exe (PID: 3412)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 3032)
      • CP210xVCPInstaller_x86.exe (PID: 3412)
      • DrvInst.exe (PID: 3508)
      • SETUP.exe (PID: 3812)

    • Removes files from Windows directory

      • SETUP.exe (PID: 3812)
      • DrvInst.exe (PID: 3032)
      • DrvInst.exe (PID: 3508)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 3032)
      • SETUP.exe (PID: 3812)
      • DrvInst.exe (PID: 3508)

    • Creates files in the program directory

      • CP210xVCPInstaller_x86.exe (PID: 3412)

    • Creates a software uninstall entry

      • CP210xVCPInstaller_x86.exe (PID: 3412)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2984)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3280)
      • iexplore.exe (PID: 2984)

    • Application was dropped or rewritten from another process

      • ElitechLog%20Windows[1].tmp (PID: 2480)
      • ElitechLog%20Windows[1].tmp (PID: 4064)

    • Creates a software uninstall entry

      • ElitechLog%20Windows[1].tmp (PID: 2480)

    • Creates files in the program directory

      • ElitechLog%20Windows[1].tmp (PID: 2480)

    • Changes internet zones settings

      • iexplore.exe (PID: 2984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
11
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe elitechlog%20windows[1].exe elitechlog%20windows[1].tmp no specs elitechlog%20windows[1].exe elitechlog%20windows[1].tmp setup.exe drvinst.exe cp210xvcpinstaller_x86.exe drvinst.exe no specs dl.exe

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\ElitechLogWin V3.3.2\DL.exe" C:\ElitechLogWin V3.3.2\DL.exe
explorer.exe
User:
admin
Company:
ElitechLog
Integrity Level:
MEDIUM
Description:
ElitechLog
Exit code:
0
Version:
3.0.0.0
Modules
Images
c:\elitechlogwin v3.3.2\dl.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2480"C:\Users\admin\AppData\Local\Temp\is-KBG31.tmp\ElitechLog%20Windows[1].tmp" /SL5="$40162,62524832,57856,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\ElitechLog%20Windows[1].exe" /SPAWNWND=$30166 /NOTIFYWND=$4018C C:\Users\admin\AppData\Local\Temp\is-KBG31.tmp\ElitechLog%20Windows[1].tmp
ElitechLog%20Windows[1].exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-kbg31.tmp\elitechlog%20windows[1].tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2776"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\ElitechLog%20Windows[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\ElitechLog%20Windows[1].exe
iexplore.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
ElitechLogWin V3.3.2 Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\r9zewh8d\elitechlog%20windows[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2984"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3032DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{1fe3a3c5-568d-297d-d4e9-2f15ecb3160a}\CH341SER.INF" "0" "667153af3" "00000544" "WinSta0\Default" "0000055C" "208" "C:\ElitechLogWin V3.3.2\Drivers\CH341"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3280"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2984 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3412"C:\ElitechLogWin V3.3.2\Drivers\CP210x\CP210xVCPInstaller_x86.exe" /SC:\ElitechLogWin V3.3.2\Drivers\CP210x\CP210xVCPInstaller_x86.exe
ElitechLog%20Windows[1].tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
256
Version:
2.1
Modules
Images
c:\elitechlogwin v3.3.2\drivers\cp210x\cp210xvcpinstaller_x86.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3508DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{0231715e-50b5-1cd5-f1ea-0d5d3d325457}\slabvcp.inf" "0" "6989498b3" "00000298" "WinSta0\Default" "00000544" "208" "c:\elitechlogwin v3.3.2\drivers\cp210x"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3812"C:\ElitechLogWin V3.3.2\Drivers\CH341\SETUP.exe" /SC:\ElitechLogWin V3.3.2\Drivers\CH341\SETUP.exe
ElitechLog%20Windows[1].tmp
User:
admin
Integrity Level:
HIGH
Description:
EXE For Driver Installation
Exit code:
0
Version:
1, 6, 8, 0
Modules
Images
c:\elitechlogwin v3.3.2\drivers\ch341\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
3828"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\ElitechLog%20Windows[1].exe" /SPAWNWND=$30166 /NOTIFYWND=$4018C C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\ElitechLog%20Windows[1].exe
ElitechLog%20Windows[1].tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
ElitechLogWin V3.3.2 Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\r9zewh8d\elitechlog%20windows[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
1 314
Read events
1 172
Write events
130
Delete events
12

Modification events

(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{A9879339-1D2F-11E9-AA93-5254004A04AF}
Value:
0
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307010001001500030032001100FA00
Executable files
45
Suspicious files
22
Text files
174
Unknown types
18

Dropped files

PID
Process
Filename
Type
2984iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2984iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE3521B6DC0494CA2.TMP —
MD5:—
SHA256:—
3280iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\ElitechLog%20Windows[1].exe —
MD5:—
SHA256:—
2984iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\ElitechLog%20Windows[1].exe —
MD5:—
SHA256:—
2984iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC57F66859F2C3AAD.TMP —
MD5:—
SHA256:—
2984iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{A9879339-1D2F-11E9-AA93-5254004A04AF}.dat —
MD5:—
SHA256:—
2480ElitechLog%20Windows[1].tmpC:\ElitechLogWin V3.3.2\is-9JDAP.tmp —
MD5:—
SHA256:—
2480ElitechLog%20Windows[1].tmpC:\ElitechLogWin V3.3.2\is-SHLFT.tmp —
MD5:—
SHA256:—
2480ElitechLog%20Windows[1].tmpC:\ElitechLogWin V3.3.2\is-R5DPL.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3280
iexplore.exe
GET
—
198.1.125.60:80
http://dl.elitechus.com/ElitechLog%20Windows.exe
US
—
—
suspicious
2984
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3280
iexplore.exe
198.1.125.60:80
dl.elitechus.com
Unified Layer
US
suspicious
2984
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
dl.elitechus.com
  • 198.1.125.60
suspicious

Threats

PID
Process
Class
Message
3280
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
DL.exe
Native library pre-loader is trying to load native SQLite library "C:\ElitechLogWin V3.3.2\x86\SQLite.Interop.dll"...
DL.exe
NGettext: Creating a built-in plural rule for langcode "en" for locale "en".
DL.exe
NGettext: Trying to parse a MO file stream...
DL.exe
NGettext: MO File contains 534 strings.
DL.exe
NGettext: MO File contains 534 strings.
DL.exe
NGettext: Trying to parse strings using encoding "System.Text.UTF8Encoding"...
DL.exe
NGettext: File encoding switched to "System.Text.UTF8Encoding" ("UTF-8" requested).
DL.exe
NGettext: String parsing completed.
DL.exe
NGettext: Creating a built-in plural rule for langcode "en" for locale "en".
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://dl.elitechus.com/ElitechLog%20Windows.exe