Find similar analyses in TI Lookup
Analysis date (UTC): 19 May 2021, 12:45Analysis environment: Windows 7 Pro, build 7601, x86

https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ycovid19.org%2F&data=04%7C01%7Cgail.gordon%40wizards.com%7C0f4f3e4d31e443a56dde08d91a23b86e%7C701edd3ec7a84789b1ce8a243620d68f%7C0%7C0%7C637569563013806008%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0&sdata=Xv1UGoAkVMAGssJ%2BX4o9ElTZUk%2FuEK4HkXwSYVxgC%2BY%3D&reserved=0

MD5:8265EA9D9D7A7139B45D42B3CECA9723
SHA1:EF012EF75F6724416E6DF53452D408C12711E933
SHA256:6C65455532827428DF5BA4DE65222E563F382A1F135D96E764A95312FFEFC826

Analysis result

Threat level:Malicious activity
Tags:
covid19
Full analysis:Analysis https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ycovid19.org%2F&data=04%7C01%7Cgail.gordon%40wizards.com%7C0f4f3e4d31e443a56dde08d91a23b86e%7C701edd3ec7a84789b1ce8a243620d68f%7C0%7C0%7C637569563013806008%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0&sdata=Xv1UGoAkVMAGssJ%2BX4o9ElTZUk%2FuEK4HkXwSYVxgC%2BY%3D&reserved=0 Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Modifies files in Chrome extension folder

  • chrome.exe (PID: 2064)

INFO

Reads settings of System Certificates

  • iexplore.exe (PID: 3956)
  • iexplore.exe (PID: 372)

Manual execution by user

  • chrome.exe (PID: 2064)

Application launched itself

  • iexplore.exe (PID: 372)
  • chrome.exe (PID: 2064)

Changes internet zones settings

  • iexplore.exe (PID: 372)

Reads the hosts file

  • chrome.exe (PID: 2064)
  • chrome.exe (PID: 2500)

Reads internet explorer settings

  • iexplore.exe (PID: 3956)

Drops Coronavirus (possible) decoy

  • iexplore.exe (PID: 3956)

Adds / modifies Windows certificates

  • iexplore.exe (PID: 372)

Changes settings of System certificates

  • iexplore.exe (PID: 372)

Threats

PIDProcessClassMessage
1040svchost.exePotentially Bad TrafficET INFO Suspicious Domain Request for Possible COVID-19 Domain M1
3956iexplore.exePotentially Bad TrafficET INFO Suspicious GET Request with Possible COVID-19 Domain M1
3956iexplore.exePotentially Bad TrafficET INFO Suspicious TLS SNI Request for Possible COVID-19 Domain M1
3956iexplore.exePotentially Bad TrafficET INFO Possible COVID-19 Domain in SSL Certificate M2
1040svchost.exePotentially Bad TrafficET INFO Suspicious Domain Request for Possible COVID-19 Domain M1
372iexplore.exePotentially Bad TrafficET INFO Suspicious TLS SNI Request for Possible COVID-19 Domain M1
372iexplore.exePotentially Bad TrafficET INFO Suspicious TLS SNI Request for Possible COVID-19 Domain M1
372iexplore.exePotentially Bad TrafficET INFO Possible COVID-19 Domain in SSL Certificate M2
372iexplore.exePotentially Bad TrafficET INFO Possible COVID-19 Domain in SSL Certificate M2
1040svchost.exePotentially Bad TrafficET INFO Suspicious Domain Request for Possible COVID-19 Domain M1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED