analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.excelleratejhi.com/

Full analysis: https://app.any.run/tasks/aa91ece7-608f-4d9b-b067-ce8991a02a43
Verdict: Malicious activity
Analysis date: June 27, 2022, 09:35:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
covid19
Indicators:
MD5:

237D4F4B186583FDC538DCF77BE1723F

SHA1:

0A9E65EA6274789B78E418A4186B7A21FD50017A

SHA256:

AA9D9A37A26D2A542F244138A2B33AECD26D071D6F456B5D3A089D45F58A6688

SSDEEP:

3:N8DSLSA2:2OLz2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2528)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2628)
      • iexplore.exe (PID: 2528)

    • Checks supported languages

      • iexplore.exe (PID: 2628)
      • iexplore.exe (PID: 2528)

    • Changes internet zones settings

      • iexplore.exe (PID: 2628)

    • Application launched itself

      • iexplore.exe (PID: 2628)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2528)
      • iexplore.exe (PID: 2628)

    • Drops Coronavirus (possible) decoy

      • iexplore.exe (PID: 2528)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2528)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2628)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2628)
      • iexplore.exe (PID: 2528)

    • Creates files in the user directory

      • iexplore.exe (PID: 2528)
      • iexplore.exe (PID: 2628)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2628"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.excelleratejhi.com/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2528"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2628 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
15 198
Read events
14 977
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
19
Text files
119
Unknown types
30

Dropped files

PID
Process
Filename
Type
2528iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\31E419D0671DA9BC22F946F0C612E819der
MD5:FA378756A9902F777E111B7645B0BCD0
SHA256:5FDF41AEBB72CB79903F34DB29FFE5389082E38286598D7D52FE17390325E61A
2528iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:308336E7F515478969B24C13DED11EDE
SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
2528iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9A43.tmpcompressed
MD5:308336E7F515478969B24C13DED11EDE
SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
2528iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\31E419D0671DA9BC22F946F0C612E819binary
MD5:4D429AF9A55EA07034221E54CAD00776
SHA256:912A1A8BCB15E5957A0CB2CA1F7D00857DF77353BE6F9EDEF5002E9AD644E634
2528iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\ion.rangeSlider.skinFlat[1].csstext
MD5:BA5EC4A15ED157248CC10930416A611A
SHA256:6D091D7EA60C4F1DCD0B1A648F5F802E6055AF08966AA8CDB6782EC5FA9BDBBA
2528iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:E2B30A12E8F4CB032B2ACF57C9480469
SHA256:D2BF67821D6CB26CDD78F4554739B3769164BA1CC34BD129EA2B0C02AFE7EBF3
2528iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\style[1].jstext
MD5:50388A76824E90947C4DF12E25162881
SHA256:A3A533CDD6C3C65DCF3E64D1CDDF83BF67BACE6EE10DFEC10E7E2163E4418FE0
2528iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\OBXAXSDD.htmhtml
MD5:0BD5FFE9CFFC84BB7763D721ADFAA3BD
SHA256:77E6849E1C09481C2943B78BC10BB994E1491F396C56AFE8C6136D71B710F1DF
2528iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\loader[1].csstext
MD5:88F73CBC171283F14AA1E6C02A17B3BE
SHA256:F6D892BFD094AF0DEE0350BE58CE93B5A8F1752BD08584D91925813179E70614
2528iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\default[1].csstext
MD5:3571C17A320DFA537F3409CC2A5A0487
SHA256:9A7E4A2AFDEC3C601F088DB83603C3721C7C542A8CC6715E609FC96A94A89FB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
95
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2528
iexplore.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e23a1cf438697d91
DE
compressed
60.0 Kb
whitelisted
2528
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2528
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCqm%2FLZVwk%2FcRLv5CtSZANu
US
der
472 b
whitelisted
2528
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAT%2FrubUb6nOEpcsoEFY3SI%3D
US
der
471 b
whitelisted
2628
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2528
iexplore.exe
GET
200
184.24.77.79:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTEi0yusPvv2ea4PVjymPzOgA%3D%3D
US
der
503 b
shared
2528
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2528
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2628
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2528
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEESz3%2FmlG2yGCtBzjzp1dVc%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2628
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2528
iexplore.exe
184.24.77.79:80
r3.o.lencr.org
Time Warner Cable Internet LLC
US
suspicious
2528
iexplore.exe
178.62.47.28:443
www.excelleratejhi.com
Digital Ocean, Inc.
GB
unknown
2528
iexplore.exe
142.250.185.104:443
www.googletagmanager.com
Google Inc.
US
suspicious
2528
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
Akamai Technologies, Inc.
US
suspicious
2528
iexplore.exe
178.79.242.0:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
DE
whitelisted
2528
iexplore.exe
104.22.25.131:443
embed.tawk.to
Cloudflare Inc
US
unknown
2628
iexplore.exe
178.62.47.28:443
www.excelleratejhi.com
Digital Ocean, Inc.
GB
unknown
2528
iexplore.exe
142.250.185.67:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2528
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
www.excelleratejhi.com
  • 178.62.47.28
unknown
ctldl.windowsupdate.com
  • 178.79.242.0
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
  • 13.107.22.200
  • 131.253.33.200
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
r3.o.lencr.org
  • 184.24.77.79
  • 184.24.77.67
  • 184.24.77.56
  • 184.24.77.54
shared
www.googletagmanager.com
  • 142.250.185.104
whitelisted
fonts.googleapis.com
  • 142.250.185.106
whitelisted
ocsp.pki.goog
  • 142.250.185.67
whitelisted
fonts.gstatic.com
  • 142.250.185.227
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.excelleratejhi.com/