Automated Malware Analysis Executive Report for http://covid10-guidelines.com/

General Information

Date:22.05.2020
Duration:0h 0m 53s
Sample URL:http://covid10-guidelines.com/
Cookbook:browseurl.jbs
Icon:No Icon
Filetype:unknown

Detection

UNKNOWN

- Found 0 malicious signatures
- Contacts 1 domain/IP
- Launches 2 process
- Drops 11 file

Signature Overview

Loading... Additional Content is being loaded

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Classification

Network Map

No contacted IP infos

Contacted Domains

Name	IP	Active
covid10-guidelines.com	unknown	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{23E82AF9-9C0A-11EA-AADD-C25F135D3C65}.dat	Microsoft Word Document	E3609EE5A856CEA4824B96AFD9D4D996	B0D5D00D8B6B9D85EF06CA97CC28F91213D9C409	F33B745A19C71F22CCE16B48820CA730F97980BE5CBF1A7E353048F8136EB43E
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{23E82AFB-9C0A-11EA-AADD-C25F135D3C65}.dat	Microsoft Word Document	F488306D35827ACF619537AC6B612D00	A6DEC886C8B105AA6AF2ECCB710E277B76BD701D	8BFBEFF58DFF400E9C5848A0F946E5F3731F8BC049E8E1969596EDEDE5FB0243
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{23E82AFC-9C0A-11EA-AADD-C25F135D3C65}.dat	Microsoft Word Document	40D81AA4560FB004410614B1C4EBE115	7081325874791C530F90CBD5AA958D31F1AAE47B	09B9BBE65F6722D6A92A7A72DFECAF3AE7511CBE7CCDCF1EEA1328F4B15BDD5E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\V5D02472\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VINVDFP6\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VTIIBVU5\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Temp\~DF4F4F31FD825372CC.TMP	data	7AEA101CC3DC21A179A7B438D04CFDFD	B3A61D0419422C2FB28FC920E59B2EFE8D3F8B50	35E76D92F13EE2321006959E0CE8E8615E51DF587727095D8F8999BFED79A6D6
C:\Users\user\AppData\Local\Temp\~DF848053A42366D5F7.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
C:\Users\user\AppData\Local\Temp\~DFAEDD09110BAF43F8.TMP	data	ECF3715788012AF105875FCB7E0ABECF	BAB82753E7533E8FD88E459F63CC4287F464369C	814FB82FCFC92D7654EB92F969D09551C516DD7F99FEBE5C9C7360E4D302F553

Networking:

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Source: unknown	DNS traffic detected: query: covid10-guidelines.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: covid10-guidelines.com replaycode: Name error (3)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: covid10-guidelines.com

Urls found in memory or binary data

Source: ~DFAEDD09110BAF43F8.TMP.1.dr	String found in binary or memory: http://covid10-guidelines.com/
Source: {23E82AFB-9C0A-11EA-AADD-C25F135D3C65}.dat.1.dr	String found in binary or memory: http://covid10-guidelines.com/Root

System Summary:

Classification label

Source: classification engine

Classification label: unknown0.win@3/11@3/0

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF4F4F31FD825372CC.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4360 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4360 CREDAT:17410 /prefetch:2	Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_171\bin\msvcr100.dll

Jump to behavior

ID:	232303
Product:	CloudBasic
Start time:	01:56:11
Start date:	22.05.2020
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Architecture:	WINDOWS