File name:

EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.bz2

Full analysis: https://app.any.run/tasks/e6f5788d-f048-4cc8-a9b4-73038c77c291
Verdict: Malicious activity
Analysis date: April 19, 2021, 01:14:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

1AC5BFE86459421D58166D964CE819E5

SHA1:

2AB1B668C1CE7FE314FE6CE6FBF4F533C96EF814

SHA256:

1C4799952AED4D30DD091A8FF59A2E6F4624A8B080D16199F25A3DEB7782A4B2

SSDEEP:

96:hNdEBIx7i1jInZCmYmfFBeI9m03FSq/hl/6LF5efqB9nbQ9hH:hMOwqhYmfn9mkFdCLGfiFQ7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • WScript.exe (PID: 1936)
      • WScript.exe (PID: 2408)

    • Writes to a start menu file

      • WScript.exe (PID: 1936)
      • WScript.exe (PID: 2408)

  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 1936)

    • Executes scripts

      • WinRAR.exe (PID: 1704)

  • INFO

    • Manual execution by user

      • WScript.exe (PID: 2408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENV?O DE MENSAJES DE DATOS.js
PackingMethod: Normal
ModifyDate: 2021:04:14 14:44:25
OperatingSystem: Win32
UncompressedSize: 102412
CompressedSize: 4125
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe wscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
1704"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.bz2"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1936"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb1704.26485\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.js" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2408"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
624
Read events
584
Write events
40
Delete events
0

Modification events

(PID) Process:(1704) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1704) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1704) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1704) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1704) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.bz2
(PID) Process:(1704) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1704) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1704) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1704) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1704) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\System32\wshext.dll,-4804
Value:
JScript Script File
Executable files
0
Suspicious files
0
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1704WinRAR.exeC:\Users\admin\Desktop\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.jstext
MD5:—
SHA256:—
1936WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.jstext
MD5:—
SHA256:—
1936WScript.exeC:\Users\admin\AppData\Local\Temp\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.jstext
MD5:—
SHA256:—
1704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb1704.26485\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.jstext
MD5:—
SHA256:—
2408WScript.exeC:\Users\admin\AppData\Local\Temp\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.jstext
MD5:—
SHA256:—
2408WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.jstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
4
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1936
WScript.exe
181.131.217.212:2022
enviorico.duckdns.org
EPM Telecomunicaciones S.A. E.S.P.
CO
unknown
2408
WScript.exe
181.131.217.212:2022
enviorico.duckdns.org
EPM Telecomunicaciones S.A. E.S.P.
CO
unknown

DNS requests

Domain
IP
Reputation
enviorico.duckdns.org
  • 181.131.217.212
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1056
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1056
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EL PRESENTE CORREO ES DE USO EXCLUSIVO PARA NOTIFICACIONES JUDICIALES Y ENVÍO DE MENSAJES DE DATOS.bz2