File name:

00245- CITACIÓN PRESENCIAL AL JUZGADO..msg

Full analysis: https://app.any.run/tasks/1a6c81d0-dbef-4a2e-b565-d1b7959ed299
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: December 13, 2024, 19:45:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
attachments
attc-unc
rat
remcos
evasion
stealer
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

BC8C4447795CDB9AF8C983B5DEEF4E40

SHA1:

7E4C689FF261D752561D850866540BC944BDBAFF

SHA256:

42238633A6D9E524AB37E435E8C52A953B0B53E3F9763FD0CD9FA71643EAF341

SSDEEP:

1536:1fBPrqWLRFWAWRYiwWdATmd4WBartTWNtvML3kf/6aFp/ML3kf/6aFpV:1fZryPPASd4a25aU5a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 7316)
      • dllhost.exe (PID: 7036)
      • dllhost.exe (PID: 7456)

    • Actions looks like stealing of personal data

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4740)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 8168)
      • cmd.exe (PID: 1612)

    • REMCOS mutex has been found

      • svchost.exe (PID: 8140)

    • REMCOS has been detected

      • svchost.exe (PID: 8140)

    • REMCOS has been detected (SURICATA)

      • svchost.exe (PID: 8140)

    • Connects to the CnC server

      • svchost.exe (PID: 8140)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 7552)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 7976)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4740)

    • The process verifies whether the antivirus software is installed

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4740)

    • Drops a system driver (possible attempt to evade defenses)

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4740)

    • Starts CMD.EXE for commands execution

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4740)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 5076)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 8140)

    • Checks for external IP

      • svchost.exe (PID: 8140)

    • Connects to unusual port

      • svchost.exe (PID: 8140)

    • Executes application which crashes

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4740)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 5076)

    • Reads security settings of Internet Explorer

      • svchost.exe (PID: 8140)

    • The process executes VB scripts

      • svchost.exe (PID: 8140)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 7552)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 7552)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 7552)

  • INFO

    • Reads Environment values

      • identity_helper.exe (PID: 7280)

    • The process uses the downloaded file

      • msedge.exe (PID: 7488)
      • OUTLOOK.EXE (PID: 6496)
      • WinRAR.exe (PID: 4980)
      • dllhost.exe (PID: 7316)
      • dllhost.exe (PID: 7036)
      • svchost.exe (PID: 8140)

    • Email with attachments

      • OUTLOOK.EXE (PID: 6496)

    • Checks supported languages

      • identity_helper.exe (PID: 7280)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 7976)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4740)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 8044)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4952)

    • Reads the computer name

      • identity_helper.exe (PID: 7280)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 7976)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4740)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 8044)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4952)

    • Application launched itself

      • msedge.exe (PID: 4264)

    • Reads the machine GUID from the registry

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 7976)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 8044)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4980)

    • Manual execution by a user

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 7976)
      • WinRAR.exe (PID: 4980)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 8044)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4952)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7316)
      • dllhost.exe (PID: 7036)

    • Checks transactions between databases Windows and Oracle

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 7976)
      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 8044)

    • The sample compiled with english language support

      • 1 DEMANDA LABORAL JURIDICA 321321.exe (PID: 4740)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7764)

    • Create files in a temporary directory

      • svchost.exe (PID: 8140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
56
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start outlook.exe ai.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs winrar.exe msedge.exe no specs 1 demanda laboral juridica 321321.exe msedge.exe no specs CMSTPLUA 1 demanda laboral juridica 321321.exe 1 demanda laboral juridica 321321.exe no specs CMSTPLUA 1 demanda laboral juridica 321321.exe cmd.exe conhost.exe no specs schtasks.exe no specs #REMCOS svchost.exe svchost.exe msedge.exe no specs 1 demanda laboral juridica 321321.exe no specs msedge.exe no specs cmd.exe conhost.exe no specs schtasks.exe no specs werfault.exe CMSTPLUA 1 demanda laboral juridica 321321.exe no specs wscript.exe no specs werfault.exe msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6496"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\00245- CITACIÓN PRESENCIAL AL JUZGADO..msg"C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\sechost.dll
3224"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "35E731D3-352E-4220-AD62-6A50959F6BB2" "17B87359-2593-44CE-A451-A69C1A232DBF" "6496"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcrt.dll
4264"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\TJIH93ZL\FISCALIA-GENERAL-CITACIÓN-PRESENCIAL-AL-JUZGADO-DELITO-ABUSO-DE-CONFIANZA-ART (1)_nh430prm.svgC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4996"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x300,0x304,0x308,0x2f8,0x310,0x7ff821c15fd8,0x7ff821c15fe4,0x7ff821c15ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3848"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2220 --field-trial-handle=2156,i,11116530524964629024,13592891096636963236,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6176"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2128 --field-trial-handle=2156,i,11116530524964629024,13592891096636963236,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6196"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2788 --field-trial-handle=2156,i,11116530524964629024,13592891096636963236,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3496 --field-trial-handle=2156,i,11116530524964629024,13592891096636963236,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3676 --field-trial-handle=2156,i,11116530524964629024,13592891096636963236,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4716"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4052 --field-trial-handle=2156,i,11116530524964629024,13592891096636963236,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 198
Read events
25 964
Write events
1 085
Delete events
149

Modification events

(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:6
Value:
01941A000000001000B24E9A3E06000000000000000600000000000000
(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\6496
Operation:writeName:0
Value:
0B0E1016D1B24460945D428651D9666DE079C423004689F2EDA3F9B2D3ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511E032D2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootCommand
Value:
(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootFailureCount
Value:
(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:delete keyName:(default)
Value:
(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:CantBootResolution
Value:
BootSuccess
(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:ProfileBeingOpened
Value:
Outlook
(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:SessionId
Value:
C3D8E96E-C1AF-4750-8D52-F4E28119C131
(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:BootDiagnosticsLogFile
Value:
C:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16026_20146-20240718T1116060318-1644.etl
(PID) Process:(6496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:ProfileBeingOpened
Value:
Executable files
10
Suspicious files
97
Text files
47
Unknown types
1

Dropped files

PID
Process
Filename
Type
6496OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
6496OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TableViewPreviewPrefs_2_9A335D0F23714847A572CC75B30F6500.datxml
MD5:0E092DB99AEE99FDFF9B5B222C732CFD
SHA256:D1614AD99ADED9F6F5C1BE7FE7FFA5124BD04A526580DA3818EA8A954E852AA6
4264msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variationsbinary
MD5:1C42329800C95BC1DB27E7657711FF1E
SHA256:D58993216FB0CBF52CED6DA4FCAEBFC8FCC7C1A37191954397BA77951B16BE9B
6496OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\TJIH93ZL\FISCALIA-GENERAL-CITACIÓN-PRESENCIAL-AL-JUZGADO-DELITO-ABUSO-DE-CONFIANZA-ART (1)_nh430prm.svgbinary
MD5:CB8F392A502AE704C53D207D398D5841
SHA256:A604CB9D0AA54691ECF3F9C751AA29629602858D04197BE0F6E1D1BE8CDFB7B8
6496OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D6B018A8-30D3-493C-B9BC-7CF8CE2199ECxml
MD5:3017BE7E08F0F62745C49D7549D5346B
SHA256:BCD7536D515942CA95C9990700A36B30DF82BB8DAA7160E0C76A8A1D70D898E7
6496OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:1F47FC31478F3AEA71850CD67FF5955C
SHA256:F5C15A52EDF9B6444C01EFAC2A3513EE34E2769843018E7EDCBD4144862053B7
4264msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local Statebinary
MD5:0E9CAF0E555F19AE36E4F775A6622FF3
SHA256:7388E1D64B932FD6B5FAB399163646324CF7F0851CA52BD59FBC1A3DDED6618C
4264msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old~RF13907b.TMPtext
MD5:C5C8E14929BCE261B2B5B899CB479AF7
SHA256:73DBFF8A366CFF6972A38C091782EF62C89E28FDA1423A47448A60343F921754
4264msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF13908b.TMP —
MD5:—
SHA256:—
4264msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
77
DNS requests
67
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.32.238.123:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7908
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1734558356&P2=404&P3=2&P4=Q12%2f0zMWTSqlzJ3wEFyZYcdR4aIjFQKgoWIA%2fiPyimYwmI8WbOWlE3SOrFz6N%2bL71PKRMVcM%2fwdHxGgnfcVyog%3d%3d
unknown
—
—
whitelisted
—
—
GET
200
23.215.121.133:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7908
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1734558356&P2=404&P3=2&P4=Q12%2f0zMWTSqlzJ3wEFyZYcdR4aIjFQKgoWIA%2fiPyimYwmI8WbOWlE3SOrFz6N%2bL71PKRMVcM%2fwdHxGgnfcVyog%3d%3d
unknown
—
—
whitelisted
7908
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1734558356&P2=404&P3=2&P4=Q12%2f0zMWTSqlzJ3wEFyZYcdR4aIjFQKgoWIA%2fiPyimYwmI8WbOWlE3SOrFz6N%2bL71PKRMVcM%2fwdHxGgnfcVyog%3d%3d
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.215.121.133:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8016
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6700
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8016
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
900
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.32.238.123:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.215.121.133:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.215.121.133:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.21.110.139:443
www.bing.com
AKAMAI-AS
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6496
OUTLOOK.EXE
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.32.238.123
  • 2.19.198.42
  • 23.32.238.112
  • 23.32.238.115
  • 23.32.238.153
  • 23.32.238.162
  • 23.32.238.155
  • 23.32.238.90
  • 23.32.238.107
  • 23.32.238.97
  • 23.32.238.88
  • 2.19.198.75
  • 2.19.198.57
  • 23.32.238.145
whitelisted
www.microsoft.com
  • 23.215.121.133
  • 88.221.169.152
  • 23.37.202.100
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 2.21.110.139
  • 2.21.110.146
  • 2.23.209.189
  • 2.23.209.193
  • 2.23.209.149
  • 2.23.209.185
  • 2.23.209.182
  • 2.23.209.148
  • 2.23.209.179
  • 2.23.209.133
  • 2.23.209.177
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.72
  • 40.126.32.74
  • 40.126.32.134
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.133
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.kozow .com Domain
—
—
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
—
—
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
00245- CITACIÓN PRESENCIAL AL JUZGADO..msg