File name:

COPIADELACITACIONELECTRONICAJUZGADOPENALDERAMAJUDICIAL.zip

Full analysis: https://app.any.run/tasks/24280496-073e-481b-b40a-d67ee103ea9f
Verdict: Malicious activity
Analysis date: February 20, 2025, 20:23:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
generic
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E4B63789F7736BC66ABB76F58BE73F4E

SHA1:

6D44CC56312D1F15AE974AEE46A6C3A1717E60B8

SHA256:

67120EC750187029EFAE93EE5AEEE158EEC62C409A178F3A124E07E303FCB380

SSDEEP:

49152:NopEG8017JZfjRbwDgUEVcoAau83RWIXQBVsEGqJyTI9RCA8o56Zmmmvz78jUDrZ:NoP7JZ9bwDgUEVdAaD3bXQBEIHCRo5BR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1200)

    • GENERIC has been found (auto)

      • WinRAR.exe (PID: 1200)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1200)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 1200)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1200)

  • INFO

    • Manual execution by a user

      • COPIA DE LA CITACION ELECTRONICA JUZGADO PENAL DE RAMA JUDICIAL.exe (PID: 3988)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 1200)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 6136)

    • Reads the computer name

      • MpCmdRun.exe (PID: 6136)
      • MpCmdRun.exe (PID: 5256)

    • Checks supported languages

      • MpCmdRun.exe (PID: 6136)
      • MpCmdRun.exe (PID: 5256)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:03:18 20:50:28
ZipCRC: 0x6ce1a1de
ZipCompressedSize: 78073
ZipUncompressedSize: 197064
ZipFileName: COPIA DE LA CITACION ELECTRONICA JUZGADO PENAL DE RAMA JUDICIAL.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GENERIC winrar.exe copia de la citacion electronica juzgado penal de rama judicial.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1200"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\COPIADELACITACIONELECTRONICAJUZGADOPENALDERAMAJUDICIAL.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1904C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR1200.39179\Rar$Scan39244.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3988"C:\Users\admin\Desktop\COPIA DE LA CITACION ELECTRONICA JUZGADO PENAL DE RAMA JUDICIAL.exe" C:\Users\admin\Desktop\COPIA DE LA CITACION ELECTRONICA JUZGADO PENAL DE RAMA JUDICIAL.exe—explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Topology Editor
Exit code:
3221225781
Version:
1.0.0.1
Modules
Images
c:\users\admin\desktop\copia de la citacion electronica juzgado penal de rama judicial.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5256"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR1200.39179"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
5488C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR1200.36300\Rar$Scan9717.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
5920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6136"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR1200.36300"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
Total events
1 778
Read events
1 768
Write events
10
Delete events
0

Modification events

(PID) Process:(1200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\COPIADELACITACIONELECTRONICAJUZGADOPENALDERAMAJUDICIAL.zip
(PID) Process:(1200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
4
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1200WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1200.36300\COPIADELACITACIONELECTRONICAJUZGADOPENALDERAMAJUDICIAL.zip\COPIA DE LA CITACION ELECTRONICA JUZGADO PENAL DE RAMA JUDICIAL.exeexecutable
MD5:93C7B66D77406F6B64507631A24BC140
SHA256:95687DA203507A11837EAEB29BFE86481828B74B62FC869604B5EAA552F950C2
1200WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1200.39179\COPIADELACITACIONELECTRONICAJUZGADOPENALDERAMAJUDICIAL.zip\COPIA DE LA CITACION ELECTRONICA JUZGADO PENAL DE RAMA JUDICIAL.exeexecutable
MD5:93C7B66D77406F6B64507631A24BC140
SHA256:95687DA203507A11837EAEB29BFE86481828B74B62FC869604B5EAA552F950C2
1200WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1200.36300\COPIADELACITACIONELECTRONICAJUZGADOPENALDERAMAJUDICIAL.zip\tedutil.dllexecutable
MD5:9A1A741C0ACE430F0D07A3C9DE2109ED
SHA256:4564BDB245C4E6248D78AAEA7B588AD3FAA79514E7662B80525578DC615E07B5
1200WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1200.36300\Rar$Scan9717.battext
MD5:CA0F162D290AC5EECBFF1A067DB0BB9F
SHA256:67312B58FE6B9B25F2511784586EE86F70495B682CFF744C564BDDA73BB0AD6D
1200WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1200.39179\COPIADELACITACIONELECTRONICAJUZGADOPENALDERAMAJUDICIAL.zip\tedutil.dllexecutable
MD5:9A1A741C0ACE430F0D07A3C9DE2109ED
SHA256:4564BDB245C4E6248D78AAEA7B588AD3FAA79514E7662B80525578DC615E07B5
6136MpCmdRun.exeC:\Users\admin\AppData\Local\Temp\MpCmdRun.logbinary
MD5:A1CD52D71216EFE37A87FABF54F7665E
SHA256:1A4353E0BD0EFE0D16E0459A915E06B58BCA26C5EF93033A36787258421E600B
1200WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1200.39179\Rar$Scan39244.battext
MD5:9F1807246A590FD3D889396DAC30AF2B
SHA256:8B2CA6E5518191B74B5B00675C47C49F9F6E4C975D25AD834C790E70955B20AB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
19
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4444
svchost.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4444
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4444
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4444
svchost.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
4444
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
self.events.data.microsoft.com
  • 104.208.16.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
COPIADELACITACIONELECTRONICAJUZGADOPENALDERAMAJUDICIAL.zip