Malware analysis /dl/download/00015d58-b682-4e0c-afb2-055cd15cece4/Naturgy.Factura02082024252244829225494DN22040419PDF.zip Malicious activity

Add for printing

download:	/dl/download/00015d58-b682-4e0c-afb2-055cd15cece4/Naturgy.Factura02082024252244829225494DN22040419PDF.zip
Full analysis:	https://app.any.run/tasks/0d31f3d6-1e30-4e76-9ef3-fb9ad9581f47
Verdict:	Malicious activity
Analysis date:	August 06, 2024, 07:15:19
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	qrcode
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:	C26CD14F500386764CDDF3252EA15132
SHA1:	87D3BD7F1CBD5D8426410DAC6E88E75E7D90AAE5
SHA256:	68FB11E840EF29A833A361270633A806C7068DB72A094C9A2564938B96684314
SSDEEP:	98304:m2AQcCqsuNTbePQwE/P5hQMjcSYHXLlAYCf0hAhJwoJCNGlQi7hc1//DRtu2tVlR:XdsGtF/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - WinRAR.exe (PID: 6564)
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
- Scans artifacts that could help determine the target
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
- Changes the autorun value in the registry
  - zanhh.exe (PID: 6436)
SUSPICIOUS
- Reads security settings of Internet Explorer
  - WinRAR.exe (PID: 6564)
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
- Executable content was dropped or overwritten
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
- Checks Windows Trust Settings
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
- Reads the date of Windows installation
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
- Reads Microsoft Outlook installation path
  - mmc.exe (PID: 6232)
- Reads Internet Explorer settings
  - mmc.exe (PID: 6232)
INFO
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 6564)
- Creates files or folders in the user directory
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
  - mmc.exe (PID: 6232)
- Checks supported languages
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6220)
  - zanhh.exe (PID: 6436)
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 2580)
  - TextInputHost.exe (PID: 6240)
- Process checks computer location settings
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
- Checks proxy server information
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
  - mmc.exe (PID: 6232)
- Manual execution by a user
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6220)
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 2580)
  - mmc.exe (PID: 6184)
  - mmc.exe (PID: 6232)
- Reads the computer name
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6220)
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
  - zanhh.exe (PID: 6436)
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 2580)
  - TextInputHost.exe (PID: 6240)
- Reads the machine GUID from the registry
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
- Reads Environment values
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6220)
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
  - zanhh.exe (PID: 6436)
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 2580)
- Reads the software policy settings
  - Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe (PID: 6148)
- Reads security settings of Internet Explorer
  - mmc.exe (PID: 6232)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	Deflated
ZipModifyDate:	2024:08:02 09:37:42
ZipCRC:	0x4b153139
ZipCompressedSize:	4029741
ZipUncompressedSize:	11198976
ZipFileName:	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

142

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2256

C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

services.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

2580

"C:\Users\admin\Desktop\Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe"

C:\Users\admin\Desktop\Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

HUNHHGSD87484985

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\desktop\naturgy.factura020820242522448292254o20049494dn22040419pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll

6148

"C:\Users\admin\AppData\Local\Temp\Rar$EXa6564.37960\Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe"

C:\Users\admin\AppData\Local\Temp\Rar$EXa6564.37960\Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe

WinRAR.exe

User:

admin

Integrity Level:

MEDIUM

Description:

HUNHHGSD87484985

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\temp\rar$exa6564.37960\naturgy.factura020820242522448292254o20049494dn22040419pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll

6184

"C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\services.msc"

C:\Windows\System32\mmc.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Management Console

Exit code:

3221226540

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\mmc.exe
c:\windows\system32\ntdll.dll

6220

"C:\Users\admin\Desktop\Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe"

C:\Users\admin\Desktop\Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

HUNHHGSD87484985

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\desktop\naturgy.factura020820242522448292254o20049494dn22040419pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

6232

"C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\services.msc"

C:\Windows\System32\mmc.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Microsoft Management Console

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\mmc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

6240

"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Version:

123.26505.0.0

Modules

Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll

6436

"C:\Nvholdnow\zanhh.exe"

C:\Nvholdnow\zanhh.exe

Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe

User:

admin

Company:

iTinySoft

Integrity Level:

MEDIUM

Description:

Media Burner

Version:

1.0.0.1

Modules

Images
c:\nvholdnow\zanhh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

6564

"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Naturgy.Factura02082024252244829225494DN22040419PDF.zip

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

Add for printing

Total events

24 382

Read events

24 342

Write events

Delete events

Modification events


(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\Naturgy.Factura02082024252244829225494DN22040419PDF.zip
(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(6564) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\24[1].zip		—
		MD5:—	SHA256:—
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	C:\Nvholdnow\20240806071611_333080.zip		—
		MD5:—	SHA256:—
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	C:\Nvholdnow\vcen.dll		—
		MD5:—	SHA256:—
6564	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa6564.37960\Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe		executable
		MD5:89E23114C4C8241F363F83B059F046AF	SHA256:A75BEAA2D722E5084A465216494B082EFB5C95D75D6F106D2627E368AFC38F18
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_39B30C223D9DBB1BF84FABB17C3B3563		binary
		MD5:F2EB9D978E2060AA9156B6C19D2C95D7	SHA256:EA8914D36503E5182D4AF3954CBDFE63FE7BCDDEA2681B8D7BBAB8A0F800F176
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB		binary
		MD5:70DE7DF34CD73752DD88D8B757351262	SHA256:BED967A149644D1AD6EAAEA7B05378E7893B9748B28791C93A8EC0B1D42A6628
6564	WinRAR.exe	C:\Users\admin\Desktop\Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe		executable
		MD5:89E23114C4C8241F363F83B059F046AF	SHA256:A75BEAA2D722E5084A465216494B082EFB5C95D75D6F106D2627E368AFC38F18
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	C:\Nvholdnow\StarBurn.dll		executable
		MD5:E76A62A26A171A1E11802DF34C6C571E	SHA256:57FF90C7FB09A8CEBE4ACE209BB1A8585D46BB3EA59EE91644323840C1B11A50
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	C:\Nvholdnow\trp.gif		binary
		MD5:321B04A8E4EBFC40674F451F426A4DA3	SHA256:0628B2F4ECDB9B0C9425C2F2BC22E15BAC3B12645A9E63C4F95E90E2D6E9C2F3
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	C:\Nvholdnow\dvdau.dll		executable
		MD5:EC13C0CA17FF65CF05C04B86A640072A	SHA256:9F649C766B673DDEE2EDEADF171EF7AFC87DFBAE2AE1B2835B5AF81EE389C707

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
5924	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5924	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6920	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6872	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D	unknown	—	—	whitelisted
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA5LESwT1wyG%2B8R6iu4iTyM%3D	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
4788	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3044	RUXIMICS.exe	40.127.240.158:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
2120	MoUsoCoreWorker.exe	40.127.240.158:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
4	System	192.168.100.255:138	—	—	—	whitelisted
5336	SearchApp.exe	95.100.146.27:443	www.bing.com	Akamai International B.V.	CZ	unknown
5336	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
5924	svchost.exe	40.126.32.138:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3260	svchost.exe	40.113.103.199:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5924	svchost.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146	whitelisted
www.bing.com	95.100.146.27 95.100.146.19 95.100.146.25 95.100.146.16 95.100.146.11 95.100.146.32 95.100.146.33 95.100.146.17 95.100.146.26 95.100.146.35 95.100.146.34 95.100.146.40 95.100.146.10	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	40.126.32.138 20.190.160.20 40.126.32.72 40.126.32.134 20.190.160.14 40.126.32.74 40.126.32.68 40.126.32.76	whitelisted
client.wns.windows.com	40.113.103.199 20.198.162.78	whitelisted
th.bing.com	95.100.146.26 95.100.146.27 95.100.146.19 95.100.146.25 95.100.146.16 95.100.146.11 95.100.146.32 95.100.146.33 95.100.146.17 95.100.146.10 95.100.146.35 95.100.146.34 95.100.146.40	whitelisted
fd.api.iris.microsoft.com	20.223.35.26 20.199.58.43	whitelisted
arc.msn.com	20.223.35.26	whitelisted
slscr.update.microsoft.com	20.114.59.183	whitelisted
fe3cr.delivery.mp.microsoft.com	52.165.164.15	whitelisted

Threats

PID	Process	Class	Message
2256	svchost.exe	Potentially Bad Traffic	ET INFO Public Cloud Domain in DNS Lookup (cld .pt)
6148	Naturgy.Factura020820242522448292254O20049494DN22040419PDF.exe	Potentially Bad Traffic	ET INFO Observed Public Cloud Domain (cld .pt in TLS SNI)

Add for printing

Process	Message
zanhh.exe	StarBurn:StarBurn_UpStart(): Call is obsolete
zanhh.exe	StarBurn CD/DVD Burning, Grabbing and Mastering Toolkit for Windows 95/98/Me/NT/2000/XP/2003 Version 6.2.24 ( 0x20060410 ) Copyright (c) Rocket Division Software 2001-2006. All rights reserved.
zanhh.exe	This PERSONAL copy of StarBurn should be used in personal or shareware projects only.
zanhh.exe	License number: 64375825, licensed to 'wu_zhi_qiang' on Tue Jun 13 19:43:02 2006
zanhh.exe	Please report all licensing violations to info@rocketdivision.com software piracy fighting team.
zanhh.exe	StarWave Media Streaming Toolkit for Windows 95/98/Me/NT/2000/XP/2003 Version 6.2.24 ( 0x20060224 ) Copyright (c) Rocket Division Software 2001-2006. All rights reserved.

General Info

/dl/download/00015d58-b682-4e0c-afb2-055cd15cece4/Naturgy.Factura02082024252244829225494DN22040419PDF.zip

C26CD14F500386764CDDF3252EA15132

87D3BD7F1CBD5D8426410DAC6E88E75E7D90AAE5

68FB11E840EF29A833A361270633A806C7068DB72A094C9A2564938B96684314

98304:m2AQcCqsuNTbePQwE/P5hQMjcSYHXLlAYCf0hAhJwoJCNGlQi7hc1//DRtu2tVlR:XdsGtF/

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Scans artifacts that could help determine the target

Changes the autorun value in the registry

SUSPICIOUS

Reads security settings of Internet Explorer

Executable content was dropped or overwritten

Checks Windows Trust Settings

Reads the date of Windows installation

Reads Microsoft Outlook installation path

Reads Internet Explorer settings

INFO

Executable content was dropped or overwritten

Creates files or folders in the user directory

Checks supported languages

Process checks computer location settings

Checks proxy server information

Manual execution by a user

Reads the computer name

Reads the machine GUID from the registry

Reads Environment values

Reads the software policy settings

Reads security settings of Internet Explorer

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings