File name:

nfactura_pendiente.tar

Full analysis: https://app.any.run/tasks/b22987ca-cdcb-4ba5-8ca9-ff5ea2a296c2
Verdict: Malicious activity
Analysis date: February 20, 2025, 16:30:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5BC6DFAAE47E1A148E6767CE20C118E5

SHA1:

80061BAEB43114EC3C242F9984D9814EF5637F10

SHA256:

A08EE7CB3C65FD01DC498000358F9F9EF844BCD3C9270A0A47DD65B6CA59B78A

SSDEEP:

49152:s4tmWSovHVszPiNdh3gqAtpC30zmuyU5GQTVzHrTcyql2s2HzpSzdKcHI9LmF5TU:s4wXovHWCw03y5Xzvtq3siHIlG5TjHir

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2972)

    • Executing a file with an untrusted certificate

      • factura pendiente.exe (PID: 3076)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 2972)

    • There is functionality for taking screenshot (YARA)

      • factura pendiente.exe (PID: 3076)

    • Executable content was dropped or overwritten

      • factura pendiente.exe (PID: 3076)
      • powershell.exe (PID: 4052)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Executes application which crashes

      • msiexec.exe (PID: 5432)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2972)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 2972)

    • Starts POWERSHELL.EXE for commands execution

      • factura pendiente.exe (PID: 3076)

  • INFO

    • Manual execution by a user

      • factura pendiente.exe (PID: 3076)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Checks supported languages

      • MpCmdRun.exe (PID: 5568)
      • factura pendiente.exe (PID: 3076)

    • Reads the computer name

      • MpCmdRun.exe (PID: 5568)
      • factura pendiente.exe (PID: 3076)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Creates files or folders in the user directory

      • factura pendiente.exe (PID: 3076)
      • WerFault.exe (PID: 6076)

    • Create files in a temporary directory

      • factura pendiente.exe (PID: 3076)
      • MpCmdRun.exe (PID: 5568)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 4052)

    • The sample compiled with english language support

      • powershell.exe (PID: 4052)
      • WinRAR.exe (PID: 2972)

    • Checks proxy server information

      • msiexec.exe (PID: 5432)
      • WerFault.exe (PID: 6076)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 5432)

    • Reads the software policy settings

      • msiexec.exe (PID: 5432)
      • WerFault.exe (PID: 6076)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 1407617
UncompressedSize: 1538312
OperatingSystem: Win32
ArchivedFileName: factura pendiente.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe factura pendiente.exe powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs msiexec.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
1804\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2972"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\nfactura_pendiente.tar.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3076"C:\Users\admin\Desktop\factura pendiente.exe" C:\Users\admin\Desktop\factura pendiente.exe
explorer.exe
User:
admin
Company:
evalueringsrkkeflgerne dissention revalueringerne
Integrity Level:
MEDIUM
Exit code:
4294967295
Version:
3.1.0.0
Modules
Images
c:\users\admin\desktop\factura pendiente.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3172C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR2972.34534\Rar$Scan8781.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4052"powershell.exe" -windowstyle minimized "$Janikas=gc -Raw 'C:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Reenjoying.Pos';$Attesters=$Janikas.SubString(56969,3);.$Attesters($Janikas)"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
factura pendiente.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5432"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
3762504530
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5568"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR2972.34534"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
6076C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5432 -s 2308C:\Windows\SysWOW64\WerFault.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
18 580
Read events
18 568
Write events
12
Delete events
0

Modification events

(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\nfactura_pendiente.tar.rar
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3076) factura pendiente.exeKey:HKEY_CURRENT_USER\Regisse\Uninstall\Concludent\dknernes
Operation:writeName:undvendigt
Value:
1
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
3
Suspicious files
8
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Chondrosin42.den —
MD5:—
SHA256:—
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\inhesion\stafferet.men —
MD5:—
SHA256:—
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Sttyskeren\Unkodaked144.jpgimage
MD5:441C487496250F2DFB7932573923DD86
SHA256:ACD14AA0BB682EE7662A198132A11098A80BC99D93A1A9D77C1D8D2CF3D7F5A8
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Sttyskeren\Populravis.txttext
MD5:0A3891B25E2CFE64897EC83CC688BFE0
SHA256:A657D235DCB9CC0EEF83EEBECD11DB719B484193DFF4A9DBA7EF8D0AD095EAC7
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Sttyskeren\Teasing.txttext
MD5:75E982C9C6367B0C988F7377D285D11E
SHA256:BC4A5FE23BAFA2F605EAB10AE96DCA68D908E5F73AB384159C01DA452C03A271
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\inhesion\kattepoters.jpgimage
MD5:F6F27A712E777AFE756D14C24B527A2D
SHA256:720DE1AB410F13AC413647A2D0EEDC3CD15893F8D3D6CC35ACC6E99A05130078
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\inhesion\uninhibitedly.jpgimage
MD5:B20C125A5BB14FD227955D7E852FA7EE
SHA256:63DB8569038CF7EC962EAD4B4759D8E5965FCE7DBCC89BA005672987AD256DEA
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\inhesion\gruppearbejderne.jpgimage
MD5:B4B76AE6B932FFB7D57B4C8DF841BBEB
SHA256:F97A2AF3EE944378630965996859802B13BF9360F3620D399B3C25564F37AE9E
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\inhesion\elsdyrets.txttext
MD5:8C956E8A51D4D31917BB453285EC6734
SHA256:7D65FEF133FA3B2EAA33C7A807D282E46B2C09D1AF6A542C6CA45F8DB8D4FBAD
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\inhesion\preposing.forbinary
MD5:B1B085431111505CDA09720950FC532C
SHA256:C4C36E403368A4D35E9C2D177F01E218579D94F7C22BC2C4915F772A38CB4931
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
244
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
303
142.250.185.206:443
https://drive.google.com/uc?export=download&id=131eBjkwYn8ICSaSNULjDwoguWSHuBmio
unknown
—
—
unknown
—
—
GET
200
142.250.185.97:443
https://drive.usercontent.google.com/download?id=131eBjkwYn8ICSaSNULjDwoguWSHuBmio&export=download
unknown
binary
271 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1488
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
92.123.104.41:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
244
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.147:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
244
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 92.123.104.41
  • 92.123.104.61
  • 92.123.104.65
  • 92.123.104.53
  • 92.123.104.59
  • 92.123.104.47
  • 92.123.104.38
  • 92.123.104.58
  • 92.123.104.64
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 23.48.23.147
  • 23.48.23.139
  • 23.48.23.137
  • 23.48.23.148
  • 23.48.23.146
  • 23.48.23.141
  • 23.48.23.140
  • 23.48.23.138
  • 23.48.23.149
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
drive.google.com
  • 142.250.185.142
whitelisted
drive.usercontent.google.com
  • 142.250.185.97
whitelisted
watson.events.data.microsoft.com
  • 20.42.65.92
whitelisted
self.events.data.microsoft.com
  • 40.79.167.8
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nfactura_pendiente.tar