| File name: | DEMANDA LABORAL POR ABUSO DE CONFIANZA 01.XZ |
| Full analysis: | https://app.any.run/tasks/2f2d716d-b064-4e6d-bee3-afe0aa6b6709 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | December 09, 2024, 13:13:10 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 87AA9B12C1B0C3E870690B9439B839D6 |
| SHA1: | 74AA95746C8B1C2FA9463B0A549FEEA78B112D11 |
| SHA256: | A53EC05A1C33D2D78AFA7E0B7385A8E60388D19110BA1CF72AFA99D295BAD315 |
| SSDEEP: | 98304:o0ItfRbUyrpI3h40rzYwK/qfzeX/8pg+dNb36LZTGj/YM2tyuiRrjvy3vgoMKUua:672cmhy4z2uNFi2 |
MALICIOUS
Known privilege escalation attack
- dllhost.exe (PID: 7144)
REMCOS has been detected
- svchost.exe (PID: 2728)
REMCOS mutex has been found
- svchost.exe (PID: 2728)
Uses Task Scheduler to autorun other applications
- cmd.exe (PID: 1412)
REMCOS has been detected (YARA)
- svchost.exe (PID: 2728)
REMCOS has been detected (SURICATA)
- svchost.exe (PID: 2728)
Connects to the CnC server
- svchost.exe (PID: 2728)
SUSPICIOUS
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 3840)
- svchost.exe (PID: 2728)
Executable content was dropped or overwritten
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 7064)
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 5528)
Drops a system driver (possible attempt to evade defenses)
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 5528)
Starts CMD.EXE for commands execution
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 5528)
The process creates files with name similar to system file names
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 5528)
There is functionality for taking screenshot (YARA)
- svchost.exe (PID: 2728)
Contacting a server suspected of hosting an CnC
- svchost.exe (PID: 2728)
Connects to unusual port
- svchost.exe (PID: 2728)
Checks for external IP
- svchost.exe (PID: 2728)
INFO
Reads the computer name
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 7064)
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 5528)
- svchost.exe (PID: 2728)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3840)
The process uses the downloaded file
- WinRAR.exe (PID: 3840)
- dllhost.exe (PID: 7144)
Checks supported languages
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 7064)
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 5528)
- svchost.exe (PID: 2728)
Creates files or folders in the user directory
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 7064)
- svchost.exe (PID: 2728)
Reads security settings of Internet Explorer
- dllhost.exe (PID: 7144)
Checks transactions between databases Windows and Oracle
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 7064)
Checks proxy server information
- svchost.exe (PID: 2728)
Reads the machine GUID from the registry
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 7064)
Create files in a temporary directory
- 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe (PID: 5528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
EXIF
ZIP
| FileVersion: | 7z v0.04 |
|---|---|
| ModifyDate: | 2024:12:04 17:30:21+00:00 |
| ArchivedFileName: | DEMANDA LABORAL POR ABUSO DE CONFIANZA 01 |
Total processes
134
Monitored processes
9
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1412 | C:\WINDOWS\system32\cmd.exe /c schtasks /create /tn "l1TC0x" /tr "C:\Users\admin\AppData\Roaming\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe" /sc onlogon /rl highest /f | C:\Windows\System32\cmd.exe | 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2728 | "C:\Users\admin\AppData\Local\Temp\svchost.exe" | C:\Users\admin\AppData\Local\Temp\svchost.exe | 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
| 3692 | schtasks /create /tn "l1TC0x" /tr "C:\Users\admin\AppData\Roaming\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe" /sc onlogon /rl highest /f | C:\Windows\System32\schtasks.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3840 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01.XZ.7z" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 5528 | "C:\Users\admin\AppData\Roaming\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe" | C:\Users\admin\AppData\Roaming\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | dllhost.exe | ||||||||||||
User: admin Company: Cisco Systems, Inc Integrity Level: HIGH Description: Webex Version: 1.0.0.2 Modules
| |||||||||||||||
| 5572 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7064 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb3840.33189\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb3840.33189\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | WinRAR.exe | ||||||||||||
User: admin Company: Cisco Systems, Inc Integrity Level: MEDIUM Description: Webex Exit code: 0 Version: 1.0.0.2 Modules
| |||||||||||||||
| 7144 | C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\System32\dllhost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
3 428
Read events
3 412
Write events
16
Delete events
0
Modification events
| (PID) Process: | (3840) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (3840) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (3840) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (3840) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01.XZ.7z | |||
| (PID) Process: | (3840) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3840) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3840) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3840) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3840) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (7144) dllhost.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
Executable files
9
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3840 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3840.33189\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01\CiscoSparkLauncher.dll | executable | |
MD5:E2E01305E938EA378A88658D81C0917F | SHA256:29C3C48F4DC84E7179881BC3767546878B2DB89D418372F687EDBD4A72EF0989 | |||
| 5528 | 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | C:\Users\admin\AppData\Local\Temp\svchost.exe | executable | |
MD5:A30283C01840F1A26AFE40AE0B576BF8 | SHA256:E2A4A7E147898DC2D01F1B4D2892000395F5E43770A25ECDB170BB185AC0477A | |||
| 5528 | 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | C:\Users\admin\AppData\Local\Temp\yKw0m.sys | executable | |
MD5:356BDA2BF0F6899A2C08B2DA3EC69F13 | SHA256:358AC54BE252673841A1D65BFC2FB6D549C1A4C877FA7F5E1BFA188F30375D69 | |||
| 3840 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3840.33189\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | executable | |
MD5:9C521A90653DF5D1EFBD0CEA12318863 | SHA256:85BCFC9DE06BD0751245AD882F7E2141F340CDEDEFCAEFB8DEABBC0792088A58 | |||
| 3840 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3840.33189\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01\VERSION.dll | executable | |
MD5:6D4E5E67DEFDE30EB1E41F7DAEF2E35F | SHA256:FE8B684B17B074D43782C9419F8739C0179C34E095A02C30E4519FACE3A51489 | |||
| 2728 | svchost.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].json | binary | |
MD5:0231FBAF53DD0F8F07E56D859F42E231 | SHA256:339AD1B9DA61FF08A0869F4456549BA4ADC813753EA381660170AC5B4D448F3A | |||
| 5528 | 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | C:\Users\admin\AppData\Local\Temp\KeUrNFcDTo6.sys | executable | |
MD5:2A3CE41BB2A7894D939FBD1B20DAE5A0 | SHA256:2BBC6B9DD5E6D0327250B32305BE20C89B19B56D33A096522EE33F22D8C82FF1 | |||
| 7064 | 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | C:\Users\admin\AppData\Roaming\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | executable | |
MD5:9C521A90653DF5D1EFBD0CEA12318863 | SHA256:85BCFC9DE06BD0751245AD882F7E2141F340CDEDEFCAEFB8DEABBC0792088A58 | |||
| 7064 | 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | C:\Users\admin\AppData\Roaming\VERSION.dll | executable | |
MD5:6D4E5E67DEFDE30EB1E41F7DAEF2E35F | SHA256:FE8B684B17B074D43782C9419F8739C0179C34E095A02C30E4519FACE3A51489 | |||
| 7064 | 01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe | C:\Users\admin\AppData\Roaming\CiscoSparkLauncher.dll | executable | |
MD5:E2E01305E938EA378A88658D81C0917F | SHA256:29C3C48F4DC84E7179881BC3767546878B2DB89D418372F687EDBD4A72EF0989 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
34
DNS requests
21
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.10:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6228 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
6908 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2728 | svchost.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | malicious |
6908 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5856 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.164.10:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3976 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5064 | SearchApp.exe | 2.23.209.136:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
1176 | svchost.exe | 40.126.31.67:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1176 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2192 | svchost.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a *.kozow .com Domain |
2192 | svchost.exe | Potentially Bad Traffic | SUSPICIOUS [ANY.RUN] Suspected Malicious domain by CrossDomain (melloreservas .kozow .com) |
2728 | svchost.exe | Malware Command and Control Activity Detected | ET MALWARE Remcos 3.x Unencrypted Checkin |
2728 | svchost.exe | Malware Command and Control Activity Detected | ET MALWARE Remcos 3.x Unencrypted Server Response |
2728 | svchost.exe | Malware Command and Control Activity Detected | ET MALWARE Remcos 3.x Unencrypted Server Response |
2728 | svchost.exe | Malware Command and Control Activity Detected | ET MALWARE Remcos 3.x Unencrypted Server Response |
1 ETPRO signatures available at the full report