Malware analysis NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO.rar Malicious activity

Add for printing

File name:	NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO.rar
Full analysis:	https://app.any.run/tasks/a011154e-2028-40fc-a1c6-418d5e09f91d
Verdict:	Malicious activity
Threats:	AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses. A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Malware Trends Tracker >>>
Analysis date:	January 03, 2025, 19:22:37
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	arch-exec hijackloader loader asyncrat rat
Indicators:
MIME:	application/x-rar
File info:	RAR archive data, v5
MD5:	811866D4C0BCD902DFA2D7889C4D3E63
SHA1:	9734AB27CAC44A576F9C48545BF27FF63D210861
SHA256:	FA4543923DAE10BCF173BCAB1A8218AA0B1699980235F91DB04F9FC7480CCCE2
SSDEEP:	98304:8A/Rp/wbRWEaqRv7G8aemPRNdb6UJmIx1mZIxN3iA65FsKsIVsE+eoZnmqbPHHiy:LcC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Generic archive extractor
  - WinRAR.exe (PID: 6628)
- Executing a file with an untrusted certificate
  - 00030 NotificacionElectronica.exe (PID: 3552)
- HIJACKLOADER has been detected (YARA)
  - 00030 NotificacionElectronica.exe (PID: 3552)
- ASYNCRAT has been detected (YARA)
  - MSBuild.exe (PID: 1488)
- ASYNCRAT has been detected (MUTEX)
  - MSBuild.exe (PID: 1488)
SUSPICIOUS
- Process drops legitimate windows executable
  - WinRAR.exe (PID: 6628)
  - 00030 NotificacionElectronica.exe (PID: 3552)
- Executable content was dropped or overwritten
  - 00030 NotificacionElectronica.exe (PID: 3552)
- Starts CMD.EXE for commands execution
  - 00030 NotificacionElectronica.exe (PID: 3552)
- Connects to unusual port
  - MSBuild.exe (PID: 1488)
INFO
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 6628)
- The sample compiled with english language support
  - WinRAR.exe (PID: 6628)
  - 00030 NotificacionElectronica.exe (PID: 3552)
- Checks supported languages
  - 00030 NotificacionElectronica.exe (PID: 3552)
  - MSBuild.exe (PID: 1488)
- The process uses the downloaded file
  - WinRAR.exe (PID: 6628)
- Manual execution by a user
  - 00030 NotificacionElectronica.exe (PID: 3552)
- Reads the computer name
  - 00030 NotificacionElectronica.exe (PID: 3552)
  - MSBuild.exe (PID: 1488)
- Creates files or folders in the user directory
  - 00030 NotificacionElectronica.exe (PID: 3552)
- Create files in a temporary directory
  - 00030 NotificacionElectronica.exe (PID: 3552)
- Reads the machine GUID from the registry
  - MSBuild.exe (PID: 1488)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.rar	\|	RAR compressed archive (v5.0) (61.5)
.rar	\|	RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion:	RAR v5
CompressedSize:	9429
UncompressedSize:	14450
OperatingSystem:	Win32
ArchivedFileName:	wdkpd

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

131

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1488

C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

MSBuild.exe

Version:

4.8.9037.0 built by: NET481REL1

Modules

Images
c:\users\admin\appdata\local\temp\gicakwobrptob
c:\windows\syswow64\mshtml.dll
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll

2192

C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

services.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

3552

"C:\Users\admin\Desktop\00030 NotificacionElectronica.exe"

C:\Users\admin\Desktop\00030 NotificacionElectronica.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\desktop\00030 notificacionelectronica.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

3732

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

5404

C:\WINDOWS\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

—

00030 NotificacionElectronica.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

6628

"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO.rar"

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Exit code:

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

Add for printing

Total events

3 054

Read events

3 020

Write events

Delete events

Modification events


(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\preferences.zip
(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO.rar
(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	15
Value:
(PID) Process:	(6628) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	14
Value:

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
5404	cmd.exe	C:\Users\admin\AppData\Local\Temp\gicakwobrptob		—
		MD5:—	SHA256:—
6628	WinRAR.exe	C:\Users\admin\Desktop\00030 NotificacionElectronica.exe		executable
		MD5:D9530ECEE42ACCCFD3871672A511BC9E	SHA256:81E04F9A131534ACC0E9DE08718C062D3D74C80C7F168EC7E699CD4B2BD0F280
6628	WinRAR.exe	C:\Users\admin\Desktop\d3dx9_43.dll		executable
		MD5:D87DE826CA653D3BFE426337EADC0EE3	SHA256:6F0B9E1F52998E21DB8B5A07305D93E699E9E766C0D04403F436E2551946701E
6628	WinRAR.exe	C:\Users\admin\Desktop\wdkpd		binary
		MD5:7082BA2B15A6F4DDC06A8E0C54C5CC81	SHA256:358301CE5A8C665C353460DDE15B7FDA2F979BD9AB5D49C0CC9F2F495828A362
3552	00030 NotificacionElectronica.exe	C:\Users\admin\AppData\Roaming\ClientWizard\wdkpd		binary
		MD5:7082BA2B15A6F4DDC06A8E0C54C5CC81	SHA256:358301CE5A8C665C353460DDE15B7FDA2F979BD9AB5D49C0CC9F2F495828A362
3552	00030 NotificacionElectronica.exe	C:\Users\admin\AppData\Roaming\ClientWizard\d3dx9_43.dll		executable
		MD5:D87DE826CA653D3BFE426337EADC0EE3	SHA256:6F0B9E1F52998E21DB8B5A07305D93E699E9E766C0D04403F436E2551946701E
6628	WinRAR.exe	C:\Users\admin\Desktop\ptvt		binary
		MD5:51B6BC457D591A9B73608BE306B05A43	SHA256:D901710C189D6D486BBE6ECF9EF0C3B1C16B675A2A7C279F7E858585E9B397FE
3552	00030 NotificacionElectronica.exe	C:\Users\admin\AppData\Roaming\ClientWizard\ptvt		binary
		MD5:51B6BC457D591A9B73608BE306B05A43	SHA256:D901710C189D6D486BBE6ECF9EF0C3B1C16B675A2A7C279F7E858585E9B397FE
5404	cmd.exe	C:\Users\admin\AppData\Local\Temp\sihdnv		binary
		MD5:911370296A1147D7A64AC90514B0D7A5	SHA256:B29F1DE1B73EF6DE7F43035D8BEA49431666A6991F0606BD41184AF21E0DB5A3
3552	00030 NotificacionElectronica.exe	C:\Users\admin\AppData\Local\Temp\14049e25		binary
		MD5:99BF764F539749D03DC56DA294E97CD5	SHA256:26D2D742CD5732E1C41A6566F69C984612F9E8BBD13E024765DF27100BCCB598

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	184.30.230.103:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	2.16.164.35:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4712	MoUsoCoreWorker.exe	GET	200	184.30.230.103:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1176	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5992	SIHClient.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
6380	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D	unknown	—	—	whitelisted
5992	SIHClient.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
5064	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
640	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	2.16.164.35:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
—	—	184.30.230.103:80	www.microsoft.com	AKAMAI-AS	US	unknown
4712	MoUsoCoreWorker.exe	184.30.230.103:80	www.microsoft.com	AKAMAI-AS	US	whitelisted
5064	SearchApp.exe	2.23.227.221:443	www.bing.com	Ooredoo Q.S.C.	QA	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5064	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
1176	svchost.exe	40.126.31.73:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 20.73.194.208	whitelisted
crl.microsoft.com	2.16.164.35 2.16.164.64 2.16.164.74 2.16.164.89 2.16.164.96 2.16.164.72 2.16.164.88 2.16.164.49 2.16.164.73	whitelisted
www.microsoft.com	184.30.230.103 88.221.169.152	whitelisted
google.com	142.250.185.142	whitelisted
www.bing.com	2.23.227.221 2.23.227.208 2.23.227.215	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	40.126.31.73 40.126.31.69 20.190.159.4 20.190.159.64 20.190.159.23 40.126.31.67 40.126.31.71 20.190.159.71	whitelisted
go.microsoft.com	23.56.254.14	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	40.69.42.241	whitelisted

Threats

PID	Process	Class	Message
2192	svchost.exe	Misc activity	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2192	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2192	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2192	svchost.exe	Misc activity	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2192	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2192	svchost.exe	Misc activity	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2192	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2192	svchost.exe	Misc activity	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2192	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2192	svchost.exe	Misc activity	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain

Add for printing

No debug info

General Info

NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO.rar

811866D4C0BCD902DFA2D7889C4D3E63

9734AB27CAC44A576F9C48545BF27FF63D210861

FA4543923DAE10BCF173BCAB1A8218AA0B1699980235F91DB04F9FC7480CCCE2

98304:8A/Rp/wbRWEaqRv7G8aemPRNdb6UJmIx1mZIxN3iA65FsKsIVsE+eoZnmqbPHHiy:LcC

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Generic archive extractor

Executing a file with an untrusted certificate

HIJACKLOADER has been detected (YARA)

ASYNCRAT has been detected (YARA)

ASYNCRAT has been detected (MUTEX)

SUSPICIOUS

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts CMD.EXE for commands execution

Connects to unusual port

INFO

Executable content was dropped or overwritten

The sample compiled with english language support

Checks supported languages

The process uses the downloaded file

Manual execution by a user

Reads the computer name

Creates files or folders in the user directory

Create files in a temporary directory

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings