File name: | PROCESO JUZGADO N° 741920230418.UUE |
Full analysis: | https://app.any.run/tasks/41b7c75a-204f-4383-8b2b-2b49bf5f6a6a |
Verdict: | Malicious activity |
Analysis date: | July 25, 2024, 19:26:45 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 6D91F06E8B27E40F0AF584CD717B7C09 |
SHA1: | 725F77EE83E34A15B65EE0278EBBE0C9C026C796 |
SHA256: | FC50B139011B2DAB70FD1F731B9310A722DEFCC4F7391765CAF6238A46A0A36C |
SSDEEP: | 12288:COfviw65EwDRotJd3g/fwtPFScVhC0WpQK7zsB8jw:1fvir5EERSg/fwtPMcVh16QK7wB8c |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6668 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PROCESO JUZGADO N° 741920230418.UUE.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
6388 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6352 | "C:\Users\admin\Desktop\PROCESO JUZGADO N° 741920230418.exe" | C:\Users\admin\Desktop\PROCESO JUZGADO N° 741920230418.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
|
(PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
(PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\PROCESO JUZGADO N° 741920230418.UUE.rar | |||
(PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
Operation: | write | Name: | ShowPassword |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6352 | PROCESO JUZGADO N° 741920230418.exe | C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | executable | |
MD5:6DD1CF6DA5B2D07344E5AD912E60DF04 | SHA256:8F9D445702A8AE7547B9CED23A362612CFBF4F5D53569B619FDB7168EABD97E5 | |||
6352 | PROCESO JUZGADO N° 741920230418.exe | C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe | executable | |
MD5:6DD1CF6DA5B2D07344E5AD912E60DF04 | SHA256:8F9D445702A8AE7547B9CED23A362612CFBF4F5D53569B619FDB7168EABD97E5 | |||
6352 | PROCESO JUZGADO N° 741920230418.exe | C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe | executable | |
MD5:6DD1CF6DA5B2D07344E5AD912E60DF04 | SHA256:8F9D445702A8AE7547B9CED23A362612CFBF4F5D53569B619FDB7168EABD97E5 | |||
6352 | PROCESO JUZGADO N° 741920230418.exe | C:\Users\admin\AppData\Roaming\Ground.exe | executable | |
MD5:6DD1CF6DA5B2D07344E5AD912E60DF04 | SHA256:8F9D445702A8AE7547B9CED23A362612CFBF4F5D53569B619FDB7168EABD97E5 | |||
6352 | PROCESO JUZGADO N° 741920230418.exe | C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe | executable | |
MD5:6DD1CF6DA5B2D07344E5AD912E60DF04 | SHA256:8F9D445702A8AE7547B9CED23A362612CFBF4F5D53569B619FDB7168EABD97E5 | |||
6352 | PROCESO JUZGADO N° 741920230418.exe | C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe | executable | |
MD5:6DD1CF6DA5B2D07344E5AD912E60DF04 | SHA256:8F9D445702A8AE7547B9CED23A362612CFBF4F5D53569B619FDB7168EABD97E5 | |||
6352 | PROCESO JUZGADO N° 741920230418.exe | C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe | executable | |
MD5:6DD1CF6DA5B2D07344E5AD912E60DF04 | SHA256:8F9D445702A8AE7547B9CED23A362612CFBF4F5D53569B619FDB7168EABD97E5 | |||
6352 | PROCESO JUZGADO N° 741920230418.exe | C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe | executable | |
MD5:6DD1CF6DA5B2D07344E5AD912E60DF04 | SHA256:8F9D445702A8AE7547B9CED23A362612CFBF4F5D53569B619FDB7168EABD97E5 | |||
6668 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6668.43677\PROCESO JUZGADO N° 741920230418.exe | executable | |
MD5:6DD1CF6DA5B2D07344E5AD912E60DF04 | SHA256:8F9D445702A8AE7547B9CED23A362612CFBF4F5D53569B619FDB7168EABD97E5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1904 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
5272 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
5272 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
5272 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
3704 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | unknown |
4932 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3800 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6012 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4212 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3952 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4204 | svchost.exe | 4.209.32.198:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4468 | slui.exe | 40.91.76.224:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5368 | SearchApp.exe | 2.20.142.145:443 | www.bing.com | Akamai International B.V. | DE | unknown |
5272 | svchost.exe | 40.126.32.72:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |