Malware Analysis Report

2024-09-22 07:18

Sample ID 240530-xjnklagb6z
Target 03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.REV
SHA256 bd25554c274a03203a99a4bc55c6a8553edbcc7dbee5ec606eefbedd7f551e00
Tags
discovery asyncrat default rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bd25554c274a03203a99a4bc55c6a8553edbcc7dbee5ec606eefbedd7f551e00

Threat Level: Known bad

The file 03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.REV was found to be: Known bad.

Malicious Activity Summary

discovery asyncrat default rat

AsyncRat

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-30 18:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240221-en

Max time kernel

117s

Max time network

118s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\libcrypto-1_1-x64.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\libcrypto-1_1-x64.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240508-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Qt5Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Qt5Core.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

98s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Qt5Network.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Qt5Network.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 205.131.50.23.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

151s

Command Line

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\anesthesiology.ini"

Signatures

N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\anesthesiology.ini"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3908 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 63.141.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

148s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\badge.dat"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\badge.dat"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240220-en

Max time kernel

119s

Max time network

121s

Command Line

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\anesthesiology.ini"

Signatures

N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\anesthesiology.ini"

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240419-en

Max time kernel

118s

Max time network

124s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\badge.dat"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.dat C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.dat\ = "dat_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\badge.dat"

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\badge.dat

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\badge.dat"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 74c97d3f94d9a8f4c1bb434f10f06a0d
SHA1 99123826e4b31d49b323c20c84f9133d4f33acf6
SHA256 840c5e6162f70e3d72dc60a552817de5f134d4d6e38e3e8af93b3b27461f84a5
SHA512 1e82961d023bdcad57fe6b748f64d7c27040fb92ec50a1dd7f32f3e5b86d34e3a6ab6eecee0ea6ec93a5d1442c8f707f7136bd11af677f2aa18123eca5a95371

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240221-en

Max time kernel

120s

Max time network

123s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\msvcp140_1.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\msvcp140_1.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20231129-en

Max time kernel

117s

Max time network

119s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\vcruntime140_1.dll",#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2888 wrote to memory of 2952 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2888 wrote to memory of 2952 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2888 wrote to memory of 2952 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\vcruntime140_1.dll",#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2888 -s 80

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240221-en

Max time kernel

119s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe

"C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe"

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe"

Signatures

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\7-Zip\Lang\ast.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\ug.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\kaa.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\kab.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\nb.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\sl.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\ext.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\is.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\mk.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\7-zip.dll C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\an.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\cy.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\pt-br.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\ta.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\ba.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\ne.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\pl.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\de.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\es.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\fur.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\ro.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\sq.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\ku.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\ast.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\fi.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\fr.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\it.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\va.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\et.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\License.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\bn.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\lv.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\lv.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\af.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\ga.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\id.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\mr.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\ps.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\ru.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\7z.dll C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\es.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\7-zip.chm C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\fur.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\ug.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\uz.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\fy.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\mn.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\nn.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\sq.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\7z.sfx C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\sa.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\sw.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\hr.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\th.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\tr.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File created C:\Program Files (x86)\7-Zip\Lang\it.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
File opened for modification C:\Program Files (x86)\7-Zip\Lang\mn.txt C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll" C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe

"C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Winrar\7z2301.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
BE 2.17.196.105:443 www.bing.com tcp
US 8.8.8.8:53 105.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240508-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\steam_api64.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\steam_api64.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240221-en

Max time kernel

120s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe"

Signatures

AsyncRat

rat asyncrat

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\ValidAppv3.job C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2600 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe C:\Windows\SysWOW64\cmd.exe
PID 2664 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2664 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2664 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2664 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2664 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2664 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Processes

C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe

"C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 enviofinal.kozow.com udp
US 45.77.80.234:5051 enviofinal.kozow.com tcp

Files

memory/2600-0-0x000007FEF5B40000-0x000007FEF5C98000-memory.dmp

memory/2600-12-0x000007FEF5B58000-0x000007FEF5B59000-memory.dmp

memory/2600-13-0x000007FEF5B40000-0x000007FEF5C98000-memory.dmp

memory/2600-14-0x000007FEF5B40000-0x000007FEF5C98000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1d64741f

MD5 981edd5997b744f04a6624142b314233
SHA1 9ae85015c0d5b670fa4b3c5b26aaeee9bb8b2e71
SHA256 e04909a0a2b70a7621736c89148f6e460d847984824eaa772cd08ca90eb1a867
SHA512 014dab300c31fa042cfcf490e181b29ea63b74930fc2a768f7897d98189b5d8acbbdccc819234740315674fae42e45756416e76bd7109f6645d7e33fcc87512c

memory/2664-17-0x0000000077450000-0x00000000775F9000-memory.dmp

memory/2664-63-0x0000000074C9E000-0x0000000074CA2000-memory.dmp

memory/2664-62-0x0000000074C90000-0x0000000074E04000-memory.dmp

memory/2664-69-0x0000000074C90000-0x0000000074E04000-memory.dmp

memory/2664-72-0x0000000074C90000-0x0000000074E04000-memory.dmp

memory/2664-73-0x0000000074C90000-0x0000000074E04000-memory.dmp

memory/2664-76-0x0000000074C90000-0x0000000074E04000-memory.dmp

memory/960-77-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/960-78-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/960-75-0x0000000072A80000-0x0000000073AE2000-memory.dmp

memory/2664-79-0x0000000074C9E000-0x0000000074CA2000-memory.dmp

memory/960-80-0x0000000000400000-0x0000000000416000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240508-en

Max time kernel

120s

Max time network

123s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\libssl-1_1-x64.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\libssl-1_1-x64.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

127s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\libssl-1_1-x64.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\libssl-1_1-x64.dll",#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4036,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
BE 2.17.196.105:443 www.bing.com tcp
US 8.8.8.8:53 105.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

154s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\msvcp140.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\msvcp140.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
BE 2.17.196.105:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 105.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240419-en

Max time kernel

120s

Max time network

125s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\vcruntime140.dll",#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2076 wrote to memory of 2300 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2076 wrote to memory of 2300 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2076 wrote to memory of 2300 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\vcruntime140.dll",#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2076 -s 80

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

107s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Qt5Core.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Qt5Core.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 177.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240215-en

Max time kernel

122s

Max time network

123s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Qt5Network.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\Qt5Network.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240426-en

Max time kernel

92s

Max time network

94s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\libcrypto-1_1-x64.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\libcrypto-1_1-x64.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

105s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\msvcp140_1.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\msvcp140_1.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240226-en

Max time kernel

144s

Max time network

153s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\steam_api64.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\steam_api64.dll",#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 56.94.73.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.179.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20240508-en

Max time kernel

120s

Max time network

122s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z"

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 1a5a8f0d9fe25051243a6eb71f68949c
SHA1 6e9678ee5634f4da7463f742c84d7ce972438333
SHA256 72db09bfccd74270f264dc209822b257ffc291634ba5c542d888a28873257e2b
SHA512 a759afc174a4cb052bb12caff2f27c412ac3b024405e4d6a985269f73a3d3345ae8dad39c67af414aa29308f44b7b2cdaa6a9d87c2a27019cd6f2b921682590f

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

135s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.123:443 www.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 123.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe"

Signatures

AsyncRat

rat asyncrat

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\ValidAppv3.job C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe

"C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\01 PROCESO JUDICIAL JUZGADO.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
BE 2.17.196.105:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 105.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 enviofinal.kozow.com udp
US 45.77.80.234:5051 enviofinal.kozow.com tcp
US 8.8.8.8:53 234.80.77.45.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 205.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/2096-0-0x00007FF9171E0000-0x00007FF917352000-memory.dmp

memory/2096-12-0x00007FF9171F8000-0x00007FF9171F9000-memory.dmp

memory/2096-13-0x00007FF9171E0000-0x00007FF917352000-memory.dmp

memory/2096-14-0x00007FF9171E0000-0x00007FF917352000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\acd380ea

MD5 25bb5cf83573b3b91436cc12b32ebb41
SHA1 ec862c2328a8b96e5c03e8d7da7dc93bf9d7c74e
SHA256 7f0e8157b000ea1b5dce96cb158836e630021b0a6be57d99ebd0109e2e6e22dc
SHA512 78855a669d144b90b51f2bfc19cb66782d5e5d0a9f1769b027db1982274e8c0f1692285c250f9670d11ed91b7c4cb3796e3f703b24fb8894caae31f556efcf0b

memory/1216-17-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

memory/1216-19-0x0000000075990000-0x0000000075B0B000-memory.dmp

memory/1216-22-0x0000000075990000-0x0000000075B0B000-memory.dmp

memory/1216-20-0x000000007599E000-0x00000000759A2000-memory.dmp

memory/1216-24-0x0000000075990000-0x0000000075B0B000-memory.dmp

memory/1216-25-0x0000000075990000-0x0000000075B0B000-memory.dmp

memory/1216-27-0x0000000075990000-0x0000000075B0B000-memory.dmp

memory/5032-28-0x0000000073EB0000-0x0000000075104000-memory.dmp

memory/1216-31-0x000000007599E000-0x00000000759A2000-memory.dmp

memory/5032-32-0x00000000735FE000-0x00000000735FF000-memory.dmp

memory/5032-33-0x0000000000DA0000-0x0000000000DB6000-memory.dmp

memory/5032-34-0x0000000005EE0000-0x0000000006484000-memory.dmp

memory/5032-35-0x0000000005AD0000-0x0000000005B62000-memory.dmp

memory/5032-36-0x0000000005AA0000-0x0000000005AAA000-memory.dmp

memory/5032-39-0x0000000006B70000-0x0000000006C0C000-memory.dmp

memory/5032-40-0x0000000006AD0000-0x0000000006B36000-memory.dmp

memory/5032-41-0x00000000735FE000-0x00000000735FF000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win7-20231129-en

Max time kernel

129s

Max time network

121s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\msvcp140.dll",#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1368 wrote to memory of 1920 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1368 wrote to memory of 1920 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1368 wrote to memory of 1920 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\msvcp140.dll",#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1368 -s 80

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240426-en

Max time kernel

92s

Max time network

96s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\vcruntime140.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\vcruntime140.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-05-30 18:53

Reported

2024-05-30 18:56

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\vcruntime140_1.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO\vcruntime140_1.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.123:443 www.bing.com tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 123.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 203.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 205.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp

Files

N/A