Analysis
-
max time kernel
123s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 02:00
Static task
static1
Behavioral task
behavioral1
Sample
Places to visit.scr
Resource
win7-20240221-en
General
-
Target
Places to visit.scr
-
Size
772.4MB
-
MD5
b61ea25997f2f8721ac589703526dd6b
-
SHA1
3bd31fe83ff4e4ad99395426654f80200b21e021
-
SHA256
8d4ade5b2a0b9b026e58e9771ce41d77a82cebae4d493cf3170b14c45b236b69
-
SHA512
450f26ec9fc2feb1854d5d00271eba0b128831cdd09c8a6675d248ea4ef2f6e0f7d1bd0f00a5ee3242577ac5d1ffc48175a9ca4ebdda021c7b91d4fb5d7dfa8a
-
SSDEEP
6144:Xc2iyp+gYP1ueAFoTScAXstyrTKmBrHfqlyeBzbRNI07EoUOlc/:YyyP1jAF2SRcqumBrHfqvP5Eo3+
Malware Config
Extracted
lumma
https://theatergenerationju.shop/api
https://entitlementappwo.shop/api
https://economicscreateojsu.shop/api
https://pushjellysingeywus.shop/api
https://absentconvicsjawun.shop/api
https://suitcaseacanehalk.shop/api
https://bordersoarmanusjuw.shop/api
https://mealplayerpreceodsju.shop/api
https://wifeplasterbakewis.shop/api
Signatures
Processes
-
C:\Users\Admin\AppData\Local\Temp\Places to visit.scr"C:\Users\Admin\AppData\Local\Temp\Places to visit.scr" /S1⤵PID:4644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 3962⤵
- Program crash
PID:3712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4644 -ip 46441⤵PID:1192