Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 08:26
Behavioral task
behavioral1
Sample
mail.scr
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
mail.scr
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
mail.scr
-
Size
21KB
-
MD5
26b8bc40d95b979e1e708a9f843242ad
-
SHA1
229284e8cb74bbfae647eb160e4188bda3e50721
-
SHA256
1fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81
-
SHA512
e53fb1b351f47227c1568718c99cc78048507518ac823cebccddebdc630845f9c972a746036f67d416275bdb1667d298ddd6a0fd4e0fea4dc096d7c2cfcf0625
-
SSDEEP
384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzU4ek+:SCIqdH/k1ZVcT194jp44eD
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2072-1-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-3-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-5-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-7-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/files/0x0007000000015c2f-11.dat upx behavioral1/memory/2072-87-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-110-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-111-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-112-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-137-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-138-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-140-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-141-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2072-186-0x0000000000800000-0x000000000080D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" mail.scr -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\Winamp 5.0 (en).com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\WinRAR.v.3.2.and.key.com mail.scr File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Harry Potter.exe mail.scr File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\Winamp 5.0 (en).ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\EURO\Harry Potter.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\Winamp 5.0 (en) Crack.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\Harry Potter.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\ICQ 4 Lite.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\index.ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\Harry Potter.ShareReactor.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\WinRAR.v.3.2.and.key.ShareReactor.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\Winamp 5.0 (en).com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\index.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\Kazaa Lite.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\WinRAR.v.3.2.and.key.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\Winamp 5.0 (en) Crack.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\WinRAR.v.3.2.and.key.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\Winamp 5.0 (en).exe mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\index.exe mail.scr File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\index.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\index.exe mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\Harry Potter.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\Winamp 5.0 (en).com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\Winamp 5.0 (en).ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\Winamp 5.0 (en).exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\ICQ 4 Lite.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\index.ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\index.ShareReactor.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Winamp 5.0 (en).exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\Winamp 5.0 (en).ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\index.ShareReactor.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\index.ShareReactor.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\Harry Potter.ShareReactor.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\WinRAR.v.3.2.and.key.ShareReactor.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\Kazaa Lite.exe mail.scr File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\WinRAR.v.3.2.and.key.exe mail.scr File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\index.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\Winamp 5.0 (en).com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\WinRAR.v.3.2.and.key.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\Winamp 5.0 (en) Crack.ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\ink\index.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\WinRAR.v.3.2.and.key.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\WinRAR.v.3.2.and.key.ShareReactor.com mail.scr File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\Harry Potter.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\WinRAR.v.3.2.and.key.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\Winamp 5.0 (en).exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\VGX\Kazaa Lite.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\Winamp 5.0 (en).exe mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\Winamp 5.0 (en) Crack.exe mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\Harry Potter.ShareReactor.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\Winamp 5.0 (en).exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\index.ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\index.exe mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\ICQ 4 Lite.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\Winamp 5.0 (en).com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\Kazaa Lite.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\ICQ 4 Lite.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\ICQ 4 Lite.ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\Help\Harry Potter.com mail.scr File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Harry Potter.ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\Winamp 5.0 (en) Crack.ShareReactor.com mail.scr File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\Kazaa Lite.ShareReactor.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\index.com mail.scr File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\Kazaa Lite.com mail.scr -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe mail.scr File created C:\Windows\lsass.exe mail.scr
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD526b8bc40d95b979e1e708a9f843242ad
SHA1229284e8cb74bbfae647eb160e4188bda3e50721
SHA2561fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81
SHA512e53fb1b351f47227c1568718c99cc78048507518ac823cebccddebdc630845f9c972a746036f67d416275bdb1667d298ddd6a0fd4e0fea4dc096d7c2cfcf0625