Overview

overview

10

Static

static

7

message.pif.exe

windows7-x64

7

message.pif.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 03:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    message.pif.exe
  • Size 29KB
  • Sample240721-djfp7stcld
  • SHA256 270d199aa8ef1d8a93e5bf75715c4bc6c7f22ec0e4747436e541234426419bda
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\message.pif.exe
    "C:\Users\Admin\AppData\Local\Temp\message.pif.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2692

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        QC5RD00B.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\QC5RD00B.htm
        • Size 176KB
        • SHA256 c0f13d9e0bc53efcb8c0fad33c024a43f7149e3544a1eb84e39d4545ec713b0e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\results[3].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        searchK0BJJD3A.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\searchK0BJJD3A.htm
        • Size 141KB
        • SHA256 db8cbb4672ba10fc3e09c96a6912b62084f50fd83660eaba797802fb5e285bbe
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchXR9XTFKK.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\searchXR9XTFKK.htm
        • Size 157KB
        • SHA256 9a882414be701fb3b1799bfc33ec9fe2f183a4f4d7cdaccb0891a13e221b112d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\search[5].htm
        • Size 128KB
        • SHA256 6716fecb17c1e1d291d8c7eec6740510b32b0e13cf409327b70b2673cd6830cc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\results[2].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        searchGMOD0ZMW.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\searchGMOD0ZMW.htm
        • Size 131KB
        • SHA256 2a97dc6522b826ce27faba15334e9ef2862ba55aa4fe56876a6b76cbed7685bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchN3CKZOFJ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\searchN3CKZOFJ.htm
        • Size 108KB
        • SHA256 37c4a099ad1a0ad46c2e49e484e079259c3ed93f6c27131b0e4051c786676a34
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search[10].htm
        • Size 118KB
        • SHA256 5a9b92a7e411a95aae5575e061a2728478fbdc7a11f5a8646d94482fc95c4b4a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search[1].htm
        • Size 134KB
        • SHA256 f86debea7bf269bcd183b89d4c4462c0b03a9c2573fd708d3af7f01d5c7418f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search[7].htm
        • Size 115KB
        • SHA256 457daeb2abb194d82e56e80a177a20e5a619640d35f634bba7208284c1ff85f1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\default[2].htm
        • Size 305B
        • SHA256 109d8ca823dca724c4f32557a8057783a6fb755d67fc74cf9df004731c7c432b
        • MD5 SHA1 SHA512
        Submit Download

        search3JJF6K6D.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\search3JJF6K6D.htm
        • Size 141KB
        • SHA256 b7a6337e683cb6aa3bbcbc909454078c9ea37f976249eca6eef0208eb5629157
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search4TVPFWMI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\search4TVPFWMI.htm
        • Size 120KB
        • SHA256 d4a7a1babf8c972f440d8055ff8159c03caa62efdbdd1632464df942cc420de9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchCGBVEYA1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\searchCGBVEYA1.htm
        • Size 144KB
        • SHA256 3510f3f56ab60ea5d8b837fd8a1c390633f23f910f73f100f0ae3116954567ee
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchE0P0AW65.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\searchE0P0AW65.htm
        • Size 113KB
        • SHA256 ae2c924e9ea59259e5d6ef3a91ecf241f1084baa7c472e753d801ddfcfb22436
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\search[1].htm
        • Size 120KB
        • SHA256 0034b8231e9ad7d69eae3c6eea3be4fbcee0ff98e9419469955d8ba86dc97802
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\search[8].htm
        • Size 122KB
        • SHA256 2d2a350f8b97b8762cff037b1ff54ce5c2a79538d1e54df1e2eac332c8ea9812
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\default[1].htm
        • Size 315B
        • SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
        • MD5 SHA1 SHA512
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\default[3].htm
        • Size 310B
        • SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
        • MD5 SHA1 SHA512
        Submit Download

        results[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\results[8].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        search0AX7SWEH.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\search0AX7SWEH.htm
        • Size 132KB
        • SHA256 8320ca7b6f2f97315340fe69b1e9ea16d96051d2dd1289f1f64c9bc4c9b45aa4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchC47M0WSY.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\searchC47M0WSY.htm
        • Size 132KB
        • SHA256 ead51f8975d37684b697d45f1b8ab7a7299c254d2ccfce6ff22cd0fabf3d91dd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\search[2].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\search[7].htm
        • Size 115KB
        • SHA256 19699e8fb4149695f23a68a946bf9c7b08374fdb926d88808a9f2cfb1649f5aa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp80D5.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp80D5.tmp
        • Size 29KB
        • SHA256 c93bc35b4657ab52aa40240d22d6fe41cc47d73c6c2661bbfd1e59b3fa60392b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 732b5aa3660c00997585f23d1a97c27e7982633f3177850c646861b93a76d9af
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 fe7ab664a020ba0a54665f0d649726cd9ba2c400fe102942ee2da8513ae2cb93
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 db002024b8e102ec2139dfddb2742639f4123efd026ac0715aa52bd4d8a46254
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 52f3fdce67f870d8cef96d64504b26c9df1320460054f35824c1601cfd027d3d
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 1d9122127dc825a9d721349cd76c825dd6ff45de8f9770a510d89c28223c0408
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1036-257-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-791-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-314-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-248-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-25-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-420-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-30-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-454-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-156-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-597-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/1036-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2692-249-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-598-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-157-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-455-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-421-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-253-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-792-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-315-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2692-258-0x0000000000400000-0x0000000000408000-memory.dmp
        Download