Overview

overview

10

Static

static

7

LETTER.scr

windows7-x64

7

LETTER.scr

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LETTER.scr
  • Size 29KB
  • Sample240721-dpc69stcra
  • SHA256 fff81cc8b1c1277ff1f6bc5b3a0c9a1c997e7048b2feed7c6e053da0e3f5686a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LETTER.scr
    "C:\Users\Admin\AppData\Local\Temp\LETTER.scr" /S
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4392
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:436

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9X9HPJHY\default[8].htm
        • Size 313B
        • SHA256 7bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660
        • MD5 SHA1 SHA512
        Submit Download

        results[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9X9HPJHY\results[2].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        searchUXD2R02L.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9X9HPJHY\searchUXD2R02L.htm
        • Size 134KB
        • SHA256 b78be528a3a4faa1d74a7675a1abf7c8edd9a01abf898632ab3b40bc2386c785
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\default[2].htm
        • Size 312B
        • SHA256 3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432
        • MD5 SHA1 SHA512
        Submit Download

        default[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\default[8].htm
        • Size 309B
        • SHA256 e397cc793fd29a7e5c2d4bc5110b0be997769caf679b25805ed6c70238a0b81c
        • MD5 SHA1 SHA512
        Submit Download

        search0Y5UV23X.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\search0Y5UV23X.htm
        • Size 115KB
        • SHA256 8a35a0d5545e66c8dc8b0d500592dbcabacdf909f48e5eb6c6293e6944037819
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search2OP5XRJC.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\search2OP5XRJC.htm
        • Size 103KB
        • SHA256 f81b5a934cf6e5568753cf06d5b1c2ba1fe7b3e5bb67f99ae38e525a32ee5dda
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchGEYEHYA1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\searchGEYEHYA1.htm
        • Size 122KB
        • SHA256 509362f1fdef37d4aa6f4c629aacf7a652821376ce23569538c4a20197f0cf90
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchLYHI3QAT.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\searchLYHI3QAT.htm
        • Size 142KB
        • SHA256 f41eafba8973188a543889d116a0694b9520a3640b8cd21d429fa1d88aa2d64e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchMO11494F.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\searchMO11494F.htm
        • Size 104KB
        • SHA256 81a7d03498e857f451e3dbf49b188f07eed14489863247704046002bc94f1020
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYE6T2W7V.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\searchYE6T2W7V.htm
        • Size 145KB
        • SHA256 6ff87aa71ac0307e63b758019056bc4fef0074aea2ed04a949f38662d8486d58
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\search[10].htm
        • Size 115KB
        • SHA256 71ed9eef8d1ffbb5bec8fd5c41948912d07aed7692f2289e44966f2d0d47c6f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\search[6].htm
        • Size 118KB
        • SHA256 6f9cb3ec3d17283dd83afb15bc2577f1af17969c0673310d7dcec5f79ffb7756
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CXE8T2AA.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SN5O4Q15\CXE8T2AA.htm
        • Size 176KB
        • SHA256 f03ff5b2cdf0ce6094305d87583ca0f9ea6989109ae87204ddd0f96825306b1d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SN5O4Q15\default[4].htm
        • Size 309B
        • SHA256 bdb7ac94dc916af2d7784a5c147167ce13e49d12baa9b8f3cccaf33e29419a7c
        • MD5 SHA1 SHA512
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SN5O4Q15\results[3].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SN5O4Q15\results[4].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        search0N7CLVZ8.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SN5O4Q15\search0N7CLVZ8.htm
        • Size 173KB
        • SHA256 54b57bb3bab79cec29e6617714d00ae11c4c701411d3b323924eeb5ff8f186ba
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SN5O4Q15\search[1].htm
        • Size 137KB
        • SHA256 ad76ae98d9eaff5e25233c7181dbaa6899a4c135662b51f04b61ffc93565ce73
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\default[1].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        search2H8UR3Z2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\search2H8UR3Z2.htm
        • Size 115KB
        • SHA256 10fdc94fe92aeabf2d713fd1fe0df66a562278c522d09a9b7496ca2a38d01010
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search537NPODQ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\search537NPODQ.htm
        • Size 128KB
        • SHA256 e7b3e208653a6d2c515ed58ddead655f97a5776450f045b0f897ba28890f6c7c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search7TOQM8XU.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\search7TOQM8XU.htm
        • Size 144KB
        • SHA256 06a20be99f202861562477d0e55acc5973c6b446fbc754093b3f307ca1a63b0d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search7VG8P01X.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\search7VG8P01X.htm
        • Size 162KB
        • SHA256 d50115fd283adb7fc77bafcf131f84c372d946f8d143d816fe1d9cf4f0ab70a7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchDEO1WXMW.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\searchDEO1WXMW.htm
        • Size 134KB
        • SHA256 a5b03d73ba17d3f8af244d71a30854295e0ed8deea842214a0bb5db1f2c38cd6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchF87HJ9S4.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\searchF87HJ9S4.htm
        • Size 113KB
        • SHA256 5afc36f824f6eb5163c96ac13c202e26eee3f3b70283aa57a995369f7475d1f1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchMO3OAF2R.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\searchMO3OAF2R.htm
        • Size 122KB
        • SHA256 d4c1dcf460d6072cb01574633d6fc7fc85d12de4b91e21d8a3c24dd798137945
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchWQBQSX6C.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\searchWQBQSX6C.htm
        • Size 149KB
        • SHA256 49b83f9b6601d059b89c2914efa2034bceafa3b560618ee60a143f40a2e719be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\search[2].htm
        • Size 123KB
        • SHA256 80ee91db0d2230970cf82082b8d6f80bd0657de0e5ac37ad55df3142f4d294e6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\search[4].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\search[5].htm
        • Size 103KB
        • SHA256 64c28aec4fe44284c21101f933783d99ff85336801afeed298bfc87ca75837ec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W4K3IOC2\search[9].htm
        • Size 147KB
        • SHA256 f63c1d5e0e47223644d77a6cc506c6af7ea83fa85a8b72abe0b92806b8916b84
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp194F.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp194F.tmp
        • Size 29KB
        • SHA256 f5d210592f11910218b23c45d9a2e52bbb13bb304a4c52217d02b34e5ccbbb8b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 695070ffe8eb0cc6e5aa173586df155e4cb16e2a0ac8d93b7e2ddddc37467829
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 13cb66694cea53d88412f40944a7c978fa9f6b268aa14f1d475e42cbac1b9994
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 e2f7b4aeef0ad2430464ddb93656e33e2a862f6a6d7170a0288a110c6df8f7cd
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 6c9e9a0e3a31eb207782a0dcb03d77a20545333bdaa5bd774373126fa2b53a4a
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 384B
        • SHA256 73c8d7bee247ebf33761159a07a1f466b89d0f5c8a8ca99db373b67172d015b9
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/436-165-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-234-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-469-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-308-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-1024-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-893-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-739-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-229-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-227-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-540-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/436-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4392-226-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-892-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-164-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-25-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-233-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-738-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-1023-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-307-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-468-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4392-539-0x0000000000500000-0x0000000000510200-memory.dmp
        Download