| File name: | SPAM.7z |
| Full analysis: | https://app.any.run/tasks/dcd69eb8-6e8a-4a67-a2c6-db22aeaf2dc1 |
| Verdict: | Malicious activity |
| Analysis date: | June 02, 2024, 08:56:25 |
| OS: | Ubuntu 22.04.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 657A58FBF3DD0BB1BB07C32392F5226D |
| SHA1: | C74DDEB0F16F0F3B4AE4331832214BAF957FFFA9 |
| SHA256: | F37806A77EF9FF9C67DC814F1D866B723B107EE3E0666B3FAD4119FFEF022FE8 |
| SSDEEP: | 196608:S1UDcAI900BW2NQkQkV4IjM2OKrs4BTUH:S6Do9DBWsZd0Krs4ZUH |
MALICIOUS
No malicious indicators.SUSPICIOUS
Checks DMI information (probably VM detection)
- systemd-hostnamed (PID: 11988)
Executes commands using command-line interpreter
- thunderbird (PID: 12235)
Reads /proc/mounts (likely used to find writable filesystems)
- thunderbird (PID: 12105)
- thunderbird (PID: 12488)
- thunderbird (PID: 12795)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
Total processes
489
Monitored processes
276
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 11953 | /bin/sh -c "DISPLAY=:0 sudo -iu user file-roller /tmp/SPAM\.7z " | /bin/sh | — | any-guest-agent |
User: user Integrity Level: UNKNOWN Exit code: 12879 | ||||
| 11954 | sudo -iu user file-roller /tmp/SPAM.7z | /usr/bin/sudo | — | sh |
User: user Integrity Level: UNKNOWN Exit code: 12879 | ||||
| 11955 | file-roller /tmp/SPAM.7z | /usr/bin/file-roller | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 12879 | ||||
| 11956 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 11970 | /usr/lib/p7zip/7z l -slt -bd -y -- /tmp/SPAM.7z | /usr/lib/p7zip/7z | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 482 | ||||
| 11988 | /lib/systemd/systemd-hostnamed | /lib/systemd/systemd-hostnamed | — | systemd |
User: root Integrity Level: UNKNOWN Exit code: 12236 | ||||
| 11989 | /usr/libexec/gvfsd-network --spawner :1.6 /org/gtk/gvfs/exec_spaw/1 | /usr/libexec/gvfsd-network | — | gvfsd |
User: user Integrity Level: UNKNOWN | ||||
| 12005 | /usr/libexec/gvfsd-smb-browse --spawner :1.6 /org/gtk/gvfs/exec_spaw/2 | /usr/libexec/gvfsd-smb-browse | gvfsd | |
User: user Integrity Level: UNKNOWN Exit code: 482 | ||||
| 12011 | /usr/libexec/gvfsd-dnssd --spawner :1.6 /org/gtk/gvfs/exec_spaw/3 | /usr/libexec/gvfsd-dnssd | — | gvfsd |
User: user Integrity Level: UNKNOWN | ||||
| 12019 | /usr/lib/p7zip/7z x -bd -bb1 -y -o/home/user -- /tmp/SPAM.7z | /usr/lib/p7zip/7z | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 12019 | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 11955 | file-roller | /home/user/.local/share/recently-used.xbel.N0HDO2 | — | |
MD5:— | SHA256:— | |||
| 12019 | 7z | /home/user/SPAM/'Furiosa'. Oceniamy film - Filmweb (noreply@newsletter.filmweb.pl) - 2024-05-24 1830.eml | — | |
MD5:— | SHA256:— | |||
| 12019 | 7z | /home/user/SPAM/(Special Invite) Exclusive access to our community of sexy single women - 'Freya' (freya@lovehotties.com) - 2024-05-30 1026.eml | — | |
MD5:— | SHA256:— | |||
| 12019 | 7z | /home/user/SPAM/- Abraham Ovall (aovalluqc@outlook.de) - 2024-06-01 0047.eml | — | |
MD5:— | SHA256:— | |||
| 12019 | 7z | /home/user/SPAM/- Ashley 💣Kamen (dbcwcqkldjmd@hotmail.com) - 2024-05-17 1243.eml | — | |
MD5:— | SHA256:— | |||
| 12019 | 7z | /home/user/SPAM/- Brandy Castellano (jvnytuphwcbm@outlook.com) - 2024-05-20 2320.eml | — | |
MD5:— | SHA256:— | |||
| 12019 | 7z | /home/user/SPAM/- Caden Muench (cadenquiomuench@outlook.com) - 2024-05-19 0408.eml | — | |
MD5:— | SHA256:— | |||
| 12019 | 7z | /home/user/SPAM/- Cash Golida (cash1sgolida@outlook.fr) - 2024-05-31 2001.eml | — | |
MD5:— | SHA256:— | |||
| 12019 | 7z | /home/user/SPAM/- Charlton Lawyer (charltonlawyer126@outlook.fr) - 2024-05-31 0531.eml | — | |
MD5:— | SHA256:— | |||
| 12019 | 7z | /home/user/SPAM/- David James (davidjames8sl@outlook.co.il) - 2024-05-17 0112.eml | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
105
DNS requests
91
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.48:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
12926 | chrome | GET | 302 | 144.217.85.60:80 | http://eu87g15u8a91s7t0hav.idmeucuscabecirc.ru/cbk5e6cwoeybx?rvQmhh5aYFMZ1WZQh0JfRhTyuM8%2FtIIZt93G6T%2FSgBnPmjxdXI4DEvjf7XnjvCB46EL3pmGcqNPxzSSieCqFRyFzO%2BY9LltWoPElrGeVvZxTRtIpVjcJC8VjZzWBTF5aP3kfO6KCnuwpinHLa1YY7xZOrcoHqTU5LBAstrkySHE%3D | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
470 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.190.48:80 | — | Canonical Group Limited | GB | unknown |
— | — | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
12005 | gvfsd-smb-browse | 192.168.100.255:137 | — | — | — | whitelisted |
12105 | thunderbird | 13.224.189.107:443 | services.addons.thunderbird.net | AMAZON-02 | US | unknown |
12284 | chrome | 64.233.166.84:443 | accounts.google.com | — | — | unknown |
12284 | chrome | 151.101.129.91:443 | google-ohttp-relay-safebrowsing.fastly-edge.com | — | — | unknown |
12284 | chrome | 216.58.206.35:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
12284 | chrome | 104.22.27.130:443 | winnicalidla.pl | — | — | unknown |
12236 | chrome | 239.255.255.250:1900 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
api.snapcraft.io |
| unknown |
119.100.168.192.in-addr.arpa |
| unknown |
connectivity-check.ubuntu.com |
| unknown |
services.addons.thunderbird.net |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
system.hypemail.pl |
| unknown |
google-ohttp-relay-safebrowsing.fastly-edge.com |
| unknown |
system.redsales.pl |
| unknown |
winnicalidla.pl |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Global content delivery network (unpkg .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Global content delivery network (unpkg .com) |
12926 | chrome | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |
12926 | chrome | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com) |
12926 | chrome | Not Suspicious Traffic | INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net) |