Question Analyzing SCR file

[Yseurk]

Hello,

From another forum someone wanted to know if it's possible to understand what a .SCR file is trying to do. According to what he said, someone of his family downloaded the file which is hosted on a website and executed it thinking it was a PDF file (the hacker sent the link in the email). I wanted to take a look at this because I'm curious but I'm not at all into malware analysis

I just found out that malware can be hidden through this extension and I looked on the Internet on how to analyze this kind of file but didn't get a lot of answer.

I tried DnSPY however the result is not really interesting (I don't see any code), the only thing I was able to do with my current skills was to run this file on Hybrid-Analysis and check the result, I'm sharing the link if it can be relevant for you :

Free Automated Malware Analysis Service - powered by Falcon Sandbox

Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.

www.hybrid-analysis.com

This is not a malware removal request, I just want to know what I should look at in the Hybrid Analysis report and what tool could be useful in this case

Thanks guys !

PS : If needed I can provide you the link to download the .SCR file

 

[Sandbox Breaker]

Im looking at it now. SCR files can execute like an exe. Im looking and will post soon.

 

[Bot]

Hello,

From another forum someone wanted to know if it's possible to understand what a .SCR file is trying to do. According to what he said, someone of his family downloaded the file which is hosted on a website and executed it thinking it was a PDF file (the hacker sent the link in the email). I wanted to take a look at this because I'm curious but I'm not at all into malware analysis

I just found out that malware can be hidden through this extension and I looked on the Internet on how to analyze this kind of file but didn't get a lot of answer.

I tried DnSPY however the result is not really interesting (I don't see any code), the only thing I was able to do with my current skills was to run this file on Hybrid-Analysis and check the result, I'm sharing the link if it can be relevant for you :

Free Automated Malware Analysis Service - powered by Falcon Sandbox

Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.

www.hybrid-analysis.com

This is not a malware removal request, I just want to know what I should look at in the Hybrid Analysis report and what tool could be useful in this case

Thanks guys !

PS : If needed I can provide you the link to download the .SCR file

Hi there,

Analyzing a .SCR file can definitely be challenging, but there are a few approaches you can take to gain more insights. Let's start by looking at the Hybrid Analysis report you shared.

In the report, you'll find various sections that provide valuable information. Here are a few key areas to focus on:

1. AV Detection: Check whether any antivirus engines flagged the file as malicious. This can give you an initial idea of its nature.

2. File Analysis: Look at the extracted strings, PE imports/exports, and PE sections to gather useful information about the file's functionality and behavior.

3. Network Analysis: Examine any network traffic generated by the file. This can reveal communication with remote servers or the internet. Look for suspicious domains or IP addresses.

4. Behavior Analysis: Check the runtime behavior section, which highlights any system changes or actions performed by the file. Pay attention to file creation, registry changes, process creation, and network activity.

In addition to Hybrid Analysis, you may consider using other tools for further analysis. Here are a few suggestions:

1. PE Studio: This tool allows you to explore the internal components of a PE file and analyze its structure, imports, exports, and more.

2. Process Hacker or Process Explorer: These tools help you monitor the file's activity during execution. You can examine loaded DLLs, open handles, network connections, and more.

3. Wireshark: It's a powerful network traffic analysis tool that can help you capture and inspect network packets generated by the file.

Lastly, if you'd like more assistance with analyzing the .SCR file, feel free to share the download link. However, exercise caution when sharing potentially malicious files and ensure you take appropriate precautions.

Remember, analyzing malware can be risky, so it's important to conduct proper analysis in a controlled environment or seek assistance from seasoned malware analysts.

I hope this provides you with a starting point for your analysis. Good luck, and feel free to ask if you have any further questions!

 

[Sandbox Breaker]

- This file is a PE/DLL

- Has alot of anti debugging and evasion tactics
- Invalid Signature

- Opens channel via 443 to download zip file
- Writes Data to local zip file and deletes itself
- Bugged out Triage Sandbox Dynamic

- Alot of TTP's used

- Could get more into but but lack of time.
- File shows no GUI which further indicated their MO to stay hidden.
-Unique Code

Verdict: Malicious

 

[Shadowra]

Kaspersky and DeepInstinct : detected

 

[Sandbox Breaker]

Kaspersky and DeepInstinct : detected

Aren't some of you guys happy about that!

 

[Sandbox Breaker]

Hello,

From another forum someone wanted to know if it's possible to understand what a .SCR file is trying to do. According to what he said, someone of his family downloaded the file which is hosted on a website and executed it thinking it was a PDF file (the hacker sent the link in the email). I wanted to take a look at this because I'm curious but I'm not at all into malware analysis

I just found out that malware can be hidden through this extension and I looked on the Internet on how to analyze this kind of file but didn't get a lot of answer.

I tried DnSPY however the result is not really interesting (I don't see any code), the only thing I was able to do with my current skills was to run this file on Hybrid-Analysis and check the result, I'm sharing the link if it can be relevant for you :

Free Automated Malware Analysis Service - powered by Falcon Sandbox

Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.

www.hybrid-analysis.com

This is not a malware removal request, I just want to know what I should look at in the Hybrid Analysis report and what tool could be useful in this case

Thanks guys !

PS : If needed I can provide you the link to download the .SCR file

Some of the tools I use

 

[likeastar20]

Some of the tools I use
View attachment 278089

Bro, hook me up with that Joe Sandbox pro.

 

[Sandbox Breaker]

Intezer "Sandbox Broken". It wont finish the dynamic analysis after 3 tries. It says to "Call Their Experts" because the code is unique. But I am the expert... LMAO

 

[Sandbox Breaker]

Bro, hook me up with that Joe Sandbox pro.

Here you go.

 

[likeastar20]

On virustotal, for your sample, if you check the relations tab, i visited the url link and got to download the following file:

lumma | 86a046300c03712f3d07e9c0e50369937b77a7e8183f3e40574da5de7fc5ce6e | Triage

Check this lumma report malware sample 86a046300c03712f3d07e9c0e50369937b77a7e8183f3e40574da5de7fc5ce6e, with a score of 10 out of 10.

tria.ge

VirusTotal

VirusTotal

www.virustotal.com

 

[Sandbox Breaker]

Sophos ML Broken by this sample. Reputation is known but high TTD (Time to detect).

Sophos Dynamic Analysis in process.

Intezer cannot analyse the file.

 

[Sandbox Breaker]

- Sophos Dynamic Analysis offers very little for this sample.

 

[likeastar20]

On virustotal, for your sample, if you check the relations tab, i visited the url link and got to download the following file:

lumma | 86a046300c03712f3d07e9c0e50369937b77a7e8183f3e40574da5de7fc5ce6e | Triage

Check this lumma report malware sample 86a046300c03712f3d07e9c0e50369937b77a7e8183f3e40574da5de7fc5ce6e, with a score of 10 out of 10.

tria.ge

VirusTotal

VirusTotal

www.virustotal.com

View attachment 278093

the file i linked is not detected by f-secure, only url block

 

[Sandbox Breaker]

Xcitium and Microsoft Threat Experts are manually looking at the file. Lets see how their verdicts land. Should be exiting.

Ill post results ASAP.

 

[Sandbox Breaker]

Ok so here is Microsoft Deep Analysis(SAND BOX). Still waiting on their Human Analyst.

Xcitium Broken but waiting on their Human Analysts also.

 

[struppigel]

Hello,

From another forum someone wanted to know if it's possible to understand what a .SCR file is trying to do. According to what he said, someone of his family downloaded the file which is hosted on a website and executed it thinking it was a PDF file (the hacker sent the link in the email). I wanted to take a look at this because I'm curious but I'm not at all into malware analysis

I just found out that malware can be hidden through this extension and I looked on the Internet on how to analyze this kind of file but didn't get a lot of answer.

I tried DnSPY however the result is not really interesting (I don't see any code), the only thing I was able to do with my current skills was to run this file on Hybrid-Analysis and check the result, I'm sharing the link if it can be relevant for you :

Free Automated Malware Analysis Service - powered by Falcon Sandbox

Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.

www.hybrid-analysis.com

This is not a malware removal request, I just want to know what I should look at in the Hybrid Analysis report and what tool could be useful in this case

Thanks guys !

PS : If needed I can provide you the link to download the .SCR file

Hi there.

SCR is just an extension, the file itself is a Portable Executable .NETCore App. You can see from the .pdb that it is compiled with a singlefilehost stub. That means when creating this executable, the person decided to compile it with the .NET environment into one executable.
DnSpy does not work here because it cannot open .NETCore App singlefiles. You can open it with ILSpy, though.

The file is a rather simple downloader, which is also why no one detects a specific family here. This is the full code:

The more interesting part will be the downloaded file. The levelcomputer.zip is 192 MB in size, so VT is not fond of it. I am gonna check if I can remove some bloat to share the file.

 

[Sandbox Breaker]

Hi there.

SCR is just an extension, the file itself is a Portable Executable .NETCore App. You can see from the .pdb that it is compiled with a singlefilehost stub. That means when creating this executable, the person decided to compile it with the .NET environment into one executable.
DnSpy does not work here because it cannot open .NETCore App singlefiles. You can open it with ILSpy, though.

The file is a rather simple downloader, which is also why no one detects a specific family here. This is the full code:

View attachment 278105

The more interesting part will be the downloaded file. The levelcomputer.zip is 192 MB in size, so VT is not fond of it. I am gonna check if I can remove some bloat to share the file.

Thats the payload that's got me curious. I'm just throwing this sample at all the tech out there to see what jives. If you have the time to dissect it... Please do

Also noted to MS that it was a malicious downloader

 

[Sandbox Breaker]

File Never Seen on VT
After Trying to interact with the file in Triage:

Looks like luma stealer.

lumma | 96f35b8f39ac3630a9c58f2621bb0cfce873b69c5a1c2a40612130076e07a533 | Triage

Check this lumma report malware sample 96f35b8f39ac3630a9c58f2621bb0cfce873b69c5a1c2a40612130076e07a533, with a score of 10 out of 10.

tria.ge

Further Analysis is Welcome

 

[likeastar20]

He is talking about the payload that the downloader fetched and drops.​

4cea7ae85c87ddc7295d39ff9cda31d1​

File Never Seen on VT
After Trying to interact with the file in Triage:
View attachment 278115
View attachment 278117View attachment 278118
Looks like luma stealer.

levelcomputer.exe? It's in my first post with the VT and hatching triage link