Analysis
-
max time kernel
68s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2022 17:25
Static task
static1
Behavioral task
behavioral1
Sample
🏦 Invoice INV #24923.htm
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
🏦 Invoice INV #24923.htm
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
🏦 Invoice INV #24923.htm
-
Size
14KB
-
MD5
a4033bc0b6c643175875358adb71c718
-
SHA1
48218828c7c6e9270d0a421156d5be7c9ee6e8a4
-
SHA256
7dba8d842e0b08b638d9975ede9466418c650c490a566c21511325eb90d4b703
-
SHA512
93a649c92ed02b7c6d27d03509f63875488c073974e4db09ab93e3bf7f00ce4a1552cd2134d7e5f486f2895454f903540aa15375753b19e56cceebc34790f532
-
SSDEEP
384:2bAXgahOZrLb3mjmRZxIIU9xeoa/Pb6tlfL5wah0MyZ0mo+JgWwaThTZbKob0:2bigaUZrLb2jmRZxIICxeoa/Pb6tlfLP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3871950552" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30983096" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3880702438" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000ad09b95645e47b4da421e8fad53357d2017c2da0751953da3d44a7b033f245f1000000000e8000000002000020000000b7dfbfafd47be582560bcc8b7f6936c4bed43088fa4e0b10fcb661cd6f01c0962000000024ff7cacc51868286f34986e3d831e1335796b6ac0375179aaa9ab33c1ea0ac64000000033e3cfe8cd16cfd3b8416b7e6b41f7e6d1edfdf6577496899ab1f3f92244ba9f04fdf5d0778a28caff7db2df062c548bcf97913e531757e623f30768ef2a9da3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{122F4634-2FAC-11ED-89AC-EE6CABA3804C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000b71f2ec5a9769cc90130cd2d1b53bb08da07ccc4b911ab81d92cde68d131073b000000000e80000000020000200000002051b9855d208b26163a9b7b560a9bd3b1bf013bd36a88ba47ceec88709497922000000099410b20e8f18fdd31070bb6811e9a490493b031fd6e1b66a62a9db9488cdb6c4000000087f4250e840b6ac445470a130ad06b06ec82387d76d29aea1d892ce59f7e30385a861da1aa6a0340bc4beb7925cdb3d5dc7d380e1d1aa0917de187102125c329 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a10000000000200000000001066000000010000200000009130c8342918b83c476374ca9083bb69dc1884d2046f09841efa8048e36b9a22000000000e800000000200002000000067f36bd08fd9064e4e2482f8c98815cf71a0b43185cecb20e5a14831f8115709200000005653585b02218a29a9f4e380f2c99af43ed225fc29526f87999079af72db9439400000006309af72185efda00eefc01ef708804baf3f342a6cdc187f9d1355ec407ff52280e5cd0bd5008e705e46aa475b0795bd4e0052635efc7f1dffca583c89bccd0d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3872106444" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "369430135" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30983096" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0052b4e8b8c3d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a10000000000200000000001066000000010000200000003187f2cfc890a771aff2d059aeb755d3e0695446e1520400bce0a205857c3f59000000000e800000000200002000000090cfe43ff4bf438e7aba56f0f2d1156fd4ee532f43def5c12d10ba45d989851420000000ea6d8b14c61a43dd8aeb2f01c5056cda2530c4a7c3a3f163714c0f189763e2a640000000e61d7d7fff670cb13d013f2ac80a17b02c37e6aaaa195ca77666b8ccdf12c88234bf84396db52aea6c6e3bcfda623b2a4142f514c1760f57663cba70b0de1466 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f59ee8b8c3d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6053fbf4b8c3d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f943f9b8c3d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30983096" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000540cc692fa1c31c27fbf698e28723797710d831c6b373f1ca4a4efe61a1d2325000000000e8000000002000020000000b87aad58459a2d4458e8781a68b1d3a8c660705026cd82a9dd996ccdf55887fe2000000034f6cc01d0f33ea2ae58ef7647bd77f1fd2c265eab7e48458a8174b55f8919164000000065f5baa8f23e049f44a943e08aac0776daa4eaca0b5b14c20c4ac4f21d0b8401ae36b5ec7aab3629f60e09987588f26eca7709a09c777eccf9f1caa4b53c669f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09e82fbb8c3d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4784 iexplore.exe -
Suspicious use of SetWindowsHookEx 60 IoCs
pid Process 4784 iexplore.exe 4784 iexplore.exe 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4784 wrote to memory of 3384 4784 iexplore.exe 83 PID 4784 wrote to memory of 3384 4784 iexplore.exe 83 PID 4784 wrote to memory of 3384 4784 iexplore.exe 83
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\🏦 Invoice INV #24923.htm"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4784 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3384
-