Overview
overview
10Static
static
invoice.vhd
windows7-x64
3invoice.vhd
windows10-2004-x64
3$RECYCLE.B...IB.exe
windows7-x64
$RECYCLE.B...IB.exe
windows10-2004-x64
$RECYCLE.B...S1.bat
windows7-x64
1$RECYCLE.B...S1.bat
windows10-2004-x64
1$RECYCLE.B...IB.exe
windows7-x64
9$RECYCLE.B...IB.exe
windows10-2004-x64
8$RECYCLE.B...S1.bat
windows7-x64
8$RECYCLE.B...S1.bat
windows10-2004-x64
8$RECYCLE.B...op.ini
windows7-x64
1$RECYCLE.B...op.ini
windows10-2004-x64
1System Vol...meGuid
windows7-x64
1System Vol...meGuid
windows10-2004-x64
1System Vol...gs.dat
windows7-x64
3System Vol...gs.dat
windows10-2004-x64
3invoice-041.js
windows7-x64
10invoice-041.js
windows10-2004-x64
10Static task
static1
Behavioral task
behavioral1
Sample
invoice.vhd
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
invoice.vhd
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
$RECYCLE.BIN/$IHL25IB.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
$RECYCLE.BIN/$IHL25IB.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
$RECYCLE.BIN/$IJXIQS1.bat
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
$RECYCLE.BIN/$IJXIQS1.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
$RECYCLE.BIN/$RHL25IB.exe
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
$RECYCLE.BIN/$RHL25IB.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
$RECYCLE.BIN/$RJXIQS1.bat
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
$RECYCLE.BIN/$RJXIQS1.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
$RECYCLE.BIN/desktop.ini
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
$RECYCLE.BIN/desktop.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
System Volume Information/IndexerVolumeGuid
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
System Volume Information/IndexerVolumeGuid
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
System Volume Information/WPSettings.dat
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
System Volume Information/WPSettings.dat
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
invoice-041.js
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
invoice-041.js
Resource
win10v2004-20220812-en
General
-
Target
1b12c5d8-6942-2d7f-6704-aba706937dfe.eml
-
Size
8.2MB
-
MD5
7d3a506775ce7a6ff3032240686a0aee
-
SHA1
fbd461c0a5638c7a137300fabf75ef73de51075f
-
SHA256
5d702d1a61995f9c453734735fb7e3feb7578211b45aff9adb77dec4f6f61ffd
-
SHA512
7e4b74815b5ad889c01efc4a25d8fe07d904833c40c16bfdb4e1ab163c4e7baaa94d3696892a6af758ef419f50d270498f018b3c0e324febb0c4a951c8208c5e
-
SSDEEP
24576:NOz/y51YBfxe6D/MPz30x44a41V4444CA44E44X49444rXX44cr4U4O4OIh:se1e4
Malware Config
Signatures
Files
-
1b12c5d8-6942-2d7f-6704-aba706937dfe.eml.eml
-
https://www.freepnglogos.com/uploads/usps-png-logo/bridgeport-apartments-usps-png-logo-2.png]
-
-
email-html-2.txt.html
-
email-plain-1.txt
-
invoice.vhd.vhd
-
$RECYCLE.BIN/$IHL25IB.exe
-
$RECYCLE.BIN/$IJXIQS1.bat
-
$RECYCLE.BIN/$RHL25IB.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 175KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$RECYCLE.BIN/$RJXIQS1.bat.bat .vbs
-
$RECYCLE.BIN/desktop.ini
-
System Volume Information/IndexerVolumeGuid
-
System Volume Information/WPSettings.dat
-
invoice-041.js.js