Analysis
-
max time kernel
93s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 17:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
INVOICES.bat.exe
Resource
win7-20241010-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
INVOICES.bat.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
INVOICES.bat.exe
-
Size
77.0MB
-
MD5
7832c592d6a2e403b8323da6b238e789
-
SHA1
1b0a4f33ed26e9284d3a93b7a119a895eb12c0f2
-
SHA256
3e4a1645de56b2595ebd83686945f60b1fc4242d9dada664ca9ef9d6c3f8659f
-
SHA512
aa38396cb18fb5c7cae17413f42b6d3ee15adc82dc5a02513bd430c27f774433186f781cada07d6709d93448404fbdae179cf018144fbf2bfff1405330cbeb09
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6Fac1HJWnny4sd09pWiszrWY:Xu0c++OCvkGs9FacdJ6VpWiXY
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4684 1488 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INVOICES.bat.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1488 INVOICES.bat.exe 1488 INVOICES.bat.exe 1488 INVOICES.bat.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1488 INVOICES.bat.exe 1488 INVOICES.bat.exe 1488 INVOICES.bat.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1488 wrote to memory of 3656 1488 INVOICES.bat.exe 83 PID 1488 wrote to memory of 3656 1488 INVOICES.bat.exe 83 PID 1488 wrote to memory of 3656 1488 INVOICES.bat.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICES.bat.exe"C:\Users\Admin\AppData\Local\Temp\INVOICES.bat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\INVOICES.bat.exe"2⤵PID:3656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 6922⤵
- Program crash
PID:4684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1488 -ip 14881⤵PID:1264