Analysis
- user interaction
yes - max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/10/2026, 16:46
Behavioral task
behavioral1
Sample
PAYMENT_CONFIRMATION.svg
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target PAYMENT_CONFIRMATION.svg
- Size 481B
- Sample261005-vaaahazybw
- SHA256 b8c7eab56d22ff4e788280278969347607b04d89af58035b4ccf031b6763ceed
- MD5 776c89299c3cc4934e185081a6779bf8
- SHA1 cc861d6e4638b88063e895f4457ce54a0f966e08
- SHA512 67e03f1f0dd59ee2d8f9bbfed6502b73d8f0564ccf9d8e798d999241b7cf6b023e740c6753594f2e3916fcc68287a6b45c9a0d1ccffc6a3b3704dcd745530490
- TLSH T180F0E2E99A8EC85011B4CA55BAF4EC08E193808746C48889F8E468669731AEA1A0329C
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0024993f154dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282409" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "816868661" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "820149756" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497983785" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282409" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a000000000200000000001066000000010000200000005c6c3ebd3791aeef2d1341a88611210a1375346183aea1791dfaeaaaca5d4554000000000e8000000002000020000000ff6f42aef6606d0a42ed685dde4208719c1c4babff0c85c4766b85210d198ce020000000229db490ca753d28c4b9abeac0b2004ee55c8eb4dffb8d69f82fc32f1c7ccbed4000000078d868ba7ff8428fbeca6d5b0bcf0cfa582eb366005038b3605a888ae54a938f8c58dde1a99cbde7ff8ab573ac9d3b07d4f9720995ab448d2ce64218b0415bba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5BFB3518-C0DC-11F1-8FDF-66DCEFAAD7CC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a0000000002000000000010660000000100002000000070642976b1f3dfece63b23a27077f8e6524690b839ec64b0c11fd8eb707d2d7e000000000e8000000002000020000000f5b2e0e71867e2cd59c5cc45d2323bf8a3d80fab22eb022ae3e17f40eded3cde20000000089061a8b0024c0073c6a4f6e390012e5ff8ec8c3be9f59e341656d185a78fb840000000feb60698aff5977ed71716d2554946d16e1b89a3a3ac970a68cdfd33a1f29464edcce955141680e2b990f26f63fcfdeeffe9893d810aafea14e678f339503653 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0204493f154dd01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1880 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1880 iexplore.exe 1880 iexplore.exe 5848 IEXPLORE.EXE 5848 IEXPLORE.EXE 5848 IEXPLORE.EXE 5848 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1880 wrote to memory of 5848 1880 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\PAYMENT_CONFIRMATION.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5848
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 12680d63a74eee47549b4639aaf6eda1c3f7f2508602d7ec01c48d7ae144ed5b
- MD5 e50c033cf69dca92caea10f9cab47cab
- SHA1 4e64e2e06a8c39ae35e34a827a9a32c404d5a87c
- SHA512 57286a6bfe6d56e35b272765eff4310609aa502329e1b5877059b071a40e08d6ca14662beecdcb5145c014ae2fc6ae8f6bb290f42b22acb36710448bd6c2780c
- TLSH T1A2F05462DCDCE5526D9130EC102C5E61303074FB505A8407A13C0FF20EA17373D08439
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 a6f06305b790adfe3908bdb65f378518d259c3a68fb18f4d20d31a8cc8522500
- MD5 e56cb478fed049177be263bd61b5017b
- SHA1 c2994eb0ed4b14f056ef554c0bcd08c403b9d00c
- SHA512 e6b2d4b9db5e1b9d8c83c4035b7dd89b3ca5a04be1b43918601a5600174be182b860b6591ec718bb6dcae66b92ac3d8ed1baeeacd0cf897f7c33d277e2857dae
- TLSH T1C0E0C03415FF411FF4F4E4398BC8742655DEF1230628D3B86DC59B04A303A00DC42925
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8OSE262\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH