Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

ORIGINAL INVOICE COAU7230734293.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.696500442057931
Filename:	ORIGINAL INVOICE COAU7230734293.exe
Filesize:	831488
MD5:	f6c2a4c4d05e7b76e17a5a7a191ddeb1
SHA1:	0d93776c5acfa7bb9a2ed5bc3ca46e0a525fa6bd
SHA256:	ece8d193afdcc6ec2c024e2441f7c0ce25801143573cacf71cf059de9a337275
SHA512:	4cbef24da9a5eba79c703a8cd56eb5eecd8bc991e069ed6cbf3ad7c592d672ead393a5d4b17ace2a99289ad4e00f3b94a0e534e7d857a26909c158a7f45fbc0a
SSDEEP:	12288:y1ZF8KZ3TwTg2gICk97UnmB218KAObF1idB8G5rmzZ89sFYSopnLsDloQLXoW:yyvnjUn78rOBe8rz+yMsDxLY
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)M................0.................. ........@.. ....................... ............@................................

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains potential unpacker	Data Obfuscation
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion
Modifies the context of a thread in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queues an APC in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion	System Information Discovery
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Checks if the current process is being debugged	Anti Debugging
Contains functionality for execution timing, often used to detect debuggers	Malware Analysis System Evasion, Anti Debugging
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Contains functionality to call native functions	System Summary
Contains functionality to read the PEB	Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
Found large amount of non-executed APIs	Malware Analysis System Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Binary may include packed or encrypted code	Data Obfuscation	Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ORIGINAL INVOICE COAU7230734293.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ORIGINAL INVOICE COAU7230734293.exe.log
Category:	dropped
Dump:	ORIGINAL INVOICE COAU7230734293.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734293.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.354384827676232
Encrypted:	false
Ssdeep:	24:MLUE4K5E4K1Bs1qE4qXKDE4KhKMaKhPKIE4oKnKoZAE4KzD1E4x84j:MIHK5HK1Bs1qHiYHKh6oPtHoAhAHKzhp
Size:	1216
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734293.exe

"C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734293.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5096
Target ID:	0
Parent PID:	5072
Name:	ORIGINAL INVOICE COAU7230734293.exe
Path:	C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734293.exe
Commandline:	"C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734293.exe"
Size:	831488
MD5:	F6C2A4C4D05E7B76E17A5A7A191DDEB1
Time:	20:12:29
Date:	01/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x6d0000
Modulesize:	860160
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734293.exe

"C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734293.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6828
Target ID:	2
Parent PID:	5096
Name:	ORIGINAL INVOICE COAU7230734293.exe
Path:	C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734293.exe
Commandline:	"C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734293.exe"
Size:	831488
MD5:	F6C2A4C4D05E7B76E17A5A7A191DDEB1
Time:	20:12:41
Date:	01/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xaf0000
Modulesize:	860160
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s

Details

Is windows:	true
Is dropped:	false
PID:	7608
Target ID:	3
Parent PID:	6828
Name:	RAVCpl64.exe
Path:	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
Commandline:	"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
Size:	16696840
MD5:	731FB4B2E5AFBCADAABB80D642E056AC
Time:	20:13:11
Date:	01/10/2024
Reason:	existingprocessinject
Reputation:	moderate
Is admin:	false
Is elevated:	false
Modulebase:	0x140000000
Modulesize:	16748544
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queues an APC in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection

C:\Windows\SysWOW64\RpcPing.exe

"C:\Windows\SysWOW64\RpcPing.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5808
Target ID:	4
Parent PID:	7608
Name:	RpcPing.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\RpcPing.exe
Commandline:	"C:\Windows\SysWOW64\RpcPing.exe"
Size:	26624
MD5:	F7DD5764D96A988F0CF9DD4813751473
Time:	20:13:11
Date:	01/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xbe0000
Modulesize:	40960
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

Details

Is windows:	true
Is dropped:	false
PID:	5072
Target ID:	5
Parent PID:	5808
Name:	explorer.exe
Class:	explorer
Path:	C:\Windows\explorer.exe
Commandline:	C:\Windows\Explorer.EXE
Size:	4849904
MD5:	5EA66FF5AE5612F921BC9DA23BAC95F7
Time:	20:15:45
Date:	01/10/2024
Reason:	existingprocessinject
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff79d2d0000
Modulesize:	4833280
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection

URLs

Name

Malicious

https://www.msn.com/en-us/money/retirement/americans-have-just-weeks-left-until-new-social-security-

unknown

https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd-dark

unknown

https://www.pollensense.com/

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV

unknown

https://assets.msn.com/weathermapdata/1/static/finance/crypto/icons/Cryptoc2112Image.png

unknown

https://www.msn.com/en-us/news/us/james-earl-jones-s-talents-went-far-far-beyond-his-magnificent-voi

unknown

https://www.msn.com/en-us/news/us/john-amos-patriarch-on-good-times-and-an-emmy-nominee-for-the-bloc

unknown

https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/hot.svg

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW

unknown

https://www.msn.com/en-us/lifestyle/relationships/my-dad-was-gay-but-married-to-my-mom-for-64-years-

unknown

https://api.msn.com:443/v1/news/Feed/Windows?

unknown

https://www.delish.com/restaurants/g33388878/diners-drive-ins-and-dives-restaurant-rules/

unknown

https://www.msn.com/en-us/feed

unknown

https://api.msn.com/P

unknown

https://www.msn.com/en-us/autos/other/24-used-sports-cars-that-are-notoriously-reliable-yet-crazy-ch

unknown

https://www.msn.com/en-us/lifestyle/shopping/iphone-16-first-look-while-we-wait-for-apple-intelligen

unknown

https://www.msn.com/en-us/sports/other/can-t-miss-play-vintage-rodgers-jets-qb-gashes-49ers-for-36-y

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW-dark

unknown

https://www.msn.com/en-us/tv/news/reacher-spinoff-the-untitled-neagley-project-starring-maria-sten-s

unknown

https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/

unknown

https://excel.office.com

unknown

https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Stock_In

unknown

https://www.msn.com/en-us/channel/source/AZ%20Animals%20US/sr-vid-7etr9q8xun6k6508c3nufaum0de3dqktiq

unknown

https://www.msn.com/en-us/weather/hourlyforecast/in-Miami%2CFlorida?loc=eyJsIjoiTWlhbWkiLCJyIjoiRmxv

unknown

http://schemas.micro

unknown

https://powerpoint.office.comEM

unknown

https://www.msn.com/en-us/news/crime/dick-van-dyke-forever-young/ar-AA1lDpRD

unknown

https://www.msn.com/en-us/news/us/sen-tuberville-blocks-promotion-of-lloyd-austin-s-top-military-aid

unknown

https://www.msn.com/en-us/sports/nba/don-t-know-what-to-say-phil-jackson-on-pau-gasol-and-matt-barne

unknown

https://www.msn.com/en-us/news/politics/jd-vance-spreads-outrageous-lie-about-hai

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gFtr-dark

unknown

https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNew

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb

unknown

https://www.msn.com/en-us/weather/forecast/in-Miami%2CFlorida?loc=eyJsIjoiTWlhbWkiLCJyIjoiRmxvcmlkYS

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3

unknown

https://www.msn.com/en-us/news/us/trump-repeats-false-claims-that-children-are-undergoing-transgende

unknown

https://api.msn.com/v1/news/Feed/Windows?activityId=30839BE1E99742A69F7CECEEBE3BA9D0&timeOut=5000&oc

unknown

https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlySunnyDay.svg

unknown

https://www.msn.com/en-us/money/savingandinvesting/rich-young-americans-are-ditching-the-stormy-stoc

unknown

https://excel.office.comrl

unknown

https://ntp.msn.com/edge/ntp?cm=en-us&ocid=widgetonlockscreenwin10&cvid=22fac781-5ff2-4c5e-9dca-d6b3

unknown

https://assets.msn.com/weathermapdata/1/

unknown

https://www.msn.com/en-us/money/retirement/middle-aged-americans-are-leaving-work-for-months-years-t

unknown

https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240908.1/Weather/W02_Most

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark

unknown

https://www.msn.com/en-us/health/other/the-5-carbs-you-should-be-eating-for-insulin-resistance-accor

unknown

https://www.msn.com/en-us/sports/nba/the-really-challenging-ones-were-heavy-and-mechanical-hakeem-ol

unknown

https://www.msn.com/en-us/health/other/vacuum-sealing-certain-foods-could-make-you-sick-here-are-7-t

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm

unknown

https://windows.msn.com:443/shellv2?osLocale=en-US&chosenMarketReason=ImplicitNew

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gD5m

unknown

https://www.msn.com/en-us/money/technology/new-tandem-solar-cells-break-efficiency-record-they-could

unknown

https://www.msn.com/en-us/tv/news/the-bold-the-beautiful-young-and-the-restless-more-get-premiere-da

unknown

https://www.msn.com/en-us/money/realestate/tour-of-original-1949-frank-lloyd-wright-home-in-michigan

unknown

https://stacker.com/lifestyle/truth-behind-5-unconventional-self-care-rituals-have-gone-viral-tiktok

unknown

https://www.msn.com/en-us/movies/news/all-37-new-movies-dropping-on-netflix-today/ss-AA1rxnU9

unknown

https://www.msn.com/en-us/travel/news/global-entry-vs-tsa-precheck-which-prescreen-will-get-you-thro

unknown

https://aka.ms/odirmB

unknown

https://www.msn.com/en-us/news/technology/spacex-set-to-launch-billionaire-s-private-crew-on-breakth

unknown

https://www.msn.com/en-us/foodanddrink/foodnews/happy-national-taco-day-here-are-the-best-deals-for-

unknown

https://powerpoint.office.com

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm-dark

unknown

http://www.foreca.com

unknown

https://outlook.com

unknown

https://www.msn.com/en-us/news/us/a-record-breaking-bass-has-been-caught-in-a-texas-lake/ss-AA1qf3tz

unknown

https://www.msn.com/en-us/news/politics/6-things-to-watch-for-when-kamala-harris-debates-donald-trum

unknown

https://www.msn.com/en-us/news/crime/dick-van-dyke-forever-you

unknown

https://www.msn.com/en-us/news/crime/tyreek-hill-s-traffic-stop-shows-interactions-with-police-can-b

unknown

https://api.msn.com/(

unknown

https://www.delish.com/cooking/best-road-trip-snacks/

unknown

https://assets.msn.com/weathermapdata/1/static/finance/taskbar/icons/index/svg/light/greenup.svg

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gFtr

unknown

https://api.msn.com/v1/news/Feed/Windows?$

unknown

https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlySunnyDay.png

unknown

https://stacker.com/stories

unknown

https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
ORIGINAL INVOICE COAU7230734293.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportORIGINAL INVOICE COAU7230734293.exe

Files

Processes

URLs

IOC Report
ORIGINAL INVOICE COAU7230734293.exe