Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
12-04-2021 17:38
Static task
static1
Behavioral task
behavioral1
Sample
Dringende Bestellung Zitat CTX88467638,pdf.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Dringende Bestellung Zitat CTX88467638,pdf.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
Dringende Bestellung Zitat CTX88467638,pdf.exe
-
Size
769KB
-
MD5
66525016cb1f9420e5e5c178082346cf
-
SHA1
afe3c32389f0009959d9de94feb11e2bf1f1abd7
-
SHA256
0f3cac160b09665561487322c11c5ee1ad0eb221b32edfecf1fe01d5b5f278f7
-
SHA512
26eefff0cdc04747ccfb432c0154ec271b2b9ad6ead105fe0f9cd07ba08df05f13d15771eafaeec9912acf02b289ecde134d56c5c398198c9c256b6580058d7c
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Dringende Bestellung Zitat CTX88467638,pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ntozkw = "C:\\Users\\Public\\Libraries\\wkzotN.url" Dringende Bestellung Zitat CTX88467638,pdf.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 668 1500 WerFault.exe dialer.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 668 WerFault.exe 668 WerFault.exe 668 WerFault.exe 668 WerFault.exe 668 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 668 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 668 WerFault.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Dringende Bestellung Zitat CTX88467638,pdf.exedialer.exedescription pid process target process PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1640 wrote to memory of 1500 1640 Dringende Bestellung Zitat CTX88467638,pdf.exe dialer.exe PID 1500 wrote to memory of 668 1500 dialer.exe WerFault.exe PID 1500 wrote to memory of 668 1500 dialer.exe WerFault.exe PID 1500 wrote to memory of 668 1500 dialer.exe WerFault.exe PID 1500 wrote to memory of 668 1500 dialer.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dringende Bestellung Zitat CTX88467638,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Dringende Bestellung Zitat CTX88467638,pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialer.exeC:\Windows\System32\dialer.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1483⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/668-67-0x0000000000000000-mapping.dmp
-
memory/668-73-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1500-65-0x0000000000000000-mapping.dmp
-
memory/1500-72-0x0000000010540000-0x0000000010564000-memory.dmpFilesize
144KB
-
memory/1500-71-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1500-69-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1500-68-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1640-59-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/1640-60-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1640-62-0x0000000000280000-0x000000000029A000-memory.dmpFilesize
104KB