Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
16-09-2022 13:00
Static task
static1
Behavioral task
behavioral1
Sample
Musterkatalog 2022.pdf.exe
Resource
win7-20220901-en
General
-
Target
Musterkatalog 2022.pdf.exe
-
Size
441KB
-
MD5
f05688143f41772720ace022f048373a
-
SHA1
a31f1b5d3dc4de99622a0bd8d31b6e88f2c34cea
-
SHA256
b7097860f2bbfcff38f49c8fb3b9e55c4dcc339202a3ab3b141f0fd13eab2b86
-
SHA512
454c8ac0177246292b0f8fb3d07cb9244b2c3f1ef5acb4ff9833120371a20b0cacc92218d74ba58a75c9f76482e0bddae0a4e7d4c3e36bf4396148b65c3f4544
-
SSDEEP
6144:tpznbUTNWFObvPYU0UwBPnLrKx72+WQrIKPRFCabWsLK4KieG:t9DFcvB0UuPnLr672+WQrFCabWsLKFK
Malware Config
Extracted
formbook
dwdp
jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=
ke1Wv1l26dZZxDikX9dU3s6k8+w=
+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==
GHXPhYzwXcKgZwqBb/kejm7rfobj
yalW64iE8+aXs70=
MD83dBR0KSF4fizgRhAM
Xti3uNm2JDWgssPgRhAM
X7gYbv5uJhpvjdI0Qg==
ydxGznbNJ3tCCLAX4arq4nweMuQ=
Ca+fvtST8OBbosPgRhAM
kG1QegD8mU/E/hLw1t0=
g9FFFjEC5C2IvR/BhbSrpw==
PCkpeg38W0aPdg1rav1DFnVASw==
vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7
G7WYirSZS9EYob8=
WbEWaOVIAPlSNNc4LsfL53weMuQ=
hnyAvEY4n3rTKS4g5mHKxR0=
JN7b0uCqVrQydMl7JNw=
XTki/RASDK6BCW0q8sU=
DQMBWA9wJyOKqqGSmGHKxR0=
nJmd4HyE8g0mfqI=
6dfYKMvIhrcUa8l7JNw=
rUlBWHBUCn1c8CQA8PXzeVzrfobj
58Kt4lz9o6QF
cL0w6PZmKlfE8RoS5TDZMyH0
2Lyico9qDju7nr2X
b374NM2N3g0mfqI=
bVEtbg0KgZj533zw7n631TknAk9sHT4=
ZuNZIBhiw04fmLueUhJMOeZf+ilfHy8=
GBxm5ITLhl5XQOlF4DDZMyH0
6zulYX1WAoNl0vXmhkauyDcT8kdhBi0=
pZeodP1cQf3SyQtfUQ==
wsAZpF7WPbCJEDQt62HKxR0=
1A1vRW5BJHzzXsl7JNw=
ubG/Epl9PIb7Xtot5mHKxR0=
ExcR7v/y1XBW6wjRx722VlHrfobj
tvtepCyscmPvrsCd
QM28Ja5N8A0mfqI=
/UuzOsQY+8WgidZJSA==
pk0ZWgUKfY4STnqImJ/ZMyH0
0/4UFT1EL86yidZJSA==
mLH6x//qm+bQvFjJpKLZMyH0
yFLYqcdEtlNQ+ovii1iGrw==
CQUKN8PsFUSwtsPgRhAM
d1JHSBRgO1zvrsCd
EX/80uRL4gztasl7JNw=
VjpQXmhQEpTVRtNISg==
icUPYOYDaj6XzNmfS4jiZkwfc3aMc3m7
YbwogyCIP+zDssTgRhAM
liKeXXL3XdW2idZJSA==
DpZxgK191uNXWDttEgV8qQ==
yCQSTlcofmfvrsCd
0HdbxU5gWZTXChULh3d8uA==
wulP5XjDdoXs8AHdilE/176mQyLJgQ==
ftUzeAdbDsGQTdNB8DTZMyH0
LyYshzZrwiL1rjbYaRIb
FxUI3fDvJSiI4+zJw9Q=
tso/3IMC7yKg1ff08AVG7tGEWT+1Rdqz
2R+QH6SM7g0mfqI=
lshW53vMIIyAR+95LXaOoAb2U3WMc3m7
JGv37fpftjotxk/Fi1iGrw==
QTswdBsMz2xN4nHfi1iGrw==
ATODSoRwHZylR6dFP0+MJBU=
TWfBPutYujsoxlzNi1iGrw==
fedefarmatour.online
Extracted
xloader
3.8
dwdp
jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=
ke1Wv1l26dZZxDikX9dU3s6k8+w=
+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==
GHXPhYzwXcKgZwqBb/kejm7rfobj
yalW64iE8+aXs70=
MD83dBR0KSF4fizgRhAM
Xti3uNm2JDWgssPgRhAM
X7gYbv5uJhpvjdI0Qg==
ydxGznbNJ3tCCLAX4arq4nweMuQ=
Ca+fvtST8OBbosPgRhAM
kG1QegD8mU/E/hLw1t0=
g9FFFjEC5C2IvR/BhbSrpw==
PCkpeg38W0aPdg1rav1DFnVASw==
vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7
G7WYirSZS9EYob8=
WbEWaOVIAPlSNNc4LsfL53weMuQ=
hnyAvEY4n3rTKS4g5mHKxR0=
JN7b0uCqVrQydMl7JNw=
XTki/RASDK6BCW0q8sU=
DQMBWA9wJyOKqqGSmGHKxR0=
nJmd4HyE8g0mfqI=
6dfYKMvIhrcUa8l7JNw=
rUlBWHBUCn1c8CQA8PXzeVzrfobj
58Kt4lz9o6QF
cL0w6PZmKlfE8RoS5TDZMyH0
2Lyico9qDju7nr2X
b374NM2N3g0mfqI=
bVEtbg0KgZj533zw7n631TknAk9sHT4=
ZuNZIBhiw04fmLueUhJMOeZf+ilfHy8=
GBxm5ITLhl5XQOlF4DDZMyH0
6zulYX1WAoNl0vXmhkauyDcT8kdhBi0=
pZeodP1cQf3SyQtfUQ==
wsAZpF7WPbCJEDQt62HKxR0=
1A1vRW5BJHzzXsl7JNw=
ubG/Epl9PIb7Xtot5mHKxR0=
ExcR7v/y1XBW6wjRx722VlHrfobj
tvtepCyscmPvrsCd
QM28Ja5N8A0mfqI=
/UuzOsQY+8WgidZJSA==
pk0ZWgUKfY4STnqImJ/ZMyH0
0/4UFT1EL86yidZJSA==
mLH6x//qm+bQvFjJpKLZMyH0
yFLYqcdEtlNQ+ovii1iGrw==
CQUKN8PsFUSwtsPgRhAM
d1JHSBRgO1zvrsCd
EX/80uRL4gztasl7JNw=
VjpQXmhQEpTVRtNISg==
icUPYOYDaj6XzNmfS4jiZkwfc3aMc3m7
YbwogyCIP+zDssTgRhAM
liKeXXL3XdW2idZJSA==
DpZxgK191uNXWDttEgV8qQ==
yCQSTlcofmfvrsCd
0HdbxU5gWZTXChULh3d8uA==
wulP5XjDdoXs8AHdilE/176mQyLJgQ==
ftUzeAdbDsGQTdNB8DTZMyH0
LyYshzZrwiL1rjbYaRIb
FxUI3fDvJSiI4+zJw9Q=
tso/3IMC7yKg1ff08AVG7tGEWT+1Rdqz
2R+QH6SM7g0mfqI=
lshW53vMIIyAR+95LXaOoAb2U3WMc3m7
JGv37fpftjotxk/Fi1iGrw==
QTswdBsMz2xN4nHfi1iGrw==
ATODSoRwHZylR6dFP0+MJBU=
TWfBPutYujsoxlzNi1iGrw==
fedefarmatour.online
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
help.exepid process 680 help.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Musterkatalog 2022.pdf.exeaspnet_compiler.exehelp.exedescription pid process target process PID 1256 set thread context of 1168 1256 Musterkatalog 2022.pdf.exe aspnet_compiler.exe PID 1168 set thread context of 1240 1168 aspnet_compiler.exe Explorer.EXE PID 1168 set thread context of 1240 1168 aspnet_compiler.exe Explorer.EXE PID 680 set thread context of 1240 680 help.exe Explorer.EXE -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
aspnet_compiler.exehelp.exepid process 1168 aspnet_compiler.exe 1168 aspnet_compiler.exe 1168 aspnet_compiler.exe 1168 aspnet_compiler.exe 1168 aspnet_compiler.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1240 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
aspnet_compiler.exehelp.exepid process 1168 aspnet_compiler.exe 1168 aspnet_compiler.exe 1168 aspnet_compiler.exe 1168 aspnet_compiler.exe 680 help.exe 680 help.exe 680 help.exe 680 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aspnet_compiler.exehelp.exedescription pid process Token: SeDebugPrivilege 1168 aspnet_compiler.exe Token: SeDebugPrivilege 680 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1240 Explorer.EXE 1240 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1240 Explorer.EXE 1240 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Musterkatalog 2022.pdf.exeaspnet_compiler.exehelp.exedescription pid process target process PID 1256 wrote to memory of 1168 1256 Musterkatalog 2022.pdf.exe aspnet_compiler.exe PID 1256 wrote to memory of 1168 1256 Musterkatalog 2022.pdf.exe aspnet_compiler.exe PID 1256 wrote to memory of 1168 1256 Musterkatalog 2022.pdf.exe aspnet_compiler.exe PID 1256 wrote to memory of 1168 1256 Musterkatalog 2022.pdf.exe aspnet_compiler.exe PID 1256 wrote to memory of 1168 1256 Musterkatalog 2022.pdf.exe aspnet_compiler.exe PID 1256 wrote to memory of 1168 1256 Musterkatalog 2022.pdf.exe aspnet_compiler.exe PID 1256 wrote to memory of 1168 1256 Musterkatalog 2022.pdf.exe aspnet_compiler.exe PID 1168 wrote to memory of 680 1168 aspnet_compiler.exe help.exe PID 1168 wrote to memory of 680 1168 aspnet_compiler.exe help.exe PID 1168 wrote to memory of 680 1168 aspnet_compiler.exe help.exe PID 1168 wrote to memory of 680 1168 aspnet_compiler.exe help.exe PID 680 wrote to memory of 2032 680 help.exe Firefox.exe PID 680 wrote to memory of 2032 680 help.exe Firefox.exe PID 680 wrote to memory of 2032 680 help.exe Firefox.exe PID 680 wrote to memory of 2032 680 help.exe Firefox.exe PID 680 wrote to memory of 2032 680 help.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Musterkatalog 2022.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Musterkatalog 2022.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"4⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"4⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
927KB
MD57fd80b1cc72dc580c02ca4cfbfb2592d
SHA118da905af878b27151b359cf1a7d0a650764e8a1
SHA2561e6dccbdf8527abb53c289da920463b7895300d0d984cc7e91a3ecda4e673190
SHA51213f7f29b5ed31c551aa5f27742557aa4d026a226087d6fcbca094819759ecc753a2c33b7422ae88dc6a4a0a966edb8485a18e59a0283ba2686cae5d78e0190a3
-
memory/680-72-0x0000000000000000-mapping.dmp
-
memory/680-81-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/680-80-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/680-78-0x0000000000590000-0x000000000061F000-memory.dmpFilesize
572KB
-
memory/680-77-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/680-76-0x0000000000710000-0x0000000000A13000-memory.dmpFilesize
3.0MB
-
memory/680-75-0x0000000000700000-0x0000000000706000-memory.dmpFilesize
24KB
-
memory/1168-61-0x00000000004012B0-mapping.dmp
-
memory/1168-74-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1168-67-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/1168-57-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1168-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1168-70-0x00000000002A0000-0x00000000002B0000-memory.dmpFilesize
64KB
-
memory/1168-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1168-64-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1168-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1168-66-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/1168-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1168-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1240-71-0x0000000006970000-0x0000000006A5D000-memory.dmpFilesize
948KB
-
memory/1240-79-0x0000000007200000-0x000000000734E000-memory.dmpFilesize
1.3MB
-
memory/1240-68-0x0000000006AF0000-0x0000000006C83000-memory.dmpFilesize
1.6MB
-
memory/1240-82-0x0000000007200000-0x000000000734E000-memory.dmpFilesize
1.3MB
-
memory/1256-54-0x0000000000DB0000-0x0000000000E24000-memory.dmpFilesize
464KB
-
memory/1256-56-0x0000000000160000-0x0000000000168000-memory.dmpFilesize
32KB
-
memory/1256-55-0x0000000000150000-0x000000000015C000-memory.dmpFilesize
48KB