Analysis
-
max time kernel
210s -
max time network
273s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:25
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
Resource
win10v2004-20220812-en
General
-
Target
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
-
Size
176KB
-
MD5
13997ebf7af8d37dda6697ac03f76cc3
-
SHA1
9be2bcd498406bdfb05f860ad726273c4a7b4f3a
-
SHA256
11ecf58db103eb2ded5b942f303d48b5d77e336b8edfe335fa7b81264d1f50ef
-
SHA512
2894ef41ec784fb39ec663ff8ca5fa8c0ebbd875f95f6e2b843c8bca59d63cc7c43f64df43898290cef31c4b32478819f437fcc4656606d0f7cd4721c735ffee
-
SSDEEP
3072:rGwR1qmB1TQgHtMF5a6I4Ya5Tlrjmvl3XymSPTyAAwoc9+IkMd+zr3/1C:7KLa6I4x3mdnCNAwo42M
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 628 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exedescription pid process target process PID 1720 set thread context of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exerechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exeExplorer.EXEpid process 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 1108 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 1108 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1108 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Token: SeDebugPrivilege 1284 Explorer.EXE Token: SeShutdownPrivilege 1284 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exepid process 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exerechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exeExplorer.EXEdescription pid process target process PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1720 wrote to memory of 1108 1720 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 1108 wrote to memory of 628 1108 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe cmd.exe PID 1108 wrote to memory of 628 1108 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe cmd.exe PID 1108 wrote to memory of 628 1108 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe cmd.exe PID 1108 wrote to memory of 628 1108 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe cmd.exe PID 1108 wrote to memory of 1284 1108 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Explorer.EXE PID 1284 wrote to memory of 1120 1284 Explorer.EXE taskhost.exe PID 1284 wrote to memory of 1176 1284 Explorer.EXE Dwm.exe PID 1284 wrote to memory of 628 1284 Explorer.EXE cmd.exe PID 1284 wrote to memory of 628 1284 Explorer.EXE cmd.exe PID 1284 wrote to memory of 1164 1284 Explorer.EXE conhost.exe PID 1284 wrote to memory of 1164 1284 Explorer.EXE conhost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exeC:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS5967~1.BAT"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "5560738441279740831578272174-1726282380-151526859135097416519807809701913814061"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms5967899.batFilesize
201B
MD55cc93979415c693fab160196405ab327
SHA13572ace2c1fcec101fe55c204db2c9cac5ea456e
SHA256001513aaa6e17df593c267d592cebd44351f35835e8db870d269cfd03237867c
SHA512807cb7e2be0d60238084ddfe5fae7c0e780633cab4f3d13582da72358b3617c6145e70d65ecbd07c07ad4b605c64e40deed8ab43c1a21df233eccc1455ee6ab1
-
memory/628-73-0x0000000000000000-mapping.dmp
-
memory/628-82-0x0000000000240000-0x0000000000254000-memory.dmpFilesize
80KB
-
memory/1108-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1108-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1108-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1108-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1108-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1108-65-0x00000000004010C0-mapping.dmp
-
memory/1108-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1108-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1108-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1120-96-0x00000000002D0000-0x00000000002E7000-memory.dmpFilesize
92KB
-
memory/1120-84-0x0000000037750000-0x0000000037760000-memory.dmpFilesize
64KB
-
memory/1164-94-0x00000000001F0000-0x0000000000207000-memory.dmpFilesize
92KB
-
memory/1164-93-0x0000000037750000-0x0000000037760000-memory.dmpFilesize
64KB
-
memory/1176-97-0x0000000000340000-0x0000000000357000-memory.dmpFilesize
92KB
-
memory/1176-92-0x0000000037750000-0x0000000037760000-memory.dmpFilesize
64KB
-
memory/1284-77-0x0000000037750000-0x0000000037760000-memory.dmpFilesize
64KB
-
memory/1284-74-0x0000000002240000-0x0000000002257000-memory.dmpFilesize
92KB
-
memory/1284-95-0x0000000002240000-0x0000000002257000-memory.dmpFilesize
92KB
-
memory/1720-69-0x0000000000250000-0x0000000000254000-memory.dmpFilesize
16KB
-
memory/1720-55-0x00000000763D1000-0x00000000763D3000-memory.dmpFilesize
8KB
-
memory/1720-54-0x0000000000400000-0x0000000000520000-memory.dmpFilesize
1.1MB
-
memory/1720-67-0x0000000000400000-0x0000000000520000-memory.dmpFilesize
1.1MB