0a4e185a7b4a46ecd1a305b1dada207f845bd8a252b3458f9c4f722c82653611

Analysis

max time kernel
152s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size 196KB
Sample221124-e1nmtacb7s
SHA256 e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0
MD5 03c97952e19ce93941404ef9a3a935f5
SHA1 ec7edb6a0b5f14c7017ba645e269c8598633e384
SHA512 713b638f2f4f0870798ae66e14a81de302612b8aec3dc4cb1ce169b6df9be3aa89746dae4b31b0cd98ada46bd0fda3e42c8b4992c04ef6635bd112a137339f7f
SSDEEP 3072:9udusODvGZVHhX1drkr3k1qusMrf/Kf2DWJEi/i0D2D7oyCT8nVn1QJsYvVnGd+z:59+phXzpsML/E2DH0yDTV13Y5z
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
112	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Token: SeDebugPrivilege	1416	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1416	Explorer.EXE
1416	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1416	Explorer.EXE
1416	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1416	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 1628 wrote to memory of 112	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1628 wrote to memory of 112	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1628 wrote to memory of 112	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1628 wrote to memory of 112	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1628 wrote to memory of 1416	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	18
PID 1416 wrote to memory of 1228	1416	Explorer.EXE	11
PID 1416 wrote to memory of 1368	1416	Explorer.EXE	19
PID 1416 wrote to memory of 1368	1416	Explorer.EXE	19

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1228

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
  C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS4471~1.BAT"
    3⤵
    - Deletes itself
    PID:112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ms4471165.bat

Path C:\Users\Admin\AppData\Roaming\ms4471165.bat
Size 201B
SHA256 cb35a69bb57a64ab6271fdcdac1bc14e4027083ca36eb679996d249bdc3098d3
MD5 89fc3adf7a46f495b5b4ec7ead7cf066
SHA1 09e5dbfa7dd9f30eb2c4bb5bdd09d56fe9dd0503
SHA512 a3466a0328815f075d68b6ed6521e9b6a3de3d193703ba724b08e8a886bf90a44e91446cff416c3c6c5dd4dc8c4c6a9a67d44a79f6d2598aa436ffd912026599
MD5 SHA1 SHA512

Submit Download

memory/1228-82-0x0000000037150000-0x0000000037160000-memory.dmp

Download

memory/1228-87-0x0000000000330000-0x0000000000347000-memory.dmp

Download

memory/1368-89-0x00000000001A0000-0x00000000001B7000-memory.dmp

Download

memory/1368-88-0x00000000001C0000-0x00000000001D7000-memory.dmp

Download

memory/1368-85-0x0000000037150000-0x0000000037160000-memory.dmp

Download

memory/1368-84-0x0000000037150000-0x0000000037160000-memory.dmp

Download

memory/1416-72-0x00000000021E0000-0x00000000021F7000-memory.dmp

Download

memory/1416-86-0x00000000021E0000-0x00000000021F7000-memory.dmp

Download

memory/1416-76-0x0000000037150000-0x0000000037160000-memory.dmp

Download

memory/1480-54-0x0000000076201000-0x0000000076203000-memory.dmp

Download

memory/1480-65-0x00000000002C0000-0x00000000002C4000-memory.dmp

Download

memory/1628-74-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1628-55-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1628-56-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1628-58-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1628-67-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1628-63-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1628-62-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1628-60-0x0000000000400000-0x0000000000412000-memory.dmp

Download