Analysis
-
max time kernel
148s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 03:46
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
Resource
win10v2004-20221111-en
General
-
Target
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
-
Size
180KB
-
MD5
f96874ad23fde2f0b3af2af1565beb73
-
SHA1
16e63fa7df0f2e8964d2e9cf2541b9ccd5c31106
-
SHA256
0ed91af7f5dd71ee724ef0bddaae43bdd10721fa21f2b226f69f3156085126fc
-
SHA512
e5c621a7bd62832ba331b2d0ee40d72e81d9a6892a662ded20c1c23e56b553b829f1691293728b1a8d190c6dd3c0dfdccfe77551ebe2bf7e3220d411c77e803d
-
SSDEEP
3072:t1ezQdDuZph4fWy6c3v40y+rzqVCr+YARsI6u2t4Y9sBG0hac0v2D+:t1eUNuFIdt3vTrz1r+R7F2t4pUO
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1440 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEpid process 1156 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1156 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1156 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe Token: SeDebugPrivilege 1272 Explorer.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEdescription pid process target process PID 1156 wrote to memory of 1440 1156 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1156 wrote to memory of 1440 1156 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1156 wrote to memory of 1440 1156 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1156 wrote to memory of 1440 1156 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1156 wrote to memory of 1272 1156 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe Explorer.EXE PID 1272 wrote to memory of 1148 1272 Explorer.EXE taskhost.exe PID 1272 wrote to memory of 1148 1272 Explorer.EXE taskhost.exe PID 1272 wrote to memory of 1236 1272 Explorer.EXE Dwm.exe PID 1272 wrote to memory of 1156 1272 Explorer.EXE rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1272 wrote to memory of 1440 1272 Explorer.EXE cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7921~1.BAT"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms7921405.batFilesize
201B
MD5ad1952aa4665d56c4a470871ff6ccd94
SHA1ed158f9adae7230bf2bdf4c0ba39c4253a318a89
SHA2565880e263922a8c0ead27768e590038f50d4ba7bc48494764278726c8d1f2718f
SHA5120a384e88359a86ce446784a8d080b56e4698f9db0cee80d663c33c8f8fbd47920296e175f20b043b15129e4ab11ceeabe287e19f92b4a7649f90535a0510f04d
-
memory/1148-77-0x0000000001CC0000-0x0000000001CD7000-memory.dmpFilesize
92KB
-
memory/1148-75-0x0000000001CE0000-0x0000000001CF7000-memory.dmpFilesize
92KB
-
memory/1148-74-0x0000000037180000-0x0000000037190000-memory.dmpFilesize
64KB
-
memory/1148-71-0x0000000037180000-0x0000000037190000-memory.dmpFilesize
64KB
-
memory/1156-54-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/1156-62-0x0000000000360000-0x0000000000395000-memory.dmpFilesize
212KB
-
memory/1156-58-0x0000000000120000-0x000000000012D000-memory.dmpFilesize
52KB
-
memory/1156-69-0x0000000000340000-0x0000000000354000-memory.dmpFilesize
80KB
-
memory/1236-72-0x0000000037180000-0x0000000037190000-memory.dmpFilesize
64KB
-
memory/1236-76-0x00000000001A0000-0x00000000001B7000-memory.dmpFilesize
92KB
-
memory/1272-63-0x00000000029A0000-0x00000000029B7000-memory.dmpFilesize
92KB
-
memory/1272-60-0x0000000037180000-0x0000000037190000-memory.dmpFilesize
64KB
-
memory/1272-56-0x00000000029A0000-0x00000000029B7000-memory.dmpFilesize
92KB
-
memory/1440-55-0x0000000000000000-mapping.dmp