Analysis
-
max time kernel
245s -
max time network
324s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 03:49
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
Resource
win10v2004-20221111-en
General
-
Target
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
-
Size
180KB
-
MD5
f96874ad23fde2f0b3af2af1565beb73
-
SHA1
16e63fa7df0f2e8964d2e9cf2541b9ccd5c31106
-
SHA256
0ed91af7f5dd71ee724ef0bddaae43bdd10721fa21f2b226f69f3156085126fc
-
SHA512
e5c621a7bd62832ba331b2d0ee40d72e81d9a6892a662ded20c1c23e56b553b829f1691293728b1a8d190c6dd3c0dfdccfe77551ebe2bf7e3220d411c77e803d
-
SSDEEP
3072:t1ezQdDuZph4fWy6c3v40y+rzqVCr+YARsI6u2t4Y9sBG0hac0v2D+:t1eUNuFIdt3vTrz1r+R7F2t4pUO
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 528 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEpid process 760 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 760 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 760 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe Token: SeDebugPrivilege 1372 Explorer.EXE Token: SeShutdownPrivilege 1372 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEdescription pid process target process PID 760 wrote to memory of 528 760 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 760 wrote to memory of 528 760 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 760 wrote to memory of 528 760 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 760 wrote to memory of 528 760 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 760 wrote to memory of 1372 760 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe Explorer.EXE PID 1372 wrote to memory of 1220 1372 Explorer.EXE taskhost.exe PID 1372 wrote to memory of 1324 1372 Explorer.EXE Dwm.exe PID 1372 wrote to memory of 528 1372 Explorer.EXE cmd.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7921~1.BAT"3⤵
- Deletes itself
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms7921405.batFilesize
201B
MD5ad1952aa4665d56c4a470871ff6ccd94
SHA1ed158f9adae7230bf2bdf4c0ba39c4253a318a89
SHA2565880e263922a8c0ead27768e590038f50d4ba7bc48494764278726c8d1f2718f
SHA5120a384e88359a86ce446784a8d080b56e4698f9db0cee80d663c33c8f8fbd47920296e175f20b043b15129e4ab11ceeabe287e19f92b4a7649f90535a0510f04d
-
memory/528-55-0x0000000000000000-mapping.dmp
-
memory/760-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmpFilesize
8KB
-
memory/760-61-0x0000000000C10000-0x0000000000C45000-memory.dmpFilesize
212KB
-
memory/760-58-0x00000000003D0000-0x00000000003DD000-memory.dmpFilesize
52KB
-
memory/1220-66-0x0000000036E50000-0x0000000036E60000-memory.dmpFilesize
64KB
-
memory/1220-69-0x0000000001DE0000-0x0000000001DF7000-memory.dmpFilesize
92KB
-
memory/1324-68-0x0000000036E50000-0x0000000036E60000-memory.dmpFilesize
64KB
-
memory/1324-70-0x0000000000130000-0x0000000000147000-memory.dmpFilesize
92KB
-
memory/1372-56-0x00000000026C0000-0x00000000026D7000-memory.dmpFilesize
92KB
-
memory/1372-59-0x0000000036E50000-0x0000000036E60000-memory.dmpFilesize
64KB
-
memory/1372-71-0x00000000026C0000-0x00000000026D7000-memory.dmpFilesize
92KB