a3cd24319aa792213116acb0a5fa06cb8d0fa101c866a8df0622f2daa0822df6

General

Target

E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
Size

148KB
MD5

bb6eaa3caf122030e276ddb20790e5e5
SHA1

050019c2864790aa5f0ac4fa6d2e1a65eb59cd70
SHA256

bba5332c6f0d44bc3f2935842dfbcc051f3edb1b7f186a94c665271ccca13755
SHA512

1290ae818f8a64288848fd6fc1e721edb96b4cd5b0991b1f7d10602198ddefdfcdd1f8b3b7610594432581752f14cc60514cd57930c636a4b8a714a18f7d4d7d
SSDEEP

3072:cIjIB3k5uMfRUL9glXFQuMlgSLLPr6s6THgFWP27:n/uUa+QuMumqAFWP6

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

560 cmd.exe

pid	process
560	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

description	pid	process	target process
PID 1632 set thread context of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exeE-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exeExplorer.EXE

pid	process
1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
1124	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
1124	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE

pid	process
1208	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1124	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
Token: SeDebugPrivilege	1208	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE
1208 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE
1208 Explorer.EXE

pid	process
1208	Explorer.EXE
1208	Explorer.EXE

pid	process
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

pid	process
1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE

pid	process
1208	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exeE-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exeExplorer.EXE

description	pid	process	target process
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1632 wrote to memory of 1124	1632	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
PID 1124 wrote to memory of 560	1124	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	cmd.exe
PID 1124 wrote to memory of 560	1124	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	cmd.exe
PID 1124 wrote to memory of 560	1124	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	cmd.exe
PID 1124 wrote to memory of 560	1124	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	cmd.exe
PID 1124 wrote to memory of 1208	1124	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	Explorer.EXE
PID 1208 wrote to memory of 1112	1208	Explorer.EXE	taskhost.exe
PID 1208 wrote to memory of 1180	1208	Explorer.EXE	Dwm.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
"C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS1567~1.BAT"
4⤵
- Deletes itself
PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms1567501.bat

Filesize
201B

MD5
b111b358b5f5efec85808c4ff0c0068a

SHA1
99d68db17e8770004d93657a19fa7e3f9850118e

SHA256
881541c5c5a04021b060ea6a96ce7b9f6e8d8d1e8f08effef5f2e76cb0856c84

SHA512
0ace9513fe7ed5b8508b248231092b9179710a5ff6f88db24258465dcf8f0d7fcec067896a5fdd6b5ef5394ffb96e19680a59afe36feee70cd2af500280d944f

Download Submit
memory/560-71-0x0000000000000000-mapping.dmp

Download
memory/1112-79-0x0000000037C30000-0x0000000037C40000-memory.dmp

Filesize
64KB

Download
memory/1112-84-0x0000000001BC0000-0x0000000001BD7000-memory.dmp

Filesize
92KB

Download
memory/1124-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1124-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1124-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1124-64-0x00000000004010C0-mapping.dmp

Download
memory/1124-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1124-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1124-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1124-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1124-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1180-82-0x0000000037C30000-0x0000000037C40000-memory.dmp

Filesize
64KB

Download
memory/1180-85-0x0000000001AC0000-0x0000000001AD7000-memory.dmp

Filesize
92KB

Download
memory/1208-72-0x0000000002A10000-0x0000000002A27000-memory.dmp

Filesize
92KB

Download
memory/1208-83-0x0000000002A10000-0x0000000002A27000-memory.dmp

Filesize
92KB

Download
memory/1208-75-0x0000000037C30000-0x0000000037C40000-memory.dmp

Filesize
64KB

Download
memory/1208-86-0x0000000002A10000-0x0000000002A27000-memory.dmp

Filesize
92KB

Download
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1632-65-0x0000000000340000-0x0000000000344000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads