Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:01
Static task
static1
Behavioral task
behavioral1
Sample
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
Resource
win10v2004-20221111-en
General
-
Target
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
-
Size
148KB
-
MD5
bb6eaa3caf122030e276ddb20790e5e5
-
SHA1
050019c2864790aa5f0ac4fa6d2e1a65eb59cd70
-
SHA256
bba5332c6f0d44bc3f2935842dfbcc051f3edb1b7f186a94c665271ccca13755
-
SHA512
1290ae818f8a64288848fd6fc1e721edb96b4cd5b0991b1f7d10602198ddefdfcdd1f8b3b7610594432581752f14cc60514cd57930c636a4b8a714a18f7d4d7d
-
SSDEEP
3072:cIjIB3k5uMfRUL9glXFQuMlgSLLPr6s6THgFWP27:n/uUa+QuMumqAFWP6
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 580 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exedescription pid process target process PID 1048 set thread context of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeInformationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeExplorer.EXEpid process 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 1388 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 1388 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1388 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Token: SeDebugPrivilege 1400 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exepid process 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeInformationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeExplorer.EXEdescription pid process target process PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1048 wrote to memory of 1388 1048 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1388 wrote to memory of 580 1388 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 1388 wrote to memory of 580 1388 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 1388 wrote to memory of 580 1388 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 1388 wrote to memory of 580 1388 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 1388 wrote to memory of 1400 1388 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Explorer.EXE PID 1400 wrote to memory of 1264 1400 Explorer.EXE taskhost.exe PID 1400 wrote to memory of 1340 1400 Explorer.EXE Dwm.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe"C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeC:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9336~1.BAT"4⤵
- Deletes itself
PID:580
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1340
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1264
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD53dc5588880efa514582ec9544bb98e54
SHA1bd65794359a114d102484ff7438bfc40375e8ad9
SHA256669d2708072d2731665be163fe09cd4021dc2375ab0f6210fa557a5e3844be78
SHA512953dc504f2d1df95bc6e5a288506bedc109c1f81c3ec1c6f912a68514c096c2aaec0f9a709f8545596bcea6f23afe4789ec398890b651a0200545f97e1a8e84f