Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:02
Static task
static1
Behavioral task
behavioral1
Sample
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
Resource
win10v2004-20220812-en
General
-
Target
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
-
Size
148KB
-
MD5
465fcd4e9e58bd34e14ff1d08f25b182
-
SHA1
5c53599441649c0d456002165a420fe866ae0d07
-
SHA256
c618529d3c965f88021d712e57a49a69792818a3cdcb438cb0066af974f6ebb7
-
SHA512
909907b7c4ba4e7da005694fb96a848177e8c17a3eff95fb5a594a7231006bd114f24b2d6f6f37cf34b872adb33dd8ce6c150bfe74a46f04d75451dbfa331448
-
SSDEEP
3072:/ITf9bPB8JYwsQ18Zd4Nan8WgBspI9ozuPG7:YVLKYYeA72W9oyPq
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1468 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\uhbkhryw.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\uhbkhryw.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exedescription pid process target process PID 1108 set thread context of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeInformationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeExplorer.EXEpid process 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Token: SeDebugPrivilege 1372 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exepid process 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeInformationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeExplorer.EXEdescription pid process target process PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 1108 wrote to memory of 2020 1108 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 1468 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 2020 wrote to memory of 1468 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 2020 wrote to memory of 1468 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 2020 wrote to memory of 1468 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 2020 wrote to memory of 1372 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Explorer.EXE PID 1372 wrote to memory of 1220 1372 Explorer.EXE taskhost.exe PID 1372 wrote to memory of 1308 1372 Explorer.EXE Dwm.exe PID 1372 wrote to memory of 588 1372 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe"C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeC:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6374~1.BAT"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1571142422104090930-2120642074-11038775433869254981974615941-1330608406-1523196807"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms6374069.batFilesize
201B
MD5016f814cfebbd887fa0fadc202b103d5
SHA17fef03893085fe3aaec917bc3536eda0e043de43
SHA256bb43073b61de8c2d43af2581a9433068e48b8854438f06f77a58602b8e79ff24
SHA512bec78a2a14bd4033c96f61f42e8fd19c11456c2f44204fee4f8d72b1e061c945ead8a35156a920fb4cffdd9d57a190ff4a176c921ec6364c87d23a5d1f067d4b
-
memory/1108-54-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1108-65-0x00000000003F0000-0x00000000003F4000-memory.dmpFilesize
16KB
-
memory/1220-84-0x0000000000210000-0x0000000000227000-memory.dmpFilesize
92KB
-
memory/1220-82-0x0000000037850000-0x0000000037860000-memory.dmpFilesize
64KB
-
memory/1308-86-0x00000000001B0000-0x00000000001C7000-memory.dmpFilesize
92KB
-
memory/1308-83-0x0000000037850000-0x0000000037860000-memory.dmpFilesize
64KB
-
memory/1372-85-0x0000000002230000-0x0000000002247000-memory.dmpFilesize
92KB
-
memory/1372-76-0x0000000037850000-0x0000000037860000-memory.dmpFilesize
64KB
-
memory/1372-72-0x0000000002230000-0x0000000002247000-memory.dmpFilesize
92KB
-
memory/1468-71-0x0000000000000000-mapping.dmp
-
memory/2020-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2020-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2020-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2020-64-0x00000000004010C0-mapping.dmp
-
memory/2020-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2020-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2020-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2020-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2020-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB