6de9fc90b37d56828711931284f797066a8ec78a9ecc170d550b4dca5b858978

General

Target

telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
Size

156KB
MD5

6fed865f5e569f40c884f0dc9ba21f6f
SHA1

603bf67bad75e611f80d311232edcb9f65706068
SHA256

3f33ae4ea87e4c2f3b2c60152da482a116e9c453662ac438b50458e56edcd87c
SHA512

b6a61eb80fac8d10435fa2280970c58a800fc86751e14bd3d5f1a1c62c7bc5a6b0b5b741770e0c6cfac78de20174d7c1cef6366c7bd0d07cabfad9d173a6cf31
SSDEEP

3072:X2V3Q7emkdat92PH48GLnCo0dXjxTsuGb+j3FRvtVFVlD2Pq:mV3Q6m6at98LdzxwuGWJ7V1D

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metlqowx.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\metlqowx.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4728 set thread context of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4488	3384	WerFault.exe	55

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
4924	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
4924	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
2644	Explorer.EXE
2644	Explorer.EXE
2644	Explorer.EXE
2644	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
Token: SeDebugPrivilege	2644	Explorer.EXE
Token: SeShutdownPrivilege	2644	Explorer.EXE
Token: SeCreatePagefilePrivilege	2644	Explorer.EXE
Token: SeShutdownPrivilege	3552	RuntimeBroker.exe
Token: SeShutdownPrivilege	3552	RuntimeBroker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79
PID 4728 wrote to memory of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79
PID 4728 wrote to memory of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79
PID 4728 wrote to memory of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79
PID 4728 wrote to memory of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79
PID 4728 wrote to memory of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79
PID 4728 wrote to memory of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79
PID 4728 wrote to memory of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79
PID 4728 wrote to memory of 4924	4728	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	79
PID 4924 wrote to memory of 5008	4924	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	80
PID 4924 wrote to memory of 5008	4924	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	80
PID 4924 wrote to memory of 5008	4924	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	80
PID 4924 wrote to memory of 2644	4924	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	33
PID 2644 wrote to memory of 2388	2644	Explorer.EXE	20
PID 2644 wrote to memory of 2396	2644	Explorer.EXE	22
PID 2644 wrote to memory of 2512	2644	Explorer.EXE	25
PID 2644 wrote to memory of 3188	2644	Explorer.EXE	56
PID 2644 wrote to memory of 3384	2644	Explorer.EXE	55
PID 2644 wrote to memory of 3488	2644	Explorer.EXE	44
PID 2644 wrote to memory of 3552	2644	Explorer.EXE	34
PID 2644 wrote to memory of 3640	2644	Explorer.EXE	35
PID 2644 wrote to memory of 3796	2644	Explorer.EXE	36
PID 2644 wrote to memory of 4680	2644	Explorer.EXE	38
PID 2644 wrote to memory of 4924	2644	Explorer.EXE	79
PID 2644 wrote to memory of 5008	2644	Explorer.EXE	80
PID 2644 wrote to memory of 4872	2644	Explorer.EXE	81

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2396

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2512

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
  "C:\Users\Admin\AppData\Local\Temp\telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Users\Admin\AppData\Local\Temp\telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
    C:\Users\Admin\AppData\Local\Temp\telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms18953.bat"
      4⤵
      PID:5008
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3552

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3640

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3796

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4680

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3488

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3384
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3384 -s 1000
  2⤵
  - Program crash
  PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3188

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 3384 -ip 3384
1⤵
PID:2340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms18953.bat

Filesize
200B

MD5
19d1a6b289bc17550661e3d4bce54666

SHA1
6f4d60cca1d0d345a9c1894f936a2843d4b7f299

SHA256
cad65da21312b8b0bf89c0d8fc8d9649e2d88bae2d5be415e6a7bffaeda98f05

SHA512
b353308c5a043be489e39dda8a898986fd09475205f437f3bbd23c36aa6bcff2cef9218a045bf911cdd78990e2ec6e9b608910f574497ebbab15ed7110d82384

Download Submit
memory/2388-155-0x000002D7B0D40000-0x000002D7B0D57000-memory.dmp

Filesize
92KB

Download
memory/2388-141-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/2396-156-0x0000027F96BD0000-0x0000027F96BE7000-memory.dmp

Filesize
92KB

Download
memory/2396-142-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/2512-143-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/2512-157-0x00000229AD660000-0x00000229AD677000-memory.dmp

Filesize
92KB

Download
memory/2644-154-0x0000000003360000-0x0000000003377000-memory.dmp

Filesize
92KB

Download
memory/2644-140-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/2644-163-0x0000000003360000-0x0000000003377000-memory.dmp

Filesize
92KB

Download
memory/3188-144-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/3188-158-0x000002EF957D0000-0x000002EF957E7000-memory.dmp

Filesize
92KB

Download
memory/3488-145-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/3488-159-0x0000024CAE9E0000-0x0000024CAE9F7000-memory.dmp

Filesize
92KB

Download
memory/3552-147-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/3552-161-0x000001EBBF360000-0x000001EBBF377000-memory.dmp

Filesize
92KB

Download
memory/3796-146-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/3796-160-0x00000281A7FD0000-0x00000281A7FE7000-memory.dmp

Filesize
92KB

Download
memory/4680-149-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/4680-162-0x000001A2ED5A0000-0x000001A2ED5B7000-memory.dmp

Filesize
92KB

Download
memory/4728-133-0x00000000022F0000-0x00000000022F4000-memory.dmp

Filesize
16KB

Download
memory/4872-153-0x00000208E79C0000-0x00000208E79D7000-memory.dmp

Filesize
92KB

Download
memory/4872-148-0x00007FFA46370000-0x00007FFA46380000-memory.dmp

Filesize
64KB

Download
memory/4924-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4924-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4924-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4924-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5008-152-0x0000000000230000-0x0000000000244000-memory.dmp

Filesize
80KB

Download
memory/5008-150-0x00000000377A0000-0x00000000377B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing