Analysis

  • max time kernel
    194s
  • max time network
    204s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 04:06

General

  • Target

    de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

  • Size

    204KB

  • MD5

    d482374e81b35c6b2bba6ee71315e382

  • SHA1

    c20efcbc5aa311b5ffb7fc18c97fccad043c22dc

  • SHA256

    cd3666f7ddcc5c720f86402b0b6fb2c81fe21827b0a4eecbba1961b896b7590d

  • SHA512

    cca3c24eac21967a98673ef921899373dc931b05318f0111fefdcadc84db193828dde56e9c47eb4a24877fb1c005fba8b04aa9a21b47751b79d72dfbc90bbf84

  • SSDEEP

    3072:2TNLneeBJ6hERwOPPB+vziPhtMCpPQKSXmLSScrE7SNZmZUNHs4j:+LnehdQgWDMCtb5LSSc/2Z4j

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1224
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
        "C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1716
        • C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
          C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1932
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS5967~1.BAT"
            4⤵
            • Deletes itself
            PID:1084
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1128
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-1822157377-614470190119780098-973487695469261956-12314532321411569134876411351"
        1⤵
          PID:468

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms5967899.bat

          Filesize

          201B

          MD5

          eb474d74e12dabe0ce2193ac839aa905

          SHA1

          2582e1c077bdc8f695f9c39a6e09d4bee025a743

          SHA256

          48899bd558087654d5904a1f57778502afb3c4eedff2f5fd864b6e0de0baf80c

          SHA512

          64f2b781069a7cc0c13a3b11fe212a9f8a653cbe721a8b7cb69618425674b2e91474837c5a3a228922e78d1034502e614102ff3611ef3bcffa7e968d82b05c34

        • memory/468-92-0x0000000000100000-0x0000000000117000-memory.dmp

          Filesize

          92KB

        • memory/468-91-0x0000000037100000-0x0000000037110000-memory.dmp

          Filesize

          64KB

        • memory/1084-81-0x00000000000F0000-0x0000000000104000-memory.dmp

          Filesize

          80KB

        • memory/1084-71-0x0000000000000000-mapping.dmp

        • memory/1128-93-0x0000000001C80000-0x0000000001C97000-memory.dmp

          Filesize

          92KB

        • memory/1128-80-0x0000000037100000-0x0000000037110000-memory.dmp

          Filesize

          64KB

        • memory/1224-95-0x0000000001B50000-0x0000000001B67000-memory.dmp

          Filesize

          92KB

        • memory/1224-83-0x0000000037100000-0x0000000037110000-memory.dmp

          Filesize

          64KB

        • memory/1276-75-0x0000000037100000-0x0000000037110000-memory.dmp

          Filesize

          64KB

        • memory/1276-94-0x00000000029E0000-0x00000000029F7000-memory.dmp

          Filesize

          92KB

        • memory/1276-72-0x00000000029E0000-0x00000000029F7000-memory.dmp

          Filesize

          92KB

        • memory/1716-65-0x00000000002D0000-0x00000000002D4000-memory.dmp

          Filesize

          16KB

        • memory/1716-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

          Filesize

          8KB

        • memory/1932-74-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1932-67-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1932-63-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1932-58-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1932-56-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1932-55-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1932-64-0x00000000004010C0-mapping.dmp

        • memory/1932-60-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1932-62-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB