c2fff3ec29e65ffd8f3d5a5a66f159ad6c1eeb28cf40bd70f944fac0f384131c

General

Target

de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
Size

204KB
MD5

d482374e81b35c6b2bba6ee71315e382
SHA1

c20efcbc5aa311b5ffb7fc18c97fccad043c22dc
SHA256

cd3666f7ddcc5c720f86402b0b6fb2c81fe21827b0a4eecbba1961b896b7590d
SHA512

cca3c24eac21967a98673ef921899373dc931b05318f0111fefdcadc84db193828dde56e9c47eb4a24877fb1c005fba8b04aa9a21b47751b79d72dfbc90bbf84
SSDEEP

3072:2TNLneeBJ6hERwOPPB+vziPhtMCpPQKSXmLSScrE7SNZmZUNHs4j:+LnehdQgWDMCtb5LSSc/2Z4j

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1148 cmd.exe

pid	process
1148	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

description	pid	process	target process
PID 1224 set thread context of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exede_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exeExplorer.EXE

pid	process
1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
1096	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
1096	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE

pid	process
1244	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1096	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
Token: SeDebugPrivilege	1244	Explorer.EXE
Token: SeShutdownPrivilege	1244	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

pid	process
1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE

pid	process
1244	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exede_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exeExplorer.EXE

description	pid	process	target process
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1224 wrote to memory of 1096	1224	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
PID 1096 wrote to memory of 1148	1096	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	cmd.exe
PID 1096 wrote to memory of 1148	1096	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	cmd.exe
PID 1096 wrote to memory of 1148	1096	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	cmd.exe
PID 1096 wrote to memory of 1148	1096	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	cmd.exe
PID 1096 wrote to memory of 1244	1096	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	Explorer.EXE
PID 1244 wrote to memory of 1128	1244	Explorer.EXE	taskhost.exe
PID 1244 wrote to memory of 1192	1244	Explorer.EXE	Dwm.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1192

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
"C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9522~1.BAT"
4⤵
- Deletes itself
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms9522115.bat
Filesize
201B

MD5
13565054bc6397b9f40e8d6b116f9ab0

SHA1
1a9abdb6006924f05cf214abc6ce72f0eb3fa2cc

SHA256
bac29c9e61b01a9ba7da5ba41e7128b938a06f687ef362f30f9faff6e8512ffe

SHA512
f60acba83b548a7da801f14d1871ff6b982d8ca436b770dfc50e94871fed2657603a87ea692e4dc58ecbe53fc321018d9328eeb796591db00459846b45efb0da

Download Submit
memory/1096-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1096-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1096-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1096-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1096-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1096-64-0x00000000004010C0-mapping.dmp

Download
memory/1096-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1096-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1096-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1128-80-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1128-84-0x0000000001E70000-0x0000000001E87000-memory.dmp

Filesize
92KB

Download
memory/1148-71-0x0000000000000000-mapping.dmp

Download
memory/1192-82-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1192-85-0x00000000002B0000-0x00000000002C7000-memory.dmp

Filesize
92KB

Download
memory/1224-65-0x0000000000240000-0x0000000000244000-memory.dmp

Filesize
16KB

Download
memory/1224-54-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/1244-72-0x0000000001D30000-0x0000000001D47000-memory.dmp

Filesize
92KB

Download
memory/1244-76-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1244-83-0x0000000001D30000-0x0000000001D47000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads