Analysis
-
max time kernel
212s -
max time network
279s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:05
Static task
static1
Behavioral task
behavioral1
Sample
zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe
Resource
win10v2004-20221111-en
General
-
Target
zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe
-
Size
212KB
-
MD5
f196726cb3ad205c35e6774f2dfc506d
-
SHA1
3509d67230073720cd38cc5e430a6166263388c6
-
SHA256
f3ec41acbd141572f40d6f62a2838325980d255ea17490767851bfa250e645e7
-
SHA512
2e90a2c7ac3475ae70b41a616861ed8193ac21d95a4ad61c505d9f206645b47dc35e7ac6968bc107e1cc32a115cc2e5d2217ef06af7e8501a7989a8603e930b5
-
SSDEEP
3072:52V3AKem3MIsNLH51FJNv4ObPCdYZcV/x6xc3AmBsB6ExmOJ85Ja:AV3Alm7sNLZLJNwCl8x93AdUEJ3
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1444 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exedescription pid process target process PID 900 set thread context of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exezahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exeExplorer.EXEpid process 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe 1080 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe 1080 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1080 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe Token: SeDebugPrivilege 1272 Explorer.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exepid process 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exezahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exeExplorer.EXEdescription pid process target process PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 900 wrote to memory of 1080 900 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe PID 1080 wrote to memory of 1444 1080 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe cmd.exe PID 1080 wrote to memory of 1444 1080 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe cmd.exe PID 1080 wrote to memory of 1444 1080 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe cmd.exe PID 1080 wrote to memory of 1444 1080 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe cmd.exe PID 1080 wrote to memory of 1272 1080 zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe Explorer.EXE PID 1272 wrote to memory of 1156 1272 Explorer.EXE taskhost.exe PID 1272 wrote to memory of 1156 1272 Explorer.EXE taskhost.exe PID 1272 wrote to memory of 1236 1272 Explorer.EXE Dwm.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe"C:\Users\Admin\AppData\Local\Temp\zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exeC:\Users\Admin\AppData\Local\Temp\zahlung_in_auftrag_2014_12_2_000002_000039_900002_0_1_6_928_29873565001_0003.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS4471~1.BAT"4⤵
- Deletes itself
PID:1444
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1236
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD5290518e567d49a33ac37c05bc68c34ac
SHA1564a76c9858df05ba44a20f6ecfd2230d8c1cb80
SHA256d5ae8c2c86ebe06f908a67d49de8f46467a24c0156022f6a3cf3270fc684dd2c
SHA512fc67a020a897085b6cc59b7770acd2a5e24da4911972190781ad4f24e3279d42d3ffc951f3207f9519ad6b50f6c08b0095dfb97f77a815139495efb6743d615c