Analysis
-
max time kernel
186s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:07
Static task
static1
Behavioral task
behavioral1
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win10v2004-20221111-en
General
-
Target
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
-
Size
164KB
-
MD5
cdaa35954dcd153996ce975b91fe719d
-
SHA1
091608f039e47e20f3f275a70ea258c7c1e9d9a0
-
SHA256
c8f5fab9ca9289342ae92ed1ef056e687f906fc40bbcfe2bee55d639157e06f4
-
SHA512
89bab6eb07c59317f6bd06c24767d73e9919a6602571451c4e0b2b7f17c5b6a820d31544928cc8f06719bbb88117dd73f788f714d2363d2bba0c3639d781058a
-
SSDEEP
3072:GJ/YG2oBmsmoA29aps+uqp65kpfuDrBNRUCLBEpXTfW0281UaOAfXTVRI9Jf+yY:GJ/GoMs1Ale5FBQrW028bOyXTHI
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1144 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\loibgjiv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\loibgjiv.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exedescription pid process target process PID 528 set thread context of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEpid process 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 672 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 672 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 672 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe Token: SeDebugPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exepid process 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEdescription pid process target process PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 528 wrote to memory of 672 528 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 672 wrote to memory of 1144 672 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 672 wrote to memory of 1144 672 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 672 wrote to memory of 1144 672 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 672 wrote to memory of 1144 672 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 672 wrote to memory of 1264 672 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe Explorer.EXE PID 1264 wrote to memory of 1124 1264 Explorer.EXE taskhost.exe PID 1264 wrote to memory of 1124 1264 Explorer.EXE taskhost.exe PID 1264 wrote to memory of 1176 1264 Explorer.EXE Dwm.exe PID 1264 wrote to memory of 1144 1264 Explorer.EXE cmd.exe PID 1264 wrote to memory of 1144 1264 Explorer.EXE cmd.exe PID 1264 wrote to memory of 1972 1264 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeC:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9082~1.BAT"4⤵
- Deletes itself
PID:1144
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1011967225766923536-12035826841618274569-1710568396-48800184011998097571880950883"1⤵PID:1972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms9082233.batFilesize
201B
MD5a23fabec87af31fbb436512573e62a3d
SHA1f8fc5af59de65fbb6b5c0aff366714edab4a573a
SHA25605eff055ffc5818b218dde8c050ff3dc67564398a78eba1caffd27d4ae8fbd59
SHA5128217a3154107fae7d2d31dc94a36de71671b1d58bac22c2fb83829fef9ce16e2889e5be4d49ad64df25429061108fc83574700a3627a1f6465ebb4e8b5eeb659
-
memory/528-66-0x0000000000370000-0x0000000000374000-memory.dmpFilesize
16KB
-
memory/528-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/672-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/672-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/672-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/672-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/672-64-0x00000000004010C0-mapping.dmp
-
memory/672-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/672-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/672-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/672-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1124-96-0x0000000001E80000-0x0000000001E97000-memory.dmpFilesize
92KB
-
memory/1124-97-0x0000000001DE0000-0x0000000001DF7000-memory.dmpFilesize
92KB
-
memory/1124-90-0x00000000379C0000-0x00000000379D0000-memory.dmpFilesize
64KB
-
memory/1124-84-0x00000000379C0000-0x00000000379D0000-memory.dmpFilesize
64KB
-
memory/1144-82-0x0000000000130000-0x0000000000144000-memory.dmpFilesize
80KB
-
memory/1144-92-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1144-71-0x0000000000000000-mapping.dmp
-
memory/1176-87-0x00000000379C0000-0x00000000379D0000-memory.dmpFilesize
64KB
-
memory/1176-98-0x0000000001AD0000-0x0000000001AE7000-memory.dmpFilesize
92KB
-
memory/1264-75-0x00000000379C0000-0x00000000379D0000-memory.dmpFilesize
64KB
-
memory/1264-72-0x0000000002B60000-0x0000000002B77000-memory.dmpFilesize
92KB
-
memory/1264-95-0x0000000002B60000-0x0000000002B77000-memory.dmpFilesize
92KB
-
memory/1972-93-0x00000000379C0000-0x00000000379D0000-memory.dmpFilesize
64KB
-
memory/1972-94-0x00000000002B0000-0x00000000002C7000-memory.dmpFilesize
92KB