Analysis
-
max time kernel
175s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:07
Static task
static1
Behavioral task
behavioral1
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win10v2004-20221111-en
General
-
Target
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
-
Size
164KB
-
MD5
cdaa35954dcd153996ce975b91fe719d
-
SHA1
091608f039e47e20f3f275a70ea258c7c1e9d9a0
-
SHA256
c8f5fab9ca9289342ae92ed1ef056e687f906fc40bbcfe2bee55d639157e06f4
-
SHA512
89bab6eb07c59317f6bd06c24767d73e9919a6602571451c4e0b2b7f17c5b6a820d31544928cc8f06719bbb88117dd73f788f714d2363d2bba0c3639d781058a
-
SSDEEP
3072:GJ/YG2oBmsmoA29aps+uqp65kpfuDrBNRUCLBEpXTfW0281UaOAfXTVRI9Jf+yY:GJ/GoMs1Ale5FBQrW028bOyXTHI
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\uhbkhryw.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\uhbkhryw.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exedescription pid process target process PID 1372 set thread context of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEpid process 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1364 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1364 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1364 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe Token: SeDebugPrivilege 1280 Explorer.EXE Token: SeShutdownPrivilege 1280 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exepid process 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEdescription pid process target process PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1372 wrote to memory of 1364 1372 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1364 wrote to memory of 1128 1364 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 1364 wrote to memory of 1128 1364 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 1364 wrote to memory of 1128 1364 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 1364 wrote to memory of 1128 1364 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 1364 wrote to memory of 1280 1364 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe Explorer.EXE PID 1280 wrote to memory of 1132 1280 Explorer.EXE taskhost.exe PID 1280 wrote to memory of 1240 1280 Explorer.EXE Dwm.exe PID 1280 wrote to memory of 1364 1280 Explorer.EXE ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1280 wrote to memory of 1128 1280 Explorer.EXE cmd.exe PID 1280 wrote to memory of 324 1280 Explorer.EXE conhost.exe PID 1280 wrote to memory of 324 1280 Explorer.EXE conhost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1132
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1240
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeC:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2660~1.BAT"4⤵PID:1128
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "982820415-18120497541934969999-2085623793-1948037695923364350-406630802-1237277405"1⤵PID:324
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms2660629.batFilesize
201B
MD5f7e9ea472cbe01d737f1da0ece7b113b
SHA1db154f7217e0b44352732f6ad3ac777d5411d0f6
SHA2568f2ebab90ef0eec6997e04565ddb43d94e9335069390b4ad865071a7287d56ac
SHA5120d4cb88902df972f7bc421df302b4d726e29e1ea582ec8313f08bcebdb95173cf5ed48a07ead55e237a192c37f0123389609d47f71f2e2cbdd6459cce435c9ce
-
memory/324-97-0x00000000001C0000-0x00000000001D7000-memory.dmpFilesize
92KB
-
memory/324-96-0x00000000001E0000-0x00000000001F7000-memory.dmpFilesize
92KB
-
memory/324-92-0x0000000036D00000-0x0000000036D10000-memory.dmpFilesize
64KB
-
memory/324-91-0x0000000036D00000-0x0000000036D10000-memory.dmpFilesize
64KB
-
memory/1128-99-0x0000000000130000-0x0000000000144000-memory.dmpFilesize
80KB
-
memory/1128-98-0x0000000036EB0000-0x0000000036EC0000-memory.dmpFilesize
64KB
-
memory/1128-71-0x0000000000000000-mapping.dmp
-
memory/1132-88-0x0000000036D00000-0x0000000036D10000-memory.dmpFilesize
64KB
-
memory/1132-93-0x0000000001DE0000-0x0000000001DF7000-memory.dmpFilesize
92KB
-
memory/1240-95-0x0000000000120000-0x0000000000137000-memory.dmpFilesize
92KB
-
memory/1240-89-0x0000000036D00000-0x0000000036D10000-memory.dmpFilesize
64KB
-
memory/1280-74-0x0000000036D00000-0x0000000036D10000-memory.dmpFilesize
64KB
-
memory/1280-72-0x0000000002590000-0x00000000025A7000-memory.dmpFilesize
92KB
-
memory/1280-94-0x0000000002590000-0x00000000025A7000-memory.dmpFilesize
92KB
-
memory/1364-64-0x00000000004010C0-mapping.dmp
-
memory/1364-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1364-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1364-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1364-80-0x0000000000260000-0x0000000000274000-memory.dmpFilesize
80KB
-
memory/1364-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1364-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1364-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1364-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1364-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-54-0x0000000075E11000-0x0000000075E13000-memory.dmpFilesize
8KB
-
memory/1372-65-0x0000000000270000-0x0000000000274000-memory.dmpFilesize
16KB