Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:08
Static task
static1
Behavioral task
behavioral1
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win10v2004-20221111-en
General
-
Target
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
-
Size
164KB
-
MD5
cdaa35954dcd153996ce975b91fe719d
-
SHA1
091608f039e47e20f3f275a70ea258c7c1e9d9a0
-
SHA256
c8f5fab9ca9289342ae92ed1ef056e687f906fc40bbcfe2bee55d639157e06f4
-
SHA512
89bab6eb07c59317f6bd06c24767d73e9919a6602571451c4e0b2b7f17c5b6a820d31544928cc8f06719bbb88117dd73f788f714d2363d2bba0c3639d781058a
-
SSDEEP
3072:GJ/YG2oBmsmoA29aps+uqp65kpfuDrBNRUCLBEpXTfW0281UaOAfXTVRI9Jf+yY:GJ/GoMs1Ale5FBQrW028bOyXTHI
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 588 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exedescription pid process target process PID 1352 set thread context of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEpid process 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1696 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1696 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1696 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe Token: SeDebugPrivilege 1360 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exepid process 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEdescription pid process target process PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1352 wrote to memory of 1696 1352 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1696 wrote to memory of 588 1696 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 1696 wrote to memory of 588 1696 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 1696 wrote to memory of 588 1696 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 1696 wrote to memory of 588 1696 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 1696 wrote to memory of 1360 1696 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe Explorer.EXE PID 1360 wrote to memory of 1228 1360 Explorer.EXE taskhost.exe PID 1360 wrote to memory of 1308 1360 Explorer.EXE Dwm.exe PID 1360 wrote to memory of 588 1360 Explorer.EXE cmd.exe PID 1360 wrote to memory of 1372 1360 Explorer.EXE conhost.exe PID 1360 wrote to memory of 1372 1360 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeC:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9502~1.BAT"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-312827068247572414-644981968-1097932614-776266483-4852668215175600001803761486"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms9502267.batFilesize
201B
MD5d94d0ca348ea829c640280f3e23f660f
SHA1bc6af695edb4af15dbca6fd8528e240bd758de52
SHA256a4e4463fbe0cd84c9f2cef7a25bdf1bda2d8e2147cf62c382e285fc29bf6c03e
SHA51293697d4c8754205d03cb4d247bea5af27310ddf920c1d03a067b4c7359f50a55d0a2bac67d919dbe9d4fa28bd2eaeeb3b2b9cd0efab63771e36c0bcb93b1d146
-
memory/588-80-0x00000000000F0000-0x0000000000104000-memory.dmpFilesize
80KB
-
memory/588-71-0x0000000000000000-mapping.dmp
-
memory/1228-87-0x0000000036DD0000-0x0000000036DE0000-memory.dmpFilesize
64KB
-
memory/1228-95-0x0000000000420000-0x0000000000437000-memory.dmpFilesize
92KB
-
memory/1308-94-0x00000000001A0000-0x00000000001B7000-memory.dmpFilesize
92KB
-
memory/1308-86-0x0000000036DD0000-0x0000000036DE0000-memory.dmpFilesize
64KB
-
memory/1352-54-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB
-
memory/1352-65-0x00000000001D0000-0x00000000001D4000-memory.dmpFilesize
16KB
-
memory/1360-93-0x0000000002200000-0x0000000002217000-memory.dmpFilesize
92KB
-
memory/1360-72-0x0000000002200000-0x0000000002217000-memory.dmpFilesize
92KB
-
memory/1360-75-0x0000000036DD0000-0x0000000036DE0000-memory.dmpFilesize
64KB
-
memory/1360-96-0x0000000002200000-0x0000000002217000-memory.dmpFilesize
92KB
-
memory/1372-91-0x00000000001F0000-0x0000000000207000-memory.dmpFilesize
92KB
-
memory/1372-89-0x0000000036DD0000-0x0000000036DE0000-memory.dmpFilesize
64KB
-
memory/1372-92-0x00000000001D0000-0x00000000001E7000-memory.dmpFilesize
92KB
-
memory/1372-88-0x0000000036DD0000-0x0000000036DE0000-memory.dmpFilesize
64KB
-
memory/1696-64-0x00000000004010C0-mapping.dmp
-
memory/1696-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1696-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1696-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1696-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1696-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1696-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1696-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1696-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB