Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 04:07

General

  • Target

    ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe

  • Size

    164KB

  • MD5

    cdaa35954dcd153996ce975b91fe719d

  • SHA1

    091608f039e47e20f3f275a70ea258c7c1e9d9a0

  • SHA256

    c8f5fab9ca9289342ae92ed1ef056e687f906fc40bbcfe2bee55d639157e06f4

  • SHA512

    89bab6eb07c59317f6bd06c24767d73e9919a6602571451c4e0b2b7f17c5b6a820d31544928cc8f06719bbb88117dd73f788f714d2363d2bba0c3639d781058a

  • SSDEEP

    3072:GJ/YG2oBmsmoA29aps+uqp65kpfuDrBNRUCLBEpXTfW0281UaOAfXTVRI9Jf+yY:GJ/GoMs1Ale5FBQrW028bOyXTHI

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1340
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
        "C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
          C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:908
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2660~1.BAT"
            4⤵
            • Deletes itself
            PID:2028
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1224
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "136453065417325176731557898367-304764448-9940833042125011644-553547808540570334"
        1⤵
          PID:1716

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms2660629.bat

          Filesize

          201B

          MD5

          f7e9ea472cbe01d737f1da0ece7b113b

          SHA1

          db154f7217e0b44352732f6ad3ac777d5411d0f6

          SHA256

          8f2ebab90ef0eec6997e04565ddb43d94e9335069390b4ad865071a7287d56ac

          SHA512

          0d4cb88902df972f7bc421df302b4d726e29e1ea582ec8313f08bcebdb95173cf5ed48a07ead55e237a192c37f0123389609d47f71f2e2cbdd6459cce435c9ce

        • memory/536-65-0x0000000000330000-0x0000000000334000-memory.dmp

          Filesize

          16KB

        • memory/536-54-0x0000000076871000-0x0000000076873000-memory.dmp

          Filesize

          8KB

        • memory/908-74-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/908-58-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/908-56-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/908-55-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/908-60-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/908-62-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/908-63-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/908-67-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1224-82-0x0000000037CE0000-0x0000000037CF0000-memory.dmp

          Filesize

          64KB

        • memory/1224-91-0x0000000001E50000-0x0000000001E67000-memory.dmp

          Filesize

          92KB

        • memory/1340-86-0x0000000037CE0000-0x0000000037CF0000-memory.dmp

          Filesize

          64KB

        • memory/1340-92-0x0000000000120000-0x0000000000137000-memory.dmp

          Filesize

          92KB

        • memory/1396-75-0x0000000037CE0000-0x0000000037CF0000-memory.dmp

          Filesize

          64KB

        • memory/1396-78-0x00000000026C0000-0x00000000026D7000-memory.dmp

          Filesize

          92KB

        • memory/1396-72-0x00000000026C0000-0x00000000026D7000-memory.dmp

          Filesize

          92KB

        • memory/2028-81-0x00000000000F0000-0x0000000000104000-memory.dmp

          Filesize

          80KB

        • memory/2028-88-0x00000000000F0000-0x0000000000104000-memory.dmp

          Filesize

          80KB