Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:09
Static task
static1
Behavioral task
behavioral1
Sample
ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
Resource
win10v2004-20221111-en
General
-
Target
ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
-
Size
164KB
-
MD5
b779127121ae2844dd49a63a9017fa2f
-
SHA1
638a99a79bc63a7211422db7b851725b62b3617b
-
SHA256
4241921870ae6fee9cef8a48cfa99f2189dd6d2e88ea22bff6caf6474d7d3ee0
-
SHA512
c43aafb393ba68406c02a507d1ad5fbc18d78625a65a4c65a5c921ad5bc0cde050a513860c1e9340d6b1dde77b687d1c1a33481e883d5f1097d159f1abab5d2d
-
SSDEEP
3072:ZJ/YG2oBH7RFQcISXZtYs9DiOkqBFtQhMpDhCVT1A6djL9Jf+yY:ZJ/GoJti4jFtQh2hCVTd/
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1168 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\uhbkhryw.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\uhbkhryw.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exedescription pid process target process PID 1892 set thread context of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exeihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exeExplorer.EXEpid process 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe 936 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe 936 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 936 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe Token: SeDebugPrivilege 1252 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exepid process 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exeihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exeExplorer.EXEdescription pid process target process PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 1892 wrote to memory of 936 1892 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe PID 936 wrote to memory of 1168 936 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe cmd.exe PID 936 wrote to memory of 1168 936 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe cmd.exe PID 936 wrote to memory of 1168 936 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe cmd.exe PID 936 wrote to memory of 1168 936 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe cmd.exe PID 936 wrote to memory of 1252 936 ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe Explorer.EXE PID 1252 wrote to memory of 1116 1252 Explorer.EXE taskhost.exe PID 1252 wrote to memory of 1184 1252 Explorer.EXE Dwm.exe PID 1252 wrote to memory of 1168 1252 Explorer.EXE cmd.exe PID 1252 wrote to memory of 680 1252 Explorer.EXE conhost.exe PID 1252 wrote to memory of 680 1252 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe"C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exeC:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6137~1.BAT"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "612174249-165895638116059697681022391782643582021-1700758102-325659442-1267915545"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms6137067.batFilesize
201B
MD55b0a412b411d2e3f6e0f0018e414cedc
SHA17d2e4b3f8cc27e41ef46d98ef14ed7d35ef820d9
SHA2560b47ae5f967bda9f0ba998ac6f6e2513c8188df0cf3b325c5f580fa4b6e1e987
SHA51291f9c63379e02be2c31de464bb040733b2004c11cfc93962ada96a6075bbf843a57ec18080272f19e4ac68ec311de9c5914ac7c495557b8f6aea98d9e563cc4a
-
memory/680-90-0x0000000000190000-0x00000000001A7000-memory.dmpFilesize
92KB
-
memory/936-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/936-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/936-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/936-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/936-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/936-64-0x00000000004010C0-mapping.dmp
-
memory/936-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/936-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/936-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1116-92-0x0000000001B00000-0x0000000001B17000-memory.dmpFilesize
92KB
-
memory/1116-87-0x0000000037B40000-0x0000000037B50000-memory.dmpFilesize
64KB
-
memory/1168-71-0x0000000000000000-mapping.dmp
-
memory/1168-81-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB
-
memory/1168-89-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB
-
memory/1184-88-0x0000000037B40000-0x0000000037B50000-memory.dmpFilesize
64KB
-
memory/1184-93-0x00000000001A0000-0x00000000001B7000-memory.dmpFilesize
92KB
-
memory/1252-76-0x0000000037B40000-0x0000000037B50000-memory.dmpFilesize
64KB
-
memory/1252-72-0x0000000002AA0000-0x0000000002AB7000-memory.dmpFilesize
92KB
-
memory/1252-91-0x0000000002AA0000-0x0000000002AB7000-memory.dmpFilesize
92KB
-
memory/1892-54-0x0000000075EC1000-0x0000000075EC3000-memory.dmpFilesize
8KB
-
memory/1892-65-0x00000000002C0000-0x00000000002C4000-memory.dmpFilesize
16KB