Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:08
Static task
static1
Behavioral task
behavioral1
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win10v2004-20220812-en
General
-
Target
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
-
Size
164KB
-
MD5
d84e5bbf8c16e91fec275230fa6de7a6
-
SHA1
e4855f1d90ad6f0755988bf5f090dee9f3ca403e
-
SHA256
674f447b67fa6481c04d7d4c7dc47ecc0d3956c0c7b9006c845efebbc8fb318f
-
SHA512
4c3418c993eb0e0bf27106e672d2e2ba60ad0f1cb6c8ec1f85b6c5c6459e061c755ffd05cb887e0d6eecd48212ef55832f2189f0afe7be2e72ca67f30d0c534b
-
SSDEEP
3072:ZJ/YG2oBFOU2IG7N1f0ufvLFz5+pWwW14Ih2M7XygCQJz9Jf+yY:ZJ/GoD/2VN1fpfTv+Iv14IhrzyFQt
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1124 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ypbkryye.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ypbkryye.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exedescription pid process target process PID 1108 set thread context of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEpid process 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 808 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 808 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 808 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe Token: SeDebugPrivilege 1360 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exepid process 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeExplorer.EXEdescription pid process target process PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1108 wrote to memory of 808 1108 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 808 wrote to memory of 1124 808 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 808 wrote to memory of 1124 808 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 808 wrote to memory of 1124 808 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 808 wrote to memory of 1124 808 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe cmd.exe PID 808 wrote to memory of 1360 808 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe Explorer.EXE PID 1360 wrote to memory of 1228 1360 Explorer.EXE taskhost.exe PID 1360 wrote to memory of 1316 1360 Explorer.EXE Dwm.exe PID 1360 wrote to memory of 808 1360 Explorer.EXE ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe PID 1360 wrote to memory of 1124 1360 Explorer.EXE cmd.exe PID 1360 wrote to memory of 1124 1360 Explorer.EXE cmd.exe PID 1360 wrote to memory of 1276 1360 Explorer.EXE conhost.exe PID 1360 wrote to memory of 1276 1360 Explorer.EXE conhost.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeC:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7921~1.BAT"4⤵
- Deletes itself
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1102069756775588698-1776972618-2110051450-1010069717-1237682089-21162318701886972310"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms7921405.batFilesize
201B
MD5a1801dc83316abf1e6a303dc1867cc84
SHA140a44fef284ad2844b506c5de4506fcacae1dc28
SHA256d056c50c3e8b3d34752d4b60f3206b9a4223894c7c78f6a545f74dfb631fdb39
SHA512d00b87eee63f33273cbd55b52d51ae1472d386468fde72fdab9edb85fd25c0dadc674ef7bebc30e5a78b44af6d53b705625095ae504ec8634e4de0e6633ed7dc
-
memory/808-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/808-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/808-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/808-80-0x00000000002F0000-0x0000000000304000-memory.dmpFilesize
80KB
-
memory/808-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/808-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/808-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/808-64-0x00000000004010C0-mapping.dmp
-
memory/808-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/808-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1108-65-0x00000000003B0000-0x00000000003B4000-memory.dmpFilesize
16KB
-
memory/1108-54-0x0000000075B41000-0x0000000075B43000-memory.dmpFilesize
8KB
-
memory/1124-71-0x0000000000000000-mapping.dmp
-
memory/1228-97-0x0000000001CA0000-0x0000000001CB7000-memory.dmpFilesize
92KB
-
memory/1228-90-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/1276-93-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/1276-92-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/1276-95-0x00000000000F0000-0x0000000000107000-memory.dmpFilesize
92KB
-
memory/1276-96-0x00000000000D0000-0x00000000000E7000-memory.dmpFilesize
92KB
-
memory/1316-91-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/1316-99-0x0000000000120000-0x0000000000137000-memory.dmpFilesize
92KB
-
memory/1360-75-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/1360-72-0x0000000002160000-0x0000000002177000-memory.dmpFilesize
92KB
-
memory/1360-98-0x0000000002160000-0x0000000002177000-memory.dmpFilesize
92KB
-
memory/1360-100-0x0000000002160000-0x0000000002177000-memory.dmpFilesize
92KB