Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 04:10

General

  • Target

    bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe

  • Size

    164KB

  • MD5

    b779127121ae2844dd49a63a9017fa2f

  • SHA1

    638a99a79bc63a7211422db7b851725b62b3617b

  • SHA256

    4241921870ae6fee9cef8a48cfa99f2189dd6d2e88ea22bff6caf6474d7d3ee0

  • SHA512

    c43aafb393ba68406c02a507d1ad5fbc18d78625a65a4c65a5c921ad5bc0cde050a513860c1e9340d6b1dde77b687d1c1a33481e883d5f1097d159f1abab5d2d

  • SSDEEP

    3072:ZJ/YG2oBH7RFQcISXZtYs9DiOkqBFtQhMpDhCVT1A6djL9Jf+yY:ZJ/GoJti4jFtQh2hCVTd/

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
      "C:\Users\Admin\AppData\Local\Temp\bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Users\Admin\AppData\Local\Temp\bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
        C:\Users\Admin\AppData\Local\Temp\bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2925~1.BAT"
          4⤵
          • Deletes itself
          PID:1116
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1336
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1260
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-163351683621330329862053060700-1521979429-1959676713-168701753410111669381152010898"
        1⤵
          PID:2028

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms2925246.bat

          Filesize

          201B

          MD5

          b531b949477b7d800d5c3a539ab651a2

          SHA1

          e59b50b4a9f3e3be51ef0fdcafa2a017bc36508a

          SHA256

          7a7d918461f5fe95e33d40190f44aee538c4e8c540f239582e709241f7d008ff

          SHA512

          ceea9dbdb03b7ccc843f043b3cdbd1ee27d37ec0311de1bcfa6d661ea4dcf0fa03643781bcc184de14b358e05df57008429c444b2cb333a976ed41051338b0a4

        • memory/1096-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

          Filesize

          8KB

        • memory/1096-65-0x00000000002F0000-0x00000000002F4000-memory.dmp

          Filesize

          16KB

        • memory/1116-71-0x0000000000000000-mapping.dmp

        • memory/1116-82-0x00000000000F0000-0x0000000000104000-memory.dmp

          Filesize

          80KB

        • memory/1260-90-0x0000000037A50000-0x0000000037A60000-memory.dmp

          Filesize

          64KB

        • memory/1260-84-0x0000000037A50000-0x0000000037A60000-memory.dmp

          Filesize

          64KB

        • memory/1260-96-0x0000000001DF0000-0x0000000001E07000-memory.dmp

          Filesize

          92KB

        • memory/1260-94-0x0000000001E10000-0x0000000001E27000-memory.dmp

          Filesize

          92KB

        • memory/1336-89-0x0000000037A50000-0x0000000037A60000-memory.dmp

          Filesize

          64KB

        • memory/1336-97-0x00000000019C0000-0x00000000019D7000-memory.dmp

          Filesize

          92KB

        • memory/1412-95-0x0000000002220000-0x0000000002237000-memory.dmp

          Filesize

          92KB

        • memory/1412-72-0x0000000002220000-0x0000000002237000-memory.dmp

          Filesize

          92KB

        • memory/1412-74-0x0000000037A50000-0x0000000037A60000-memory.dmp

          Filesize

          64KB

        • memory/1628-75-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1628-67-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1628-64-0x00000000004010C0-mapping.dmp

        • memory/1628-63-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1628-62-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1628-60-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1628-55-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1628-58-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1628-56-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2028-93-0x0000000001B00000-0x0000000001B17000-memory.dmp

          Filesize

          92KB

        • memory/2028-92-0x0000000037A50000-0x0000000037A60000-memory.dmp

          Filesize

          64KB