2179e9d925687d4643b2aae2e0487730b1a225ddb81ad5f619d42d8f1746ff58

General

Target

bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
Size

164KB
MD5

b779127121ae2844dd49a63a9017fa2f
SHA1

638a99a79bc63a7211422db7b851725b62b3617b
SHA256

4241921870ae6fee9cef8a48cfa99f2189dd6d2e88ea22bff6caf6474d7d3ee0
SHA512

c43aafb393ba68406c02a507d1ad5fbc18d78625a65a4c65a5c921ad5bc0cde050a513860c1e9340d6b1dde77b687d1c1a33481e883d5f1097d159f1abab5d2d
SSDEEP

3072:ZJ/YG2oBH7RFQcISXZtYs9DiOkqBFtQhMpDhCVT1A6djL9Jf+yY:ZJ/GoJti4jFtQh2hCVTd/

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metlqowx.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\metlqowx.exe\""	Explorer.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6108B6AD-CC37-4A00-A6CD-714B5AC3CAC3}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F8BE61C4-16FA-4A0E-93D3-8C0CC9A677EF}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5040	3352	WerFault.exe	55

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
2036	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
2036	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
Token: SeDebugPrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75
PID 1544 wrote to memory of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75
PID 1544 wrote to memory of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75
PID 1544 wrote to memory of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75
PID 1544 wrote to memory of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75
PID 1544 wrote to memory of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75
PID 1544 wrote to memory of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75
PID 1544 wrote to memory of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75
PID 1544 wrote to memory of 2036	1544	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	75
PID 2036 wrote to memory of 4832	2036	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	76
PID 2036 wrote to memory of 4832	2036	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	76
PID 2036 wrote to memory of 4832	2036	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	76
PID 2036 wrote to memory of 3004	2036	bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe	58
PID 3004 wrote to memory of 2336	3004	Explorer.EXE	41
PID 3004 wrote to memory of 2360	3004	Explorer.EXE	43
PID 3004 wrote to memory of 2456	3004	Explorer.EXE	44
PID 3004 wrote to memory of 3160	3004	Explorer.EXE	54
PID 3004 wrote to memory of 3352	3004	Explorer.EXE	55
PID 3004 wrote to memory of 3456	3004	Explorer.EXE	56
PID 3004 wrote to memory of 3584	3004	Explorer.EXE	59
PID 3004 wrote to memory of 3668	3004	Explorer.EXE	60
PID 3004 wrote to memory of 3868	3004	Explorer.EXE	61
PID 3004 wrote to memory of 4836	3004	Explorer.EXE	65
PID 3004 wrote to memory of 2036	3004	Explorer.EXE	75
PID 3004 wrote to memory of 4832	3004	Explorer.EXE	76
PID 3004 wrote to memory of 2656	3004	Explorer.EXE	77

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2360

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3160

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3352 -s 856
  2⤵
  - Program crash
  PID:5040

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3456

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
  "C:\Users\Admin\AppData\Local\Temp\bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
    C:\Users\Admin\AppData\Local\Temp\bestätigung_zahlungseingang_2014_11_55_02_277_001_033_927_0983900005_0000009127_01_20.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS1883~1.BAT"
      4⤵
      PID:4832
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2656

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3584

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3668

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4836

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 3352 -ip 3352
1⤵
PID:4584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms1883223.bat

Filesize
201B

MD5
f8fe1188577948250fc45a57ec0467d1

SHA1
3a588561d856a40540f011771c1965501e620757

SHA256
b0b7fda3afc27a40eaa6a29004adf7ebff236fb76b41e763bdf7465292c2615f

SHA512
a15e5b885fa0079e7772bc5496b385f325492ca5e689165d84e7ac212842031b0911445059503b5b882c4ff3e206e97da74c11a23c99093975b73f344e36a1da

Download Submit
memory/1544-132-0x0000000000A90000-0x0000000000A94000-memory.dmp

Filesize
16KB

Download
memory/2036-140-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2036-133-0x0000000000000000-mapping.dmp

Download
memory/2036-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2036-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2036-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2336-154-0x00000205DDA30000-0x00000205DDA47000-memory.dmp

Filesize
92KB

Download
memory/2336-141-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/2360-143-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/2360-156-0x000001B2A19B0000-0x000001B2A19C7000-memory.dmp

Filesize
92KB

Download
memory/2456-157-0x000001CBB6F60000-0x000001CBB6F77000-memory.dmp

Filesize
92KB

Download
memory/2456-142-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/2656-149-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/2656-153-0x000002CD20100000-0x000002CD20117000-memory.dmp

Filesize
92KB

Download
memory/3004-139-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3004-155-0x0000000001380000-0x0000000001397000-memory.dmp

Filesize
92KB

Download
memory/3004-163-0x0000000001380000-0x0000000001397000-memory.dmp

Filesize
92KB

Download
memory/3160-158-0x00000204735C0000-0x00000204735D7000-memory.dmp

Filesize
92KB

Download
memory/3160-144-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3456-145-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3456-159-0x0000027B02000000-0x0000027B02017000-memory.dmp

Filesize
92KB

Download
memory/3584-146-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3584-160-0x0000023366830000-0x0000023366847000-memory.dmp

Filesize
92KB

Download
memory/3868-147-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3868-161-0x00000255162E0000-0x00000255162F7000-memory.dmp

Filesize
92KB

Download
memory/4832-152-0x0000000000880000-0x0000000000894000-memory.dmp

Filesize
80KB

Download
memory/4832-138-0x0000000000000000-mapping.dmp

Download
memory/4832-150-0x0000000037210000-0x0000000037220000-memory.dmp

Filesize
64KB

Download
memory/4836-148-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/4836-162-0x0000019C4D3C0000-0x0000019C4D3D7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads