c05bd45fbe4f7f7d23811574fa1477df89127cf55ae530bcfac6c8912a9b399d

General

Target

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Size

168KB
MD5

03bbe5696e292a27becc2197f1024a16
SHA1

59802f9b918bed69eaf113f1ab24698bd46392d0
SHA256

6452bb100340136bacfe46a6c14d211f409144fe0919768fde8feb52536583a5
SHA512

36b8b3f166e87aa9c34401159dc16d0f757d1750a66bfe580e754677c59666c000a8c92484dec025ab8ec379096e24271435f25fb9e507a36d31bfc70f1bd270
SSDEEP

3072:2dLyZlwEyKcoO29Y5eCPN2bViTphJP12EFs+NLVgu2TVAOWX:oLaw7F3CY5e+CVi/yEXlVh2hk

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metlqowx.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\metlqowx.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

description	pid	process	target process
PID 2016 set thread context of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1916 3284 WerFault.exe DllHost.exe

pid	pid_target	process	target process
1916	3284	WerFault.exe	DllHost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeonline_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

pid	process
2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
4884	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
4884	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
3060	Explorer.EXE
3060	Explorer.EXE
3060	Explorer.EXE
3060	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3060 Explorer.EXE

pid	process
3060	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXERuntimeBroker.exe

description	pid	process
Token: SeDebugPrivilege	4884	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Token: SeDebugPrivilege	3060	Explorer.EXE
Token: SeShutdownPrivilege	3060	Explorer.EXE
Token: SeCreatePagefilePrivilege	3060	Explorer.EXE
Token: SeShutdownPrivilege	3444	RuntimeBroker.exe
Token: SeShutdownPrivilege	3444	RuntimeBroker.exe
Token: SeShutdownPrivilege	3444	RuntimeBroker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

pid	process
2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeonline_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

description	pid	process	target process
PID 2016 wrote to memory of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2016 wrote to memory of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2016 wrote to memory of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2016 wrote to memory of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2016 wrote to memory of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2016 wrote to memory of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2016 wrote to memory of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2016 wrote to memory of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2016 wrote to memory of 4884	2016	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 4884 wrote to memory of 1732	4884	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 4884 wrote to memory of 1732	4884	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 4884 wrote to memory of 1732	4884	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 4884 wrote to memory of 3060	4884	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	Explorer.EXE
PID 3060 wrote to memory of 2368	3060	Explorer.EXE	sihost.exe
PID 3060 wrote to memory of 2388	3060	Explorer.EXE	svchost.exe
PID 3060 wrote to memory of 2476	3060	Explorer.EXE	taskhostw.exe
PID 3060 wrote to memory of 3080	3060	Explorer.EXE	svchost.exe
PID 3060 wrote to memory of 3284	3060	Explorer.EXE	DllHost.exe
PID 3060 wrote to memory of 3368	3060	Explorer.EXE	StartMenuExperienceHost.exe
PID 3060 wrote to memory of 3444	3060	Explorer.EXE	RuntimeBroker.exe
PID 3060 wrote to memory of 3528	3060	Explorer.EXE	SearchApp.exe
PID 3060 wrote to memory of 3728	3060	Explorer.EXE	RuntimeBroker.exe
PID 3060 wrote to memory of 4712	3060	Explorer.EXE	RuntimeBroker.exe
PID 3060 wrote to memory of 4884	3060	Explorer.EXE	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 3060 wrote to memory of 1732	3060	Explorer.EXE	cmd.exe
PID 3060 wrote to memory of 1696	3060	Explorer.EXE	Conhost.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3528

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4712

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3728

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3368

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3284

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3284 -s 660
2⤵
- Program crash
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3080

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
"C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6632~1.BAT"
4⤵
PID:1732

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:1696

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2476

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3284 -ip 3284
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms6632330.bat

Filesize
201B

MD5
890e73172e03197add34e62cfe2bc57e

SHA1
c613a8d3ecf1f76f2d8cf7a224bab797c682d012

SHA256
0b63c171b0d6bd2349d08d3ac39449844b1c5e79656d32fb176e486f63e28674

SHA512
f0556cd7eaa87c7d7530a05d4151d1e36cefc372e32ea30062532ff41135bbdad57fdad55ec923e56848c5e22735948baafbf70dde34901bd93658a9348ed30e

Download Submit
memory/1696-148-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/1696-158-0x00000271A90A0000-0x00000271A90B7000-memory.dmp

Filesize
92KB

Download
memory/1732-137-0x0000000000000000-mapping.dmp

Download
memory/1732-161-0x00000000004D0000-0x00000000004E4000-memory.dmp

Filesize
80KB

Download
memory/1732-159-0x0000000037830000-0x0000000037840000-memory.dmp

Filesize
64KB

Download
memory/2016-135-0x0000000000800000-0x0000000000804000-memory.dmp

Filesize
16KB

Download
memory/2368-141-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/2368-149-0x000001CE5DF10000-0x000001CE5DF27000-memory.dmp

Filesize
92KB

Download
memory/2388-151-0x000001E89C120000-0x000001E89C137000-memory.dmp

Filesize
92KB

Download
memory/2388-140-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/2476-142-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/2476-152-0x00000157E61E0000-0x00000157E61F7000-memory.dmp

Filesize
92KB

Download
memory/3060-162-0x00000000033B0000-0x00000000033C7000-memory.dmp

Filesize
92KB

Download
memory/3060-138-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/3060-150-0x00000000033B0000-0x00000000033C7000-memory.dmp

Filesize
92KB

Download
memory/3080-153-0x00000210D1520000-0x00000210D1537000-memory.dmp

Filesize
92KB

Download
memory/3080-143-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/3368-154-0x0000022627AB0000-0x0000022627AC7000-memory.dmp

Filesize
92KB

Download
memory/3368-144-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/3444-145-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/3444-155-0x0000025196B80000-0x0000025196B97000-memory.dmp

Filesize
92KB

Download
memory/3728-156-0x000002233ED30000-0x000002233ED47000-memory.dmp

Filesize
92KB

Download
memory/3728-146-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/4712-147-0x00007FF7EA050000-0x00007FF7EA060000-memory.dmp

Filesize
64KB

Download
memory/4712-157-0x0000021811B40000-0x0000021811B57000-memory.dmp

Filesize
92KB

Download
memory/4884-132-0x0000000000000000-mapping.dmp

Download
memory/4884-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4884-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4884-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads