Analysis

  • max time kernel
    148s
  • max time network
    169s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 04:14

General

  • Target

    rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

  • Size

    168KB

  • MD5

    03bbe5696e292a27becc2197f1024a16

  • SHA1

    59802f9b918bed69eaf113f1ab24698bd46392d0

  • SHA256

    6452bb100340136bacfe46a6c14d211f409144fe0919768fde8feb52536583a5

  • SHA512

    36b8b3f166e87aa9c34401159dc16d0f757d1750a66bfe580e754677c59666c000a8c92484dec025ab8ec379096e24271435f25fb9e507a36d31bfc70f1bd270

  • SSDEEP

    3072:2dLyZlwEyKcoO29Y5eCPN2bViTphJP12EFs+NLVgu2TVAOWX:oLaw7F3CY5e+CVi/yEXlVh2hk

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1144
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
        "C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
          C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1548
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3907~1.BAT"
            4⤵
            • Deletes itself
            PID:1704
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1240
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-477293407-1118318300-1265302866-1255667971-93332703-275156726205790696-1811526107"
        1⤵
          PID:1384

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms3907252.bat

          Filesize

          201B

          MD5

          1a403b47535cb1ba8d2be155d6f11618

          SHA1

          33833476077beb8138a2e94e05d5e9e83c03d7a2

          SHA256

          a013cc510f0e9344a2cdeffe4aad36333f7265f936cf27e9a3c3f466073738de

          SHA512

          ea9cdc735bb55c1fb90bac184c13c5801c33665e82c21c58aa5169461b89b32d81c1214f63c9cd8c650964b2e31563eb21f4beee72b57aa451e682d724c6d375

        • memory/1004-54-0x0000000075211000-0x0000000075213000-memory.dmp

          Filesize

          8KB

        • memory/1004-65-0x00000000002F0000-0x00000000002F4000-memory.dmp

          Filesize

          16KB

        • memory/1144-94-0x0000000000620000-0x0000000000637000-memory.dmp

          Filesize

          92KB

        • memory/1144-82-0x0000000037470000-0x0000000037480000-memory.dmp

          Filesize

          64KB

        • memory/1240-95-0x00000000019C0000-0x00000000019D7000-memory.dmp

          Filesize

          92KB

        • memory/1240-84-0x0000000037470000-0x0000000037480000-memory.dmp

          Filesize

          64KB

        • memory/1276-72-0x0000000002960000-0x0000000002977000-memory.dmp

          Filesize

          92KB

        • memory/1276-93-0x0000000002960000-0x0000000002977000-memory.dmp

          Filesize

          92KB

        • memory/1276-75-0x0000000037470000-0x0000000037480000-memory.dmp

          Filesize

          64KB

        • memory/1548-62-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1548-74-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1548-67-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1548-80-0x0000000000260000-0x0000000000274000-memory.dmp

          Filesize

          80KB

        • memory/1548-64-0x00000000004010C0-mapping.dmp

        • memory/1548-63-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1548-60-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1548-58-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1548-56-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1548-55-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1704-71-0x0000000000000000-mapping.dmp

        • memory/1704-91-0x00000000004E0000-0x00000000004F4000-memory.dmp

          Filesize

          80KB

        • memory/1704-87-0x0000000037620000-0x0000000037630000-memory.dmp

          Filesize

          64KB