Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 04:17

General

  • Target

    rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

  • Size

    168KB

  • MD5

    03bbe5696e292a27becc2197f1024a16

  • SHA1

    59802f9b918bed69eaf113f1ab24698bd46392d0

  • SHA256

    6452bb100340136bacfe46a6c14d211f409144fe0919768fde8feb52536583a5

  • SHA512

    36b8b3f166e87aa9c34401159dc16d0f757d1750a66bfe580e754677c59666c000a8c92484dec025ab8ec379096e24271435f25fb9e507a36d31bfc70f1bd270

  • SSDEEP

    3072:2dLyZlwEyKcoO29Y5eCPN2bViTphJP12EFs+NLVgu2TVAOWX:oLaw7F3CY5e+CVi/yEXlVh2hk

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1124
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1188
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
          "C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1396
          • C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
            C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1388
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9336~1.BAT"
              4⤵
              • Deletes itself
              PID:688
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-2093172229-5435829267299051841464804896-8077552191739226785-1507399985-722919888"
        1⤵
          PID:548

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms9336058.bat

          Filesize

          201B

          MD5

          4777d531ba3fd10fbe004d7e2887cdaa

          SHA1

          5854a210c32a34b3dc7124788382f7ac9015ad87

          SHA256

          362d5b246b91bbdffda3721e4155078b2f235487745ebf8001e489672505e032

          SHA512

          6941009902e50b543579945340c5bf13827dfa4a552f9c55e7999cf057895606317fe7b2eadfb02da39c71583a60e08d988610646c984dbe0c7ef0631f5a7938

        • memory/548-98-0x0000000000160000-0x0000000000177000-memory.dmp

          Filesize

          92KB

        • memory/548-97-0x0000000000180000-0x0000000000197000-memory.dmp

          Filesize

          92KB

        • memory/548-96-0x0000000037350000-0x0000000037360000-memory.dmp

          Filesize

          64KB

        • memory/548-95-0x0000000037350000-0x0000000037360000-memory.dmp

          Filesize

          64KB

        • memory/688-84-0x00000000000A0000-0x00000000000B4000-memory.dmp

          Filesize

          80KB

        • memory/688-71-0x0000000000000000-mapping.dmp

        • memory/1124-103-0x0000000001C40000-0x0000000001C57000-memory.dmp

          Filesize

          92KB

        • memory/1124-101-0x0000000001DC0000-0x0000000001DD7000-memory.dmp

          Filesize

          92KB

        • memory/1124-93-0x0000000037350000-0x0000000037360000-memory.dmp

          Filesize

          64KB

        • memory/1124-91-0x0000000037350000-0x0000000037360000-memory.dmp

          Filesize

          64KB

        • memory/1188-90-0x0000000037350000-0x0000000037360000-memory.dmp

          Filesize

          64KB

        • memory/1188-102-0x00000000001A0000-0x00000000001B7000-memory.dmp

          Filesize

          92KB

        • memory/1188-100-0x00000000001C0000-0x00000000001D7000-memory.dmp

          Filesize

          92KB

        • memory/1188-92-0x0000000037350000-0x0000000037360000-memory.dmp

          Filesize

          64KB

        • memory/1228-72-0x0000000002960000-0x0000000002977000-memory.dmp

          Filesize

          92KB

        • memory/1228-75-0x0000000037350000-0x0000000037360000-memory.dmp

          Filesize

          64KB

        • memory/1228-99-0x0000000002960000-0x0000000002977000-memory.dmp

          Filesize

          92KB

        • memory/1388-56-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1388-62-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1388-60-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1388-58-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1388-55-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1388-74-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1388-63-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1388-67-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1388-64-0x00000000004010C0-mapping.dmp

        • memory/1396-54-0x00000000754C1000-0x00000000754C3000-memory.dmp

          Filesize

          8KB

        • memory/1396-65-0x00000000002C0000-0x00000000002C4000-memory.dmp

          Filesize

          16KB