073a6c97f972f4e866d79a6ad7d19052fdc5e11fc9e4d258f018642a34f14ba2

General

Target

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Size

168KB
MD5

03bbe5696e292a27becc2197f1024a16
SHA1

59802f9b918bed69eaf113f1ab24698bd46392d0
SHA256

6452bb100340136bacfe46a6c14d211f409144fe0919768fde8feb52536583a5
SHA512

36b8b3f166e87aa9c34401159dc16d0f757d1750a66bfe580e754677c59666c000a8c92484dec025ab8ec379096e24271435f25fb9e507a36d31bfc70f1bd270
SSDEEP

3072:2dLyZlwEyKcoO29Y5eCPN2bViTphJP12EFs+NLVgu2TVAOWX:oLaw7F3CY5e+CVi/yEXlVh2hk

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metlqowx.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\metlqowx.exe\""	Explorer.EXE

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0DE75E8B-8474-421E-8A43-BADDE9E8E668}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{BBCB4F81-C2C1-4D45-8DC2-9B2EAC509B4B}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

description	pid	process	target process
PID 1544 set thread context of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4684 3352 WerFault.exe DllHost.exe

pid	pid_target	process	target process
4684	3352	WerFault.exe	DllHost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXE

pid	process
1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
3084	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
3084	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3004 Explorer.EXE

pid	process
3004	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3084	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Token: SeDebugPrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Explorer.EXE

pid process

3004 Explorer.EXE
3004 Explorer.EXE
3004 Explorer.EXE
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Explorer.EXE

pid process

3004 Explorer.EXE
3004 Explorer.EXE
3004 Explorer.EXE

pid	process
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE

pid	process
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

pid	process
1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXE

description	pid	process	target process
PID 1544 wrote to memory of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 1544 wrote to memory of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 1544 wrote to memory of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 1544 wrote to memory of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 1544 wrote to memory of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 1544 wrote to memory of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 1544 wrote to memory of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 1544 wrote to memory of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 1544 wrote to memory of 3084	1544	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 3084 wrote to memory of 4756	3084	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 3084 wrote to memory of 4756	3084	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 3084 wrote to memory of 4756	3084	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 3084 wrote to memory of 3004	3084	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	Explorer.EXE
PID 3004 wrote to memory of 2336	3004	Explorer.EXE	sihost.exe
PID 3004 wrote to memory of 2360	3004	Explorer.EXE	svchost.exe
PID 3004 wrote to memory of 2456	3004	Explorer.EXE	taskhostw.exe
PID 3004 wrote to memory of 3160	3004	Explorer.EXE	svchost.exe
PID 3004 wrote to memory of 3352	3004	Explorer.EXE	DllHost.exe
PID 3004 wrote to memory of 3456	3004	Explorer.EXE	StartMenuExperienceHost.exe
PID 3004 wrote to memory of 3584	3004	Explorer.EXE	RuntimeBroker.exe
PID 3004 wrote to memory of 3668	3004	Explorer.EXE	SearchApp.exe
PID 3004 wrote to memory of 3868	3004	Explorer.EXE	RuntimeBroker.exe
PID 3004 wrote to memory of 4836	3004	Explorer.EXE	RuntimeBroker.exe
PID 3004 wrote to memory of 4756	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 2416	3004	Explorer.EXE	Conhost.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2336

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3160

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3352

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3352 -s 892
2⤵
- Program crash
PID:4684

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3456

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3584

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3668

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4836

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004

C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3866~1.BAT"
4⤵
PID:4756

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:2416

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3352 -ip 3352
1⤵
PID:3128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms3866340.bat

Filesize
201B

MD5
8f77f71af04dd974f05b67e343ad3dd5

SHA1
cb6a75eb20073c4c4ae41fe1bbea088c7b51ecf7

SHA256
850f7115823f6621487cfc0146535d1ad376f5cced9132c85453c521beeac539

SHA512
c5f1c59584fff8389ad958981f22890139ffbad6ad22bad0c91df360c2042868644347e26fc48c7a8e5433d15744f3712397d5fc8070dc5f1197c68387972114

Download Submit
memory/1544-134-0x0000000000BC0000-0x0000000000BC4000-memory.dmp

Filesize
16KB

Download
memory/2336-153-0x00000205DDA30000-0x00000205DDA47000-memory.dmp

Filesize
92KB

Download
memory/2336-140-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/2360-141-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/2360-155-0x000001B2A19B0000-0x000001B2A19C7000-memory.dmp

Filesize
92KB

Download
memory/2416-152-0x000001658FC50000-0x000001658FC67000-memory.dmp

Filesize
92KB

Download
memory/2416-148-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/2456-156-0x000001CBB6F60000-0x000001CBB6F77000-memory.dmp

Filesize
92KB

Download
memory/2456-142-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3004-154-0x0000000001380000-0x0000000001397000-memory.dmp

Filesize
92KB

Download
memory/3004-138-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3004-162-0x0000000001380000-0x0000000001397000-memory.dmp

Filesize
92KB

Download
memory/3084-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3084-132-0x0000000000000000-mapping.dmp

Download
memory/3084-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3084-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3160-157-0x00000204735C0000-0x00000204735D7000-memory.dmp

Filesize
92KB

Download
memory/3160-143-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3456-144-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3456-158-0x0000027B02000000-0x0000027B02017000-memory.dmp

Filesize
92KB

Download
memory/3584-159-0x0000023366830000-0x0000023366847000-memory.dmp

Filesize
92KB

Download
memory/3584-145-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3868-146-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/3868-160-0x00000255162E0000-0x00000255162F7000-memory.dmp

Filesize
92KB

Download
memory/4756-137-0x0000000000000000-mapping.dmp

Download
memory/4756-151-0x00000000000C0000-0x00000000000D4000-memory.dmp

Filesize
80KB

Download
memory/4756-149-0x0000000037210000-0x0000000037220000-memory.dmp

Filesize
64KB

Download
memory/4836-147-0x00007FFD4B270000-0x00007FFD4B280000-memory.dmp

Filesize
64KB

Download
memory/4836-161-0x0000019C4D3C0000-0x0000019C4D3D7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads