5ee6a861ebf7cdd9dce69562dd425c257b99ef116cbdf9d25156e366ae636df0

General

Target

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Size

168KB
MD5

f914047ba6e8f5bbc2eb67c2bf8336ee
SHA1

a90281ee27ac6d692fbc245e0ea688f3f9c860a2
SHA256

03baf1186fd318f5ed6ee848201f5f998c873cecaa2ec3313d6d60e17d78f4dd
SHA512

46c448718d92e834f410de23485d30848db8246ffd9d79fc5fe9575d7aa1a55cb646803dadeace3a4c891bbc9ba8cb2f46bc26285f6efc5c3a1030ab28502a1a
SSDEEP

3072:mdLyZlwEyKcoO29Y5eCPN2bViTphJP12EFs+NLVgu2TVAOWX:4Law7F3CY5e+CVi/yEXlVh2hk

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jvscicod.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\jvscicod.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4688 set thread context of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4284	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4284	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
2084	Explorer.EXE
2084	Explorer.EXE
2084	Explorer.EXE
2084	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Token: SeDebugPrivilege	2084	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84
PID 4688 wrote to memory of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84
PID 4688 wrote to memory of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84
PID 4688 wrote to memory of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84
PID 4688 wrote to memory of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84
PID 4688 wrote to memory of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84
PID 4688 wrote to memory of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84
PID 4688 wrote to memory of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84
PID 4688 wrote to memory of 4284	4688	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	84
PID 4284 wrote to memory of 2188	4284	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	85
PID 4284 wrote to memory of 2188	4284	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	85
PID 4284 wrote to memory of 2188	4284	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	85
PID 4284 wrote to memory of 2084	4284	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	19

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084
- C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
  "C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
    C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS4630~1.BAT"
      4⤵
      PID:2188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-138-0x00007FFACD910000-0x00007FFACD920000-memory.dmp

Filesize
64KB

Download
memory/4284-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4284-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4284-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4688-134-0x0000000002360000-0x0000000002364000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing