affa1589d3a5e43e4ef234a89add793dee6457b85365d95caec3e750ccd4fe0f

General

Target

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Size

168KB
MD5

bbf602cc98f05af58228dfc975622b04
SHA1

70fb72c5217aed3c52349a3a92fda087297203b5
SHA256

64dbe523c9ff1558fedaba3d2fc6476893cb2286703e69bcb30eb3015f5bd82a
SHA512

bc1e3819532e0cbcc7377c5e64cb100ef211a9e6b502f0d36a14ec0b80d2378e28d3263d64071448901a8096e904a7e845124a5d7ecc2c670459f1d6e783cfcd
SSDEEP

3072:lfmAD4c6xEGUAV31hECI115hswWe25ZU6GEAE+YBTVdX7lqEd+zr3/1C:lfYc6EGUYhECI3pTqjhC0fUlM

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metlqowx.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\metlqowx.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

description	pid	process	target process
PID 5056 set thread context of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1948 3252 WerFault.exe DllHost.exe

pid	pid_target	process	target process
1948	3252	WerFault.exe	DllHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXE

pid	process
5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4948	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
4948	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
2376	Explorer.EXE
2376	Explorer.EXE
2376	Explorer.EXE
2376	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2376 Explorer.EXE

pid	process
2376	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXERuntimeBroker.exe

description	pid	process
Token: SeDebugPrivilege	4948	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Token: SeDebugPrivilege	2376	Explorer.EXE
Token: SeShutdownPrivilege	2376	Explorer.EXE
Token: SeCreatePagefilePrivilege	2376	Explorer.EXE
Token: SeShutdownPrivilege	3492	RuntimeBroker.exe
Token: SeShutdownPrivilege	3492	RuntimeBroker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

pid	process
5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXE

description	pid	process	target process
PID 5056 wrote to memory of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 5056 wrote to memory of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 5056 wrote to memory of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 5056 wrote to memory of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 5056 wrote to memory of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 5056 wrote to memory of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 5056 wrote to memory of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 5056 wrote to memory of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 5056 wrote to memory of 4948	5056	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 4948 wrote to memory of 3156	4948	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 4948 wrote to memory of 3156	4948	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 4948 wrote to memory of 3156	4948	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 4948 wrote to memory of 2376	4948	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	Explorer.EXE
PID 2376 wrote to memory of 2296	2376	Explorer.EXE	sihost.exe
PID 2376 wrote to memory of 2308	2376	Explorer.EXE	svchost.exe
PID 2376 wrote to memory of 2472	2376	Explorer.EXE	taskhostw.exe
PID 2376 wrote to memory of 1352	2376	Explorer.EXE	svchost.exe
PID 2376 wrote to memory of 3252	2376	Explorer.EXE	DllHost.exe
PID 2376 wrote to memory of 3404	2376	Explorer.EXE	StartMenuExperienceHost.exe
PID 2376 wrote to memory of 3492	2376	Explorer.EXE	RuntimeBroker.exe
PID 2376 wrote to memory of 3576	2376	Explorer.EXE	SearchApp.exe
PID 2376 wrote to memory of 3828	2376	Explorer.EXE	RuntimeBroker.exe
PID 2376 wrote to memory of 4872	2376	Explorer.EXE	RuntimeBroker.exe
PID 2376 wrote to memory of 3156	2376	Explorer.EXE	cmd.exe
PID 2376 wrote to memory of 3752	2376	Explorer.EXE	Conhost.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2296

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3404

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3252 -s 968
2⤵
- Program crash
PID:1948

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3828

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1352

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056

C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS5274~1.BAT"
4⤵
PID:3156

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:3752

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2308

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 3252 -ip 3252
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms5274230.bat

Filesize
201B

MD5
904390a3413ee6d4bd480516015d2e3c

SHA1
7718d4394cc3b9cf3b1fdca92c1b70b9ac4f05b4

SHA256
8fd6f1a0f1b00103fcf855fdc0da68a58dccc21fbff516b2937df3633000207a

SHA512
c0aaaa9c57163e3c7a997990d2009429b1a0a9767921903caa59bd47e3f5ca19d29a6cd541fc951f3c96d5763d92c80612046efac2c2d74f8873856ddeaffa60

Download Submit
memory/1352-155-0x000001EBAD3E0000-0x000001EBAD3F7000-memory.dmp

Filesize
92KB

Download
memory/1352-144-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/2296-141-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/2296-150-0x000001680EF30000-0x000001680EF47000-memory.dmp

Filesize
92KB

Download
memory/2308-154-0x000001F4CBBA0000-0x000001F4CBBB7000-memory.dmp

Filesize
92KB

Download
memory/2308-142-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/2376-140-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/2376-163-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/2376-151-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/2472-143-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/2472-153-0x0000021826800000-0x0000021826817000-memory.dmp

Filesize
92KB

Download
memory/3156-162-0x0000000000250000-0x0000000000264000-memory.dmp

Filesize
80KB

Download
memory/3156-138-0x0000000000000000-mapping.dmp

Download
memory/3156-152-0x00000000374B0000-0x00000000374C0000-memory.dmp

Filesize
64KB

Download
memory/3404-145-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/3404-156-0x00000202EFA20000-0x00000202EFA37000-memory.dmp

Filesize
92KB

Download
memory/3492-146-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/3492-157-0x0000014DAD580000-0x0000014DAD597000-memory.dmp

Filesize
92KB

Download
memory/3752-160-0x0000024085DF0000-0x0000024085E07000-memory.dmp

Filesize
92KB

Download
memory/3752-149-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/3828-148-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/3828-158-0x0000021307A40000-0x0000021307A57000-memory.dmp

Filesize
92KB

Download
memory/4872-147-0x00007FFB88250000-0x00007FFB88260000-memory.dmp

Filesize
64KB

Download
memory/4872-159-0x000001687E7D0000-0x000001687E7E7000-memory.dmp

Filesize
92KB

Download
memory/4948-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4948-132-0x0000000000000000-mapping.dmp

Download
memory/4948-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4948-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4948-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5056-136-0x0000000002420000-0x0000000002424000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads