Analysis

  • max time kernel
    147s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 04:21

General

  • Target

    2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

  • Size

    168KB

  • MD5

    bbf602cc98f05af58228dfc975622b04

  • SHA1

    70fb72c5217aed3c52349a3a92fda087297203b5

  • SHA256

    64dbe523c9ff1558fedaba3d2fc6476893cb2286703e69bcb30eb3015f5bd82a

  • SHA512

    bc1e3819532e0cbcc7377c5e64cb100ef211a9e6b502f0d36a14ec0b80d2378e28d3263d64071448901a8096e904a7e845124a5d7ecc2c670459f1d6e783cfcd

  • SSDEEP

    3072:lfmAD4c6xEGUAV31hECI115hswWe25ZU6GEAE+YBTVdX7lqEd+zr3/1C:lfYc6EGUYhECI3pTqjhC0fUlM

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1232
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
        "C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:784
        • C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
          C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms284298.bat"
            4⤵
            • Deletes itself
            PID:936
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1312
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-1886122406-464550938-1526366883731401244-1882839776-1779563711-310213314-1272719216"
        1⤵
          PID:2000

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms284298.bat

          Filesize

          201B

          MD5

          763598dae3c37acfb6a6d97a05cd88ad

          SHA1

          28f44b6258696c87b77c9e36d55f234d6f23b397

          SHA256

          a18c505e7ded549c395d5ba64d5e9f9856fa4ad6c0e0f8302c0e72886cb73682

          SHA512

          8fdadfc37e66a0af0490d43aff4b1e7253b4e758b77e5eb6dc5f56a93b7ffd1f23a96b982cd45b8135874244f47d8da6fa32ada36ee44ca30a6b1feef3618f07

        • memory/784-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

          Filesize

          8KB

        • memory/784-65-0x0000000000390000-0x0000000000394000-memory.dmp

          Filesize

          16KB

        • memory/936-72-0x0000000000000000-mapping.dmp

        • memory/936-80-0x0000000000130000-0x0000000000144000-memory.dmp

          Filesize

          80KB

        • memory/1232-83-0x0000000036E90000-0x0000000036EA0000-memory.dmp

          Filesize

          64KB

        • memory/1232-92-0x0000000001BC0000-0x0000000001BD7000-memory.dmp

          Filesize

          92KB

        • memory/1312-84-0x0000000036E90000-0x0000000036EA0000-memory.dmp

          Filesize

          64KB

        • memory/1312-93-0x0000000001AC0000-0x0000000001AD7000-memory.dmp

          Filesize

          92KB

        • memory/1360-91-0x00000000026E0000-0x00000000026F7000-memory.dmp

          Filesize

          92KB

        • memory/1360-73-0x00000000026E0000-0x00000000026F7000-memory.dmp

          Filesize

          92KB

        • memory/1360-75-0x0000000036E90000-0x0000000036EA0000-memory.dmp

          Filesize

          64KB

        • memory/2000-90-0x00000000000D0000-0x00000000000E7000-memory.dmp

          Filesize

          92KB

        • memory/2000-88-0x0000000036E90000-0x0000000036EA0000-memory.dmp

          Filesize

          64KB

        • memory/2028-62-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2028-71-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2028-67-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2028-64-0x00000000004010C0-mapping.dmp

        • memory/2028-63-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2028-60-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2028-55-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2028-56-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2028-58-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB