Analysis
-
max time kernel
155s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:23
Static task
static1
Behavioral task
behavioral1
Sample
2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Resource
win10v2004-20220812-en
General
-
Target
2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
-
Size
188KB
-
MD5
e3ace455382fa7708264257983339263
-
SHA1
ab979cc544c46903d41fe773c568e2fa54a9bc44
-
SHA256
f2d682b9bd2857603944471a9baf4a8d83a897d7be57dbf473c8f07fd8f5ed1a
-
SHA512
be4a8e0770d30eb888a27490954b6109353673234f3b30b3c384d624ff79f3171a3ffff310883cb2f0930f0c64edb716171a78b3a166b44d855c08a0742c46ff
-
SSDEEP
3072:gudusODvGZVHhS1drkr3k1hsz3F8ol/Lg7Qir8B/xjcbfMrRPyczWIqT9tYhOddx:k9+phSzOFUs/F08PLWIqT2M
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 468 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exedescription pid process target process PID 1552 set thread context of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXEpid process 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 1468 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 1468 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1468 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe Token: SeDebugPrivilege 1272 Explorer.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exepid process 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXEdescription pid process target process PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1552 wrote to memory of 1468 1552 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe PID 1468 wrote to memory of 468 1468 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe cmd.exe PID 1468 wrote to memory of 468 1468 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe cmd.exe PID 1468 wrote to memory of 468 1468 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe cmd.exe PID 1468 wrote to memory of 468 1468 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe cmd.exe PID 1468 wrote to memory of 1272 1468 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe Explorer.EXE PID 1272 wrote to memory of 1124 1272 Explorer.EXE taskhost.exe PID 1272 wrote to memory of 1184 1272 Explorer.EXE Dwm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe"C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeC:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3818~1.BAT"3⤵
- Deletes itself
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms3818398.batFilesize
201B
MD55891d3036c8dbf331b5a34395e4b81e0
SHA1446fc77adf2ed4b0d99dade53fac522dea014a54
SHA256e2b6c26f7868bc0b39128e531e8b87f73431ef1c4d8aa7be9014ffbda83dfdbf
SHA5126f7c171e925e0672347ae4f56646f64d42229b18f43531de7708baf8ad3a2a00a77681c606690c845e7cf7e4539aa86ecc1cc4f992d8adea0c30492e5589d371
-
memory/468-71-0x0000000000000000-mapping.dmp
-
memory/1124-80-0x0000000037A80000-0x0000000037A90000-memory.dmpFilesize
64KB
-
memory/1124-84-0x0000000001D20000-0x0000000001D37000-memory.dmpFilesize
92KB
-
memory/1184-85-0x0000000001BA0000-0x0000000001BB7000-memory.dmpFilesize
92KB
-
memory/1184-82-0x0000000037A80000-0x0000000037A90000-memory.dmpFilesize
64KB
-
memory/1272-72-0x0000000002B70000-0x0000000002B87000-memory.dmpFilesize
92KB
-
memory/1272-83-0x0000000002B70000-0x0000000002B87000-memory.dmpFilesize
92KB
-
memory/1272-75-0x0000000037A80000-0x0000000037A90000-memory.dmpFilesize
64KB
-
memory/1468-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1468-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1468-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1468-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1468-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1468-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1468-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1468-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1468-64-0x00000000004010C0-mapping.dmp
-
memory/1552-65-0x00000000002F0000-0x00000000002F4000-memory.dmpFilesize
16KB
-
memory/1552-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB