Analysis
-
max time kernel
164s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 05:19
Static task
static1
Behavioral task
behavioral1
Sample
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
Resource
win10v2004-20220812-en
General
-
Target
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
-
Size
94KB
-
MD5
dbc35cd99daa5b3f3083e911a43b7c31
-
SHA1
dcbe9859542d22bc8684d798d9f5227624f5be97
-
SHA256
47063fabbef0d6759cc4076c988760f82ba0328e878431cce6a3691d052e7b06
-
SHA512
d8212148e1c5897e1c92b2eb054c9b158eafc49fb3047fe22dd01208c1384212ab388848e746f9c37e2b561975e300fe440fdc9877411f460b4cb7c9666ca641
-
SSDEEP
1536:CvSM+QtpWT1G9NS89i4XZ0wovNOinmYbGmjBtwiRAd6S9C5Qhkxolh+:Cv3I1G9NnH8vN0eGKBqLMS9cIkxolU
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 592 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exeExplorer.EXEpid process 948 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe 948 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 948 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe Token: SeDebugPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exeExplorer.EXEdescription pid process target process PID 948 wrote to memory of 592 948 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe cmd.exe PID 948 wrote to memory of 592 948 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe cmd.exe PID 948 wrote to memory of 592 948 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe cmd.exe PID 948 wrote to memory of 592 948 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe cmd.exe PID 948 wrote to memory of 1204 948 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe Explorer.EXE PID 1204 wrote to memory of 1120 1204 Explorer.EXE taskhost.exe PID 1204 wrote to memory of 1168 1204 Explorer.EXE Dwm.exe PID 1204 wrote to memory of 592 1204 Explorer.EXE cmd.exe PID 1204 wrote to memory of 1160 1204 Explorer.EXE conhost.exe PID 1204 wrote to memory of 1160 1204 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe"C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3024~1.BAT"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "963036315-1952412037-3894554921629167763-1538750641205860071212958986331034735349"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms3024091.batFilesize
201B
MD59c30c08ff702a4af3452b41f716bbf0a
SHA1a9f08a97937fb85072640263f058d7423c284a17
SHA2566e437ed21d2f9e34800cf199a0ebe3ea3645d515f536f6efc0b13c02afef160b
SHA512cc5a1427ad792b0ff9726146c096c0623cb25ba30a2a3b91fff52f303293e575dd93c6a1cd6b2cab35051d1da970653abeecbb5186cca8b8248b2883cd76066d
-
memory/592-57-0x0000000000000000-mapping.dmp
-
memory/592-68-0x00000000000F0000-0x0000000000104000-memory.dmpFilesize
80KB
-
memory/948-54-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/948-60-0x0000000000260000-0x000000000026E000-memory.dmpFilesize
56KB
-
memory/948-63-0x0000000000BA0000-0x0000000000BBB000-memory.dmpFilesize
108KB
-
memory/1120-73-0x0000000001CB0000-0x0000000001CC7000-memory.dmpFilesize
92KB
-
memory/1120-67-0x0000000037C30000-0x0000000037C40000-memory.dmpFilesize
64KB
-
memory/1160-78-0x0000000037C30000-0x0000000037C40000-memory.dmpFilesize
64KB
-
memory/1160-79-0x0000000037C30000-0x0000000037C40000-memory.dmpFilesize
64KB
-
memory/1160-81-0x00000000000F0000-0x0000000000107000-memory.dmpFilesize
92KB
-
memory/1160-82-0x00000000000D0000-0x00000000000E7000-memory.dmpFilesize
92KB
-
memory/1168-71-0x0000000037C30000-0x0000000037C40000-memory.dmpFilesize
64KB
-
memory/1168-75-0x00000000001B0000-0x00000000001C7000-memory.dmpFilesize
92KB
-
memory/1204-69-0x0000000002A30000-0x0000000002A47000-memory.dmpFilesize
92KB
-
memory/1204-61-0x0000000037C30000-0x0000000037C40000-memory.dmpFilesize
64KB
-
memory/1204-58-0x0000000002A30000-0x0000000002A47000-memory.dmpFilesize
92KB