65fb7625a2b1c164810a516d46cda46dc12cdbce76d989b3953ef33a5b49e0f1

General

Target

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
Size

254KB
MD5

825afbdeee126eeebae9200dd497b6fd
SHA1

59e6e30d6c386e71d54aa8f7ee53228bce17f4ea
SHA256

69e685713b90b3dd56876565c92dd47ab247cd20326b6dbc1e5792e0f1544914
SHA512

f96711b02d23d5b790eac2444de976a6e931446862c21f1f9498e79ccd021e7528772f5c551510198159e915380af7c2b23e3dfb78c69e7067d47705265c4e03
SSDEEP

6144:v86CSUrscKPe+V/3fdrQ57f+urD/CIfSDte:v8tvscA5Jfdyr3/CIGs

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1108 cmd.exe

pid	process
1108	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\""	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exeExplorer.EXE

pid	process
1808	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
1808	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE

pid	process
1400	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1808	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
Token: SeDebugPrivilege	1400	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exeExplorer.EXE

description	pid	process	target process
PID 1808 wrote to memory of 1108	1808	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 1808 wrote to memory of 1108	1808	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 1808 wrote to memory of 1108	1808	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 1808 wrote to memory of 1108	1808	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 1808 wrote to memory of 1400	1808	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	Explorer.EXE
PID 1400 wrote to memory of 1228	1400	Explorer.EXE	taskhost.exe
PID 1400 wrote to memory of 1328	1400	Explorer.EXE	Dwm.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1328

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS5967~1.BAT"
3⤵
- Deletes itself
PID:1108

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms5967899.bat
Filesize
201B

MD5
61e4c2e3cb029b6b22030c26086d8faa

SHA1
ac81ac636fd9b76f052006fa5f6a79563a7692ad

SHA256
fd16dca53c6dc7a9b496a37f3f61eeb0a4141a69a2ef23b16e9a38301702b7c7

SHA512
55216374250f57a6539def67f47702902e1e4a075e0ca711f71515f9c32112bb6f0a5dea8fb66221fb975725d69ea2bf89a896fa3a4bd32964f8c8c571375927

Download Submit
memory/1108-57-0x0000000000000000-mapping.dmp

Download
memory/1228-66-0x00000000377C0000-0x00000000377D0000-memory.dmp

Filesize
64KB

Download
memory/1228-69-0x0000000000490000-0x00000000004A7000-memory.dmp

Filesize
92KB

Download
memory/1328-67-0x00000000377C0000-0x00000000377D0000-memory.dmp

Filesize
64KB

Download
memory/1328-70-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1400-58-0x0000000002560000-0x0000000002577000-memory.dmp

Filesize
92KB

Download
memory/1400-60-0x00000000377C0000-0x00000000377D0000-memory.dmp

Filesize
64KB

Download
memory/1400-68-0x0000000002560000-0x0000000002577000-memory.dmp

Filesize
92KB

Download
memory/1400-71-0x000007FEF6D50000-0x000007FEF6E93000-memory.dmp

Filesize
1.3MB

Download
memory/1400-72-0x000007FEC86C0000-0x000007FEC86CA000-memory.dmp

Filesize
40KB

Download
memory/1808-56-0x00000000011D0000-0x0000000001212000-memory.dmp

Filesize
264KB

Download
memory/1808-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1808-55-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads