3b18b07b2ed62bac1c98c8d4635a53a2991eb108c910d4dc508f05ae27d6263e

General

Target

2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe
Size

277KB
MD5

6f4d475eb0cb95a0bf8ab9825403253d
SHA1

b2f4bf05e102823c97b2a6a4b00c4183073d93a4
SHA256

cae0331cddf01777e3b1c275240b988c675527a4e9f72f91ffe4c0e8d68f73e4
SHA512

384ccff8f308e901bde57c65f76aa0f501019cb709b47c041fa1c234d81f77da08980b7c757b22a83ebafe720a3aa7d676528a988d2a3b35cb80f5a91f51382e
SSDEEP

6144:diaYUpwXV9RIKWn/TUVs8oL48N8lqFzc+tRJShtS:jzXrN8UbtPShI

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1072 cmd.exe

pid	process
1072	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\""	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exeExplorer.EXE

pid	process
740	2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe
740	2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe
1392	Explorer.EXE
1392	Explorer.EXE
1392	Explorer.EXE
1392	Explorer.EXE
1392	Explorer.EXE
1392	Explorer.EXE
1392	Explorer.EXE
1392	Explorer.EXE
1392	Explorer.EXE
1392	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	740	2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe
Token: SeDebugPrivilege	1392	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
1392 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
1392 Explorer.EXE

pid	process
1392	Explorer.EXE
1392	Explorer.EXE

pid	process
1392	Explorer.EXE
1392	Explorer.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exeExplorer.EXE

description	pid	process	target process
PID 740 wrote to memory of 1072	740	2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe	cmd.exe
PID 740 wrote to memory of 1072	740	2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe	cmd.exe
PID 740 wrote to memory of 1072	740	2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe	cmd.exe
PID 740 wrote to memory of 1072	740	2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe	cmd.exe
PID 740 wrote to memory of 1392	740	2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe	Explorer.EXE
PID 1392 wrote to memory of 1240	1392	Explorer.EXE	taskhost.exe
PID 1392 wrote to memory of 1336	1392	Explorer.EXE	Dwm.exe
PID 1392 wrote to memory of 1072	1392	Explorer.EXE	cmd.exe
PID 1392 wrote to memory of 1924	1392	Explorer.EXE	conhost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Local\Temp\2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3818~1.BAT"
3⤵
- Deletes itself
PID:1072

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1336

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1240

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-564256041149079504577220460514268873734364839-802214138804075231336996315"
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms3818398.bat

Filesize
201B

MD5
5891d3036c8dbf331b5a34395e4b81e0

SHA1
446fc77adf2ed4b0d99dade53fac522dea014a54

SHA256
e2b6c26f7868bc0b39128e531e8b87f73431ef1c4d8aa7be9014ffbda83dfdbf

SHA512
6f7c171e925e0672347ae4f56646f64d42229b18f43531de7708baf8ad3a2a00a77681c606690c845e7cf7e4539aa86ecc1cc4f992d8adea0c30492e5589d371

Download Submit
memory/740-63-0x0000000001300000-0x000000000134C000-memory.dmp

Filesize
304KB

Download
memory/740-60-0x00000000000F0000-0x00000000000FE000-memory.dmp

Filesize
56KB

Download
memory/740-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1072-57-0x0000000000000000-mapping.dmp

Download
memory/1072-69-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download
memory/1240-67-0x0000000037170000-0x0000000037180000-memory.dmp

Filesize
64KB

Download
memory/1240-74-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download
memory/1336-72-0x0000000037170000-0x0000000037180000-memory.dmp

Filesize
64KB

Download
memory/1336-75-0x0000000000120000-0x0000000000137000-memory.dmp

Filesize
92KB

Download
memory/1392-58-0x00000000021F0000-0x0000000002207000-memory.dmp

Filesize
92KB

Download
memory/1392-62-0x0000000037170000-0x0000000037180000-memory.dmp

Filesize
64KB

Download
memory/1392-73-0x00000000021F0000-0x0000000002207000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads