Analysis
-
max time kernel
163s -
max time network
250s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 08:13
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
Resource
win10v2004-20221111-en
General
-
Target
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
-
Size
171KB
-
MD5
a804f34778af2e79285fc1322f1b412e
-
SHA1
072450802be854e19fdf8e84b153e64acf37e61d
-
SHA256
787a3ec22002c515ea6093e691c4578d3872cd0e24db671122d65b19e491036b
-
SHA512
306748ac10dcc89af61d4b52f753ba44f4741a2b7b597de8bbce867cd1055640288b8e9f7cd77ebbb2f80c3bacdf3b01097c7eeb95f19285dc807e5fbc46aa9e
-
SSDEEP
3072:igpd+HKWTnOwsDBY4XAHNycjNtTUhx0faUU8EoyDElkCd:igpMHKWTDun+DU6rqYlv
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1692 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ypbkryye.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ypbkryye.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exedescription pid process target process PID 1612 set thread context of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exerechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEpid process 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1176 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1176 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1176 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe Token: SeDebugPrivilege 1268 Explorer.EXE Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exerechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEdescription pid process target process PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1612 wrote to memory of 1176 1612 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1176 wrote to memory of 1692 1176 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1176 wrote to memory of 1692 1176 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1176 wrote to memory of 1692 1176 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1176 wrote to memory of 1692 1176 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1176 wrote to memory of 1268 1176 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe Explorer.EXE PID 1268 wrote to memory of 1136 1268 Explorer.EXE taskhost.exe PID 1268 wrote to memory of 1232 1268 Explorer.EXE Dwm.exe PID 1268 wrote to memory of 1692 1268 Explorer.EXE cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms284298.bat"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms284298.batFilesize
201B
MD5ad86d80cac143da63b3a4f847db36716
SHA167ba9464badbffab6dddcd610d5b5100036b2693
SHA25612cacb7cb1a8e8c2f221f4efd806018a875c006164db8c5874e4dd8465fba94a
SHA5125a93f693311885d7327c3c5836dd2cb2f60a8c604614afb3b296849468996f2a52777a1014b27adf19f3467891d4b789f6ace143cc9b291dc731ec2fd9499b8d
-
memory/1136-85-0x0000000000450000-0x0000000000467000-memory.dmpFilesize
92KB
-
memory/1136-83-0x00000000373D0000-0x00000000373E0000-memory.dmpFilesize
64KB
-
memory/1176-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1176-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1176-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1176-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1176-64-0x00000000004010C0-mapping.dmp
-
memory/1176-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1176-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1176-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1176-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1176-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1232-84-0x00000000373D0000-0x00000000373E0000-memory.dmpFilesize
64KB
-
memory/1232-86-0x0000000000120000-0x0000000000137000-memory.dmpFilesize
92KB
-
memory/1268-75-0x00000000373D0000-0x00000000373E0000-memory.dmpFilesize
64KB
-
memory/1268-73-0x0000000002210000-0x0000000002227000-memory.dmpFilesize
92KB
-
memory/1268-87-0x0000000002210000-0x0000000002227000-memory.dmpFilesize
92KB
-
memory/1612-54-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB
-
memory/1612-68-0x0000000000230000-0x000000000023E000-memory.dmpFilesize
56KB
-
memory/1692-72-0x0000000000000000-mapping.dmp