Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 08:15
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
Resource
win10v2004-20221111-en
General
-
Target
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe
-
Size
176KB
-
MD5
4a1d13a05a93cfaa8dd2627c696d2f0b
-
SHA1
173c81da2aab91f225f8eb5e8fcc87119be4eff0
-
SHA256
03f825726fdf3341bcfa36fcfd6dcd08e9d7ec3df982f7af9a290aa6f3c5647c
-
SHA512
29269b35d3b041ccf08d2351e4f3fa906ed396e5a880b357398f2f72ba7a20ff870531b2d7febaa1e4173412074d6bc7bee5723ad683011ee4a247fb683e7301
-
SSDEEP
3072:q6AMa+ceqZl+r4okWL23kjsZUQoRyV01WZIrLwwWyKdMd9zfp0T0:VfzsbWa3hZUHRHwwWy8UO4
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1528 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEpid process 1464 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1464 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEpid process 1464 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe 1360 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1464 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe Token: SeDebugPrivilege 1360 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exeExplorer.EXEdescription pid process target process PID 1464 wrote to memory of 1528 1464 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1464 wrote to memory of 1528 1464 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1464 wrote to memory of 1528 1464 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1464 wrote to memory of 1528 1464 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe cmd.exe PID 1464 wrote to memory of 1360 1464 rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe Explorer.EXE PID 1360 wrote to memory of 1228 1360 Explorer.EXE taskhost.exe PID 1360 wrote to memory of 1308 1360 Explorer.EXE Dwm.exe PID 1360 wrote to memory of 1464 1360 Explorer.EXE rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe PID 1360 wrote to memory of 1528 1360 Explorer.EXE cmd.exe PID 1360 wrote to memory of 992 1360 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2660~1.BAT"3⤵
- Deletes itself
PID:1528
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1308
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1228
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-312827068247572414-644981968-1097932614-776266483-4852668215175600001803761486"1⤵PID:992
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms2660629.batFilesize
201B
MD5b5e202c50dfff63ec06398c83fc77468
SHA1c0e8519ae9b35fd506d375f05bd2a864925f82d4
SHA2566aa79cce1e9a98a306e48e98697923014058d552cb830a04b45b30fd0ca20f0f
SHA51215c765f7a2a67a4ecdaa5cc35b050d27a6f3e1ca2bc2e9b111a4b53292bde700383586e2d80bf7b04ef6630fbb8734e16b2a56695e740646e498cd242f0a24fb
-
memory/992-77-0x00000000001B0000-0x00000000001C7000-memory.dmpFilesize
92KB
-
memory/992-75-0x0000000036DD0000-0x0000000036DE0000-memory.dmpFilesize
64KB
-
memory/1228-64-0x0000000036DD0000-0x0000000036DE0000-memory.dmpFilesize
64KB
-
memory/1228-79-0x0000000000420000-0x0000000000437000-memory.dmpFilesize
92KB
-
memory/1308-73-0x0000000036DD0000-0x0000000036DE0000-memory.dmpFilesize
64KB
-
memory/1308-80-0x00000000001A0000-0x00000000001B7000-memory.dmpFilesize
92KB
-
memory/1360-60-0x0000000036DD0000-0x0000000036DE0000-memory.dmpFilesize
64KB
-
memory/1360-78-0x0000000002200000-0x0000000002217000-memory.dmpFilesize
92KB
-
memory/1360-58-0x0000000002200000-0x0000000002217000-memory.dmpFilesize
92KB
-
memory/1464-54-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB
-
memory/1464-66-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/1464-56-0x0000000000930000-0x0000000000965000-memory.dmpFilesize
212KB
-
memory/1464-55-0x0000000000100000-0x000000000010D000-memory.dmpFilesize
52KB
-
memory/1528-57-0x0000000000000000-mapping.dmp
-
memory/1528-76-0x0000000000390000-0x00000000003A4000-memory.dmpFilesize
80KB
-
memory/1528-74-0x0000000036F80000-0x0000000036F90000-memory.dmpFilesize
64KB