86bab2ff4d7ba6f2536229413118a1201cd4bedcb3fbbb82dda4ffc2eb66e3f1

General

Target

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
Size

284KB
MD5

5227780e4555ca60025d107d5baea9dd
SHA1

73caffd3824697f8686250ef6e6c4ac12ab39252
SHA256

a34dc2d8bfe4df50efffa7f78da986024d6a0822c035ccbac2b68b995a8c35a5
SHA512

b141e79f076f019bf852f6cd1a5a1c302410294fdb3d1eec4b11b9ed615f76ac1a3c636190fc5d02a4b1b52c0bb9b7d475b7dc92fa7b81b795f715e9fa6b69d4
SSDEEP

6144:1oYT0BiwUyoqwx658IIIOf1G4ELtrWWiz0Lm1+V+XjMSBaf/9:1oY+z8Byb+Xvw

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1480 cmd.exe

pid	process
1480	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\""	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exeExplorer.EXE

pid	process
864	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
864	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	864	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
Token: SeDebugPrivilege	1380	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
1380 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
1380 Explorer.EXE

pid	process
1380	Explorer.EXE
1380	Explorer.EXE

pid	process
1380	Explorer.EXE
1380	Explorer.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exeExplorer.EXE

description	pid	process	target process
PID 864 wrote to memory of 1480	864	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 864 wrote to memory of 1480	864	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 864 wrote to memory of 1480	864	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 864 wrote to memory of 1480	864	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 864 wrote to memory of 1380	864	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	Explorer.EXE
PID 1380 wrote to memory of 1224	1380	Explorer.EXE	taskhost.exe
PID 1380 wrote to memory of 1312	1380	Explorer.EXE	Dwm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6747~1.BAT"
3⤵
- Deletes itself
PID:1480

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1312

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms6747145.bat

Filesize
201B

MD5
a1ce5ea6fb8844f6afa9f53fdb249137

SHA1
30b9262bef1ccf644c90d17feef8f400459c6ccd

SHA256
e487bd688cba034e3cd096c837f77726a5472014ff629c599c38efbdf2b28840

SHA512
7c6dd71cbdd1ab4e4ac88a65f31cdc3ddf6b152aadc8639de39870b48dfa1fafc2f59bccf075f713637876a053de4689a9a22e87ee6c40004f2ba278f39c59af

Download Submit
memory/864-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/864-60-0x00000000000F0000-0x00000000000FE000-memory.dmp

Filesize
56KB

Download
memory/864-62-0x0000000000CA0000-0x0000000000CEA000-memory.dmp

Filesize
296KB

Download
memory/1224-68-0x0000000037CA0000-0x0000000037CB0000-memory.dmp

Filesize
64KB

Download
memory/1224-70-0x0000000001B40000-0x0000000001B57000-memory.dmp

Filesize
92KB

Download
memory/1312-69-0x0000000037CA0000-0x0000000037CB0000-memory.dmp

Filesize
64KB

Download
memory/1312-71-0x0000000001BB0000-0x0000000001BC7000-memory.dmp

Filesize
92KB

Download
memory/1380-58-0x0000000002250000-0x0000000002267000-memory.dmp

Filesize
92KB

Download
memory/1380-61-0x0000000037CA0000-0x0000000037CB0000-memory.dmp

Filesize
64KB

Download
memory/1380-72-0x0000000002250000-0x0000000002267000-memory.dmp

Filesize
92KB

Download
memory/1480-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads