Analysis
-
max time kernel
37s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 07:38
Static task
static1
Behavioral task
behavioral1
Sample
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
Resource
win10v2004-20221111-en
General
-
Target
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
-
Size
284KB
-
MD5
5227780e4555ca60025d107d5baea9dd
-
SHA1
73caffd3824697f8686250ef6e6c4ac12ab39252
-
SHA256
a34dc2d8bfe4df50efffa7f78da986024d6a0822c035ccbac2b68b995a8c35a5
-
SHA512
b141e79f076f019bf852f6cd1a5a1c302410294fdb3d1eec4b11b9ed615f76ac1a3c636190fc5d02a4b1b52c0bb9b7d475b7dc92fa7b81b795f715e9fa6b69d4
-
SSDEEP
6144:1oYT0BiwUyoqwx658IIIOf1G4ELtrWWiz0Lm1+V+XjMSBaf/9:1oY+z8Byb+Xvw
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1480 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exeExplorer.EXEpid process 864 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe 864 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 864 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe Token: SeDebugPrivilege 1380 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exeExplorer.EXEdescription pid process target process PID 864 wrote to memory of 1480 864 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe cmd.exe PID 864 wrote to memory of 1480 864 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe cmd.exe PID 864 wrote to memory of 1480 864 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe cmd.exe PID 864 wrote to memory of 1480 864 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe cmd.exe PID 864 wrote to memory of 1380 864 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe Explorer.EXE PID 1380 wrote to memory of 1224 1380 Explorer.EXE taskhost.exe PID 1380 wrote to memory of 1312 1380 Explorer.EXE Dwm.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6747~1.BAT"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms6747145.batFilesize
201B
MD5a1ce5ea6fb8844f6afa9f53fdb249137
SHA130b9262bef1ccf644c90d17feef8f400459c6ccd
SHA256e487bd688cba034e3cd096c837f77726a5472014ff629c599c38efbdf2b28840
SHA5127c6dd71cbdd1ab4e4ac88a65f31cdc3ddf6b152aadc8639de39870b48dfa1fafc2f59bccf075f713637876a053de4689a9a22e87ee6c40004f2ba278f39c59af
-
memory/864-54-0x0000000076831000-0x0000000076833000-memory.dmpFilesize
8KB
-
memory/864-60-0x00000000000F0000-0x00000000000FE000-memory.dmpFilesize
56KB
-
memory/864-62-0x0000000000CA0000-0x0000000000CEA000-memory.dmpFilesize
296KB
-
memory/1224-68-0x0000000037CA0000-0x0000000037CB0000-memory.dmpFilesize
64KB
-
memory/1224-70-0x0000000001B40000-0x0000000001B57000-memory.dmpFilesize
92KB
-
memory/1312-69-0x0000000037CA0000-0x0000000037CB0000-memory.dmpFilesize
64KB
-
memory/1312-71-0x0000000001BB0000-0x0000000001BC7000-memory.dmpFilesize
92KB
-
memory/1380-58-0x0000000002250000-0x0000000002267000-memory.dmpFilesize
92KB
-
memory/1380-61-0x0000000037CA0000-0x0000000037CB0000-memory.dmpFilesize
64KB
-
memory/1380-72-0x0000000002250000-0x0000000002267000-memory.dmpFilesize
92KB
-
memory/1480-57-0x0000000000000000-mapping.dmp