2abb0b4e81751858aba49f0e75d5faa790c478a009d0b29258296a1300ca7ba7

General

Target

2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
Size

148KB
MD5

69a462f5962e03c6dc1d34b3ec702ef7
SHA1

42a898eb901252f9839b3376e91c80eb508ecf40
SHA256

7cad924cac4762e897aa2d5406cf63083e9d44d86f61cdde86946e0419746a2c
SHA512

252f8baabb0f160c2886b8d781a55ac747fc443029428929e52d42974eb8bbcc362181b8813c45a91d21dde405859943dd59d148d5f4bb04a5e44e02cca9260f
SSDEEP

3072:xQ/LFEPXCmqhQkGmgb6/d33HfI5NxwCshg0e4FeV3q0E:iTePXBaQkG7G5/Izbye4oVq0

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1072 cmd.exe

pid	process
1072	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe

description	pid	process	target process
PID 832 set thread context of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exeExplorer.EXE

pid	process
832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
1260	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
1260	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE

pid	process
1208	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1260	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
Token: SeDebugPrivilege	1208	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE
1208 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE
1208 Explorer.EXE

pid	process
1208	Explorer.EXE
1208	Explorer.EXE

pid	process
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe

pid	process
832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE

pid	process
1208	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exeExplorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2660~1.BAT"
4⤵
- Deletes itself
PID:1072

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms2660629.bat

Filesize
201B

MD5
a0e48e90c0d6d8b32df9b8eb9dc9146e

SHA1
754c081534f0a12da8f2cc5139ede91e72d090de

SHA256
2de9fa5982cfe1b5f519fa11861549bbaad917fd07e88e377905a08c997b9f24

SHA512
7f41aa0ed4f6f5c0cad7e9b95fa00ac433b41753c35a0757d71ae06852dccde068cca86cebdd88dde5f2671a0f4ab0334b0e02348d47ac12caafd7befbac5478

Download Submit
memory/832-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/832-65-0x0000000000350000-0x0000000000354000-memory.dmp

Filesize
16KB

Download
memory/1072-71-0x0000000000000000-mapping.dmp

Download
memory/1112-81-0x0000000037C30000-0x0000000037C40000-memory.dmp

Filesize
64KB

Download
memory/1112-83-0x0000000001BC0000-0x0000000001BD7000-memory.dmp

Filesize
92KB

Download
memory/1208-72-0x00000000025E0000-0x00000000025F7000-memory.dmp

Filesize
92KB

Download
memory/1208-82-0x00000000025E0000-0x00000000025F7000-memory.dmp

Filesize
92KB

Download
memory/1208-75-0x0000000037C30000-0x0000000037C40000-memory.dmp

Filesize
64KB

Download
memory/1260-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1260-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1260-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1260-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1260-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1260-64-0x00000000004010C0-mapping.dmp

Download
memory/1260-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1260-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1260-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

description	pid	process	target process
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 832 wrote to memory of 1260	832	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
PID 1260 wrote to memory of 1072	1260	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	cmd.exe
PID 1260 wrote to memory of 1072	1260	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	cmd.exe
PID 1260 wrote to memory of 1072	1260	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	cmd.exe
PID 1260 wrote to memory of 1072	1260	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	cmd.exe
PID 1260 wrote to memory of 1208	1260	2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe	Explorer.EXE
PID 1208 wrote to memory of 1112	1208	Explorer.EXE	taskhost.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads