Analysis
-
max time kernel
137s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 10:04
Static task
static1
Behavioral task
behavioral1
Sample
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
Resource
win10v2004-20220812-en
General
-
Target
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
-
Size
284KB
-
MD5
5227780e4555ca60025d107d5baea9dd
-
SHA1
73caffd3824697f8686250ef6e6c4ac12ab39252
-
SHA256
a34dc2d8bfe4df50efffa7f78da986024d6a0822c035ccbac2b68b995a8c35a5
-
SHA512
b141e79f076f019bf852f6cd1a5a1c302410294fdb3d1eec4b11b9ed615f76ac1a3c636190fc5d02a4b1b52c0bb9b7d475b7dc92fa7b81b795f715e9fa6b69d4
-
SSDEEP
6144:1oYT0BiwUyoqwx658IIIOf1G4ELtrWWiz0Lm1+V+XjMSBaf/9:1oY+z8Byb+Xvw
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1088 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exeExplorer.EXEpid process 1972 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe 1972 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE 1344 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1344 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1972 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe Token: SeDebugPrivilege 1344 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1344 Explorer.EXE 1344 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1344 Explorer.EXE 1344 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exeExplorer.EXEdescription pid process target process PID 1972 wrote to memory of 1088 1972 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe cmd.exe PID 1972 wrote to memory of 1088 1972 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe cmd.exe PID 1972 wrote to memory of 1088 1972 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe cmd.exe PID 1972 wrote to memory of 1088 1972 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe cmd.exe PID 1972 wrote to memory of 1344 1972 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe Explorer.EXE PID 1344 wrote to memory of 1200 1344 Explorer.EXE taskhost.exe PID 1344 wrote to memory of 1304 1344 Explorer.EXE Dwm.exe PID 1344 wrote to memory of 1972 1344 Explorer.EXE 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe PID 1344 wrote to memory of 1088 1344 Explorer.EXE cmd.exe PID 1344 wrote to memory of 676 1344 Explorer.EXE conhost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe"C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms523388.bat"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1031427006550025909-17646921081766979220-1346429501693761590305911455-1123108671"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms523388.batFilesize
201B
MD5a50cefb0e916550abde40374b97fd3cd
SHA10cad8314542b30849a1d46f30bb1b04f38f3563c
SHA2569229913e63175bba2b06d00667adac596bcb3befe09a69e0b0b0dc14100effdd
SHA512a5c2f41d988886bafe7592cbbe7acaa6181894256e1b998f78ae91eb4c0adc4c74fd903d8b71c4a823997c341a31ecdfa15d901ac2ae51dc775fdd1df3546400
-
memory/676-79-0x00000000000D0000-0x00000000000E7000-memory.dmpFilesize
92KB
-
memory/676-78-0x0000000037500000-0x0000000037510000-memory.dmpFilesize
64KB
-
memory/1088-77-0x0000000000120000-0x0000000000134000-memory.dmpFilesize
80KB
-
memory/1088-76-0x00000000376B0000-0x00000000376C0000-memory.dmpFilesize
64KB
-
memory/1088-57-0x0000000000000000-mapping.dmp
-
memory/1200-69-0x0000000037500000-0x0000000037510000-memory.dmpFilesize
64KB
-
memory/1200-80-0x0000000000210000-0x0000000000227000-memory.dmpFilesize
92KB
-
memory/1304-72-0x0000000037500000-0x0000000037510000-memory.dmpFilesize
64KB
-
memory/1304-81-0x00000000001A0000-0x00000000001B7000-memory.dmpFilesize
92KB
-
memory/1344-58-0x0000000001C60000-0x0000000001C77000-memory.dmpFilesize
92KB
-
memory/1344-60-0x0000000037500000-0x0000000037510000-memory.dmpFilesize
64KB
-
memory/1344-82-0x0000000001C60000-0x0000000001C77000-memory.dmpFilesize
92KB
-
memory/1972-64-0x0000000001120000-0x000000000116A000-memory.dmpFilesize
296KB
-
memory/1972-62-0x0000000000080000-0x000000000008E000-memory.dmpFilesize
56KB
-
memory/1972-67-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/1972-54-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB