Analysis
-
max time kernel
44s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 10:09
Static task
static1
Behavioral task
behavioral1
Sample
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe
Resource
win10v2004-20220812-en
General
-
Target
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe
-
Size
284KB
-
MD5
5227780e4555ca60025d107d5baea9dd
-
SHA1
73caffd3824697f8686250ef6e6c4ac12ab39252
-
SHA256
a34dc2d8bfe4df50efffa7f78da986024d6a0822c035ccbac2b68b995a8c35a5
-
SHA512
b141e79f076f019bf852f6cd1a5a1c302410294fdb3d1eec4b11b9ed615f76ac1a3c636190fc5d02a4b1b52c0bb9b7d475b7dc92fa7b81b795f715e9fa6b69d4
-
SSDEEP
6144:1oYT0BiwUyoqwx658IIIOf1G4ELtrWWiz0Lm1+V+XjMSBaf/9:1oY+z8Byb+Xvw
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1628 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exeExplorer.EXEpid process 2016 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe 2016 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2016 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe Token: SeDebugPrivilege 1380 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exeExplorer.EXEdescription pid process target process PID 2016 wrote to memory of 1628 2016 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe cmd.exe PID 2016 wrote to memory of 1628 2016 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe cmd.exe PID 2016 wrote to memory of 1628 2016 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe cmd.exe PID 2016 wrote to memory of 1628 2016 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe cmd.exe PID 2016 wrote to memory of 1380 2016 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe Explorer.EXE PID 1380 wrote to memory of 1240 1380 Explorer.EXE taskhost.exe PID 1380 wrote to memory of 1240 1380 Explorer.EXE taskhost.exe PID 1380 wrote to memory of 1340 1380 Explorer.EXE Dwm.exe PID 1380 wrote to memory of 1340 1380 Explorer.EXE Dwm.exe PID 1380 wrote to memory of 2016 1380 Explorer.EXE informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe PID 1380 wrote to memory of 1628 1380 Explorer.EXE cmd.exe PID 1380 wrote to memory of 1628 1380 Explorer.EXE cmd.exe PID 1380 wrote to memory of 888 1380 Explorer.EXE conhost.exe PID 1380 wrote to memory of 888 1380 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe"C:\Users\Admin\AppData\Local\Temp\informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6374~1.BAT"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-17202247-2027593701-1294423736-1821938302016588318-1747066533-1625453356-175198727"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms6374069.batFilesize
201B
MD5016f814cfebbd887fa0fadc202b103d5
SHA17fef03893085fe3aaec917bc3536eda0e043de43
SHA256bb43073b61de8c2d43af2581a9433068e48b8854438f06f77a58602b8e79ff24
SHA512bec78a2a14bd4033c96f61f42e8fd19c11456c2f44204fee4f8d72b1e061c945ead8a35156a920fb4cffdd9d57a190ff4a176c921ec6364c87d23a5d1f067d4b
-
memory/888-86-0x00000000000F0000-0x0000000000107000-memory.dmpFilesize
92KB
-
memory/888-84-0x0000000037700000-0x0000000037710000-memory.dmpFilesize
64KB
-
memory/1240-82-0x0000000037700000-0x0000000037710000-memory.dmpFilesize
64KB
-
memory/1240-93-0x0000000001BD0000-0x0000000001BE7000-memory.dmpFilesize
92KB
-
memory/1240-89-0x0000000001BF0000-0x0000000001C07000-memory.dmpFilesize
92KB
-
memory/1240-88-0x0000000037700000-0x0000000037710000-memory.dmpFilesize
64KB
-
memory/1340-92-0x0000000001AC0000-0x0000000001AD7000-memory.dmpFilesize
92KB
-
memory/1340-83-0x0000000037700000-0x0000000037710000-memory.dmpFilesize
64KB
-
memory/1340-87-0x0000000037700000-0x0000000037710000-memory.dmpFilesize
64KB
-
memory/1340-90-0x0000000001C60000-0x0000000001C77000-memory.dmpFilesize
92KB
-
memory/1380-62-0x0000000037700000-0x0000000037710000-memory.dmpFilesize
64KB
-
memory/1380-60-0x0000000002240000-0x0000000002257000-memory.dmpFilesize
92KB
-
memory/1380-91-0x0000000002240000-0x0000000002257000-memory.dmpFilesize
92KB
-
memory/1628-59-0x0000000000000000-mapping.dmp
-
memory/2016-63-0x0000000000BB0000-0x0000000000BFA000-memory.dmpFilesize
296KB
-
memory/2016-72-0x00000000001A0000-0x00000000001B4000-memory.dmpFilesize
80KB
-
memory/2016-54-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/2016-57-0x0000000000BB0000-0x0000000000BFA000-memory.dmpFilesize
296KB
-
memory/2016-56-0x0000000000080000-0x000000000008E000-memory.dmpFilesize
56KB