Analysis
-
max time kernel
137s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 09:37
Static task
static1
Behavioral task
behavioral1
Sample
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe
Resource
win10v2004-20221111-en
General
-
Target
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe
-
Size
94KB
-
MD5
dbc35cd99daa5b3f3083e911a43b7c31
-
SHA1
dcbe9859542d22bc8684d798d9f5227624f5be97
-
SHA256
47063fabbef0d6759cc4076c988760f82ba0328e878431cce6a3691d052e7b06
-
SHA512
d8212148e1c5897e1c92b2eb054c9b158eafc49fb3047fe22dd01208c1384212ab388848e746f9c37e2b561975e300fe440fdc9877411f460b4cb7c9666ca641
-
SSDEEP
1536:CvSM+QtpWT1G9NS89i4XZ0wovNOinmYbGmjBtwiRAd6S9C5Qhkxolh+:Cv3I1G9NnH8vN0eGKBqLMS9cIkxolU
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1268 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exeExplorer.EXEpid process 1348 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe 1348 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1348 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe Token: SeDebugPrivilege 1208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exeExplorer.EXEdescription pid process target process PID 1348 wrote to memory of 1268 1348 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe cmd.exe PID 1348 wrote to memory of 1268 1348 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe cmd.exe PID 1348 wrote to memory of 1268 1348 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe cmd.exe PID 1348 wrote to memory of 1268 1348 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe cmd.exe PID 1348 wrote to memory of 1208 1348 informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe Explorer.EXE PID 1208 wrote to memory of 1068 1208 Explorer.EXE taskhost.exe PID 1208 wrote to memory of 1164 1208 Explorer.EXE Dwm.exe PID 1208 wrote to memory of 1268 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 2028 1208 Explorer.EXE conhost.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe"C:\Users\Admin\AppData\Local\Temp\informationen_zum_transaktions_02JS_2820_JWIOU_29MQ_2001_KA21.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms284298.bat"3⤵
- Deletes itself
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "908440377-2043378708-14121641671662322367-338759049362798969-1551499669805599161"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms284298.batFilesize
201B
MD5777a7159a8b28706a66eecc81b6a2fac
SHA137b22b59fce4b50bbad7c8cd89fc2c666b5d9815
SHA256f11effc9914291ddaa870f161d23c43f9d90550a5579a08fa50b6cd95e79bebf
SHA512eb8f5694c9ece218da128480b8822e341bb7dadf6b1eefc0028792aa9f3f01ec0ad12a1ccd80b38d8216d67286d7038881eecb5158a074c88ee7c3c02eb4cfd6
-
memory/1068-68-0x00000000371A0000-0x00000000371B0000-memory.dmpFilesize
64KB
-
memory/1068-76-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/1164-77-0x00000000001A0000-0x00000000001B7000-memory.dmpFilesize
92KB
-
memory/1164-69-0x00000000371A0000-0x00000000371B0000-memory.dmpFilesize
64KB
-
memory/1208-78-0x0000000001C50000-0x0000000001C67000-memory.dmpFilesize
92KB
-
memory/1208-58-0x0000000001C50000-0x0000000001C67000-memory.dmpFilesize
92KB
-
memory/1208-62-0x00000000371A0000-0x00000000371B0000-memory.dmpFilesize
64KB
-
memory/1268-67-0x0000000000240000-0x0000000000254000-memory.dmpFilesize
80KB
-
memory/1268-57-0x0000000000000000-mapping.dmp
-
memory/1348-54-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1348-61-0x00000000002B0000-0x00000000002CB000-memory.dmpFilesize
108KB
-
memory/1348-60-0x0000000000110000-0x000000000011E000-memory.dmpFilesize
56KB
-
memory/2028-74-0x00000000371A0000-0x00000000371B0000-memory.dmpFilesize
64KB
-
memory/2028-75-0x00000000001E0000-0x00000000001F7000-memory.dmpFilesize
92KB