24cc362d280bbefd2940d94ff35d121d6e109200b6b08d173df1ee6fe5b52841

General

Target

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
Size

140KB
MD5

112b33bfeb2514bf11b0595c55173b32
SHA1

bde96a6d72babb9d5dea78d98dfa434ab2108624
SHA256

585f86ba3173d7a8560a2e82d6adcc8e3e3772bbaefb3239547b43a6685f21c1
SHA512

eb9a80e201d751740d0992459e1fcd61f3973113ab62c4d0b930dabcb165095492dc7d70ddfe8267c707d1b73df3a0df772c755b2477839a1f754e17be51401b
SSDEEP

3072:sJjzdejzg3KOSD+dN6so3Llk5aAGGUvXaIurWuK6o5yw5pP9m+OnlNEWd/SGv4MC:URejz+KOW+dNmLeaAGdZuK/z5T5pP9mI

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

856 cmd.exe

pid	process
856	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe

description	pid	process	target process
PID 948 set thread context of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exeExplorer.EXE

pid	process
948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
1692	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
1692	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
1388	Explorer.EXE
1388	Explorer.EXE
1388	Explorer.EXE
1388	Explorer.EXE
1388	Explorer.EXE
1388	Explorer.EXE
1388	Explorer.EXE
1388	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1388 Explorer.EXE

pid	process
1388	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1692	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
Token: SeDebugPrivilege	1388	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1388 Explorer.EXE
1388 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1388 Explorer.EXE
1388 Explorer.EXE

pid	process
1388	Explorer.EXE
1388	Explorer.EXE

pid	process
1388	Explorer.EXE
1388	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe

pid	process
948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exeExplorer.EXE

description	pid	process	target process
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 948 wrote to memory of 1692	948	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
PID 1692 wrote to memory of 856	1692	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	cmd.exe
PID 1692 wrote to memory of 856	1692	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	cmd.exe
PID 1692 wrote to memory of 856	1692	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	cmd.exe
PID 1692 wrote to memory of 856	1692	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	cmd.exe
PID 1692 wrote to memory of 1388	1692	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	Explorer.EXE
PID 1388 wrote to memory of 1236	1388	Explorer.EXE	taskhost.exe
PID 1388 wrote to memory of 1336	1388	Explorer.EXE	Dwm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms284298.bat"
4⤵
- Deletes itself
PID:856

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1336

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms284298.bat

Filesize
201B

MD5
763598dae3c37acfb6a6d97a05cd88ad

SHA1
28f44b6258696c87b77c9e36d55f234d6f23b397

SHA256
a18c505e7ded549c395d5ba64d5e9f9856fa4ad6c0e0f8302c0e72886cb73682

SHA512
8fdadfc37e66a0af0490d43aff4b1e7253b4e758b77e5eb6dc5f56a93b7ffd1f23a96b982cd45b8135874244f47d8da6fa32ada36ee44ca30a6b1feef3618f07

Download Submit
memory/856-71-0x0000000000000000-mapping.dmp

Download
memory/948-65-0x0000000000310000-0x0000000000314000-memory.dmp

Filesize
16KB

Download
memory/948-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1236-81-0x0000000037BB0000-0x0000000037BC0000-memory.dmp

Filesize
64KB

Download
memory/1236-84-0x0000000000410000-0x0000000000427000-memory.dmp

Filesize
92KB

Download
memory/1336-82-0x0000000037BB0000-0x0000000037BC0000-memory.dmp

Filesize
64KB

Download
memory/1336-85-0x00000000002B0000-0x00000000002C7000-memory.dmp

Filesize
92KB

Download
memory/1388-83-0x0000000002A70000-0x0000000002A87000-memory.dmp

Filesize
92KB

Download
memory/1388-75-0x0000000037BB0000-0x0000000037BC0000-memory.dmp

Filesize
64KB

Download
memory/1388-87-0x000007FE99C40000-0x000007FE99C4A000-memory.dmp

Filesize
40KB

Download
memory/1388-72-0x0000000002A70000-0x0000000002A87000-memory.dmp

Filesize
92KB

Download
memory/1388-86-0x000007FEF6DB0000-0x000007FEF6EF3000-memory.dmp

Filesize
1.3MB

Download
memory/1692-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1692-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1692-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1692-67-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1692-62-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1692-64-0x00000000004010C0-mapping.dmp

Download
memory/1692-63-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1692-74-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1692-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads