Analysis
-
max time kernel
214s -
max time network
295s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 18:09
Static task
static1
Behavioral task
behavioral1
Sample
2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe
Resource
win10v2004-20220901-en
General
-
Target
2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe
-
Size
204KB
-
MD5
bf08a33a6aa04fd576d4661bfe409d63
-
SHA1
33bac2b5647c3cf464e5b2cbd7e108aa75877be9
-
SHA256
796c421ab9d0cb0b7e2de528cc7535c3eccabb31c888a04796593654ec37a0e2
-
SHA512
4f11e2e9e606c68afaa534f700f54706f1ce23e99c42398a09e4df7a2481a8c6b07f6ffb2d19db5b2dc2fea7e5b6488692af5eeac52e16ae2b13062d8a3c8140
-
SSDEEP
3072:KbbbeGI6JRubMVHhRJO13oreqjc2K9FZn0f1MsWzdT6V:hGLRdVHheeOFZ0fGL16V
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 752 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exedescription pid process target process PID 1996 set thread context of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exeExplorer.EXEpid process 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 588 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 588 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 588 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe Token: SeDebugPrivilege 1192 Explorer.EXE Token: SeShutdownPrivilege 1192 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exepid process 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exeExplorer.EXEdescription pid process target process PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 1996 wrote to memory of 588 1996 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe PID 588 wrote to memory of 752 588 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe cmd.exe PID 588 wrote to memory of 752 588 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe cmd.exe PID 588 wrote to memory of 752 588 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe cmd.exe PID 588 wrote to memory of 752 588 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe cmd.exe PID 588 wrote to memory of 1192 588 2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe Explorer.EXE PID 1192 wrote to memory of 1108 1192 Explorer.EXE taskhost.exe PID 1192 wrote to memory of 1152 1192 Explorer.EXE Dwm.exe PID 1192 wrote to memory of 1152 1192 Explorer.EXE Dwm.exe PID 1192 wrote to memory of 752 1192 Explorer.EXE cmd.exe PID 1192 wrote to memory of 1492 1192 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe"C:\Users\Admin\AppData\Local\Temp\2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exeC:\Users\Admin\AppData\Local\Temp\2014_11vodafone_onlinerechnung_002120003909_november_390321980009_11_00000000445.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2925~1.BAT"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1360926487946149337-722878891981218672-3328951531021490060-1740333180433133110"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms2925246.batFilesize
201B
MD50d4feb60a8a707dcfc70b6fbc1468487
SHA18e9623fc7d3b1741ef94b9a7bac6befcac42ec4b
SHA2560b8263bb39e6350e8fb8366785dc966c50cde720f8823f395e90d35b467741b1
SHA51281fa96d421711ad39560ee40aec40ff48576464e2a801b9deb3468e3b50c19499984f02dbcc4de1fe6918bae55bfd7fd5031fa2c06de29a52a386d27deab5734
-
memory/588-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/588-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/588-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/588-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/588-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/588-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/588-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/588-65-0x00000000004010C0-mapping.dmp
-
memory/588-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/752-83-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/752-72-0x0000000000000000-mapping.dmp
-
memory/1108-93-0x0000000001E80000-0x0000000001E97000-memory.dmpFilesize
92KB
-
memory/1108-87-0x0000000037B20000-0x0000000037B30000-memory.dmpFilesize
64KB
-
memory/1152-90-0x0000000037B20000-0x0000000037B30000-memory.dmpFilesize
64KB
-
memory/1152-91-0x00000000019E0000-0x00000000019F7000-memory.dmpFilesize
92KB
-
memory/1152-95-0x00000000019C0000-0x00000000019D7000-memory.dmpFilesize
92KB
-
memory/1152-88-0x0000000037B20000-0x0000000037B30000-memory.dmpFilesize
64KB
-
memory/1192-73-0x00000000029F0000-0x0000000002A07000-memory.dmpFilesize
92KB
-
memory/1192-76-0x0000000037B20000-0x0000000037B30000-memory.dmpFilesize
64KB
-
memory/1192-92-0x00000000029F0000-0x0000000002A07000-memory.dmpFilesize
92KB
-
memory/1192-97-0x00000000029F0000-0x0000000002A07000-memory.dmpFilesize
92KB
-
memory/1492-89-0x0000000037B20000-0x0000000037B30000-memory.dmpFilesize
64KB
-
memory/1492-94-0x00000000000E0000-0x00000000000F7000-memory.dmpFilesize
92KB
-
memory/1996-54-0x0000000000220000-0x00000000002CC000-memory.dmpFilesize
688KB
-
memory/1996-66-0x00000000005D0000-0x00000000005D4000-memory.dmpFilesize
16KB
-
memory/1996-55-0x00000000763A1000-0x00000000763A3000-memory.dmpFilesize
8KB