Analysis
-
max time kernel
144s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Resource
win10v2004-20221111-en
General
-
Target
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
-
Size
306KB
-
MD5
756fae3b80bf129ce578006534c1413f
-
SHA1
00ec3c18110067acd9014a27c366160f2ea18ab3
-
SHA256
69b81b054100dc55fa61aa0edb9acdecccb84ab84fa37177b33e5d9814067633
-
SHA512
10274e2d15f6c7990acee9dd6b8e4d3b30c5dc810321198257671862f125baecede3cb5193468f8361d3289fb4623cb3ab6a9f0caceb780eaa6e0e4ef4d1626e
-
SSDEEP
6144:Ci37LbbWiaYUpwXV9RIKWn/TUVs8oL48N8lqFzc+tRJShtvUdJk:CO/izXrN8UbtPShoJk
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1860 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhohjter.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\dhohjter.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exeExplorer.EXEpid process 1928 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe 1928 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1928 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe Token: SeDebugPrivilege 1400 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exeExplorer.EXEdescription pid process target process PID 1928 wrote to memory of 1860 1928 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe cmd.exe PID 1928 wrote to memory of 1860 1928 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe cmd.exe PID 1928 wrote to memory of 1860 1928 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe cmd.exe PID 1928 wrote to memory of 1860 1928 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe cmd.exe PID 1928 wrote to memory of 1400 1928 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe Explorer.EXE PID 1400 wrote to memory of 1236 1400 Explorer.EXE taskhost.exe PID 1400 wrote to memory of 1348 1400 Explorer.EXE Dwm.exe PID 1400 wrote to memory of 1928 1400 Explorer.EXE 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe PID 1400 wrote to memory of 1860 1400 Explorer.EXE cmd.exe PID 1400 wrote to memory of 1860 1400 Explorer.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6374~1.BAT"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms6374069.batFilesize
201B
MD5889ed06ab2691e3eb0cd6439f14730c9
SHA13ccc56555e327d29d637aa55692586e061b1b48c
SHA2564c803fc15cc4ef8dfc9f20d0cb93fa07afbf1becf56751a11955cd20d70ca851
SHA5127417a8ba275b8de74e8322fe793c5acbbe678672caea8b080c4554304ec1ea2a3ee14fc27ac9cf4ae5c768b8922de1d774eddc57f57ef796b745c225c88d2e4d
-
memory/1236-64-0x0000000037920000-0x0000000037930000-memory.dmpFilesize
64KB
-
memory/1236-77-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/1348-68-0x0000000037920000-0x0000000037930000-memory.dmpFilesize
64KB
-
memory/1348-78-0x0000000000120000-0x0000000000137000-memory.dmpFilesize
92KB
-
memory/1400-76-0x0000000002210000-0x0000000002227000-memory.dmpFilesize
92KB
-
memory/1400-58-0x0000000002210000-0x0000000002227000-memory.dmpFilesize
92KB
-
memory/1400-60-0x0000000037920000-0x0000000037930000-memory.dmpFilesize
64KB
-
memory/1860-57-0x0000000000000000-mapping.dmp
-
memory/1928-66-0x0000000000440000-0x0000000000454000-memory.dmpFilesize
80KB
-
memory/1928-75-0x0000000000F20000-0x0000000000F74000-memory.dmpFilesize
336KB
-
memory/1928-74-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1928-54-0x00000000762B1000-0x00000000762B3000-memory.dmpFilesize
8KB