Analysis
-
max time kernel
142s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:00
Static task
static1
Behavioral task
behavioral1
Sample
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Resource
win10v2004-20221111-en
General
-
Target
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
-
Size
306KB
-
MD5
756fae3b80bf129ce578006534c1413f
-
SHA1
00ec3c18110067acd9014a27c366160f2ea18ab3
-
SHA256
69b81b054100dc55fa61aa0edb9acdecccb84ab84fa37177b33e5d9814067633
-
SHA512
10274e2d15f6c7990acee9dd6b8e4d3b30c5dc810321198257671862f125baecede3cb5193468f8361d3289fb4623cb3ab6a9f0caceb780eaa6e0e4ef4d1626e
-
SSDEEP
6144:Ci37LbbWiaYUpwXV9RIKWn/TUVs8oL48N8lqFzc+tRJShtvUdJk:CO/izXrN8UbtPShoJk
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2040 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhohjter.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\dhohjter.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exeExplorer.EXEpid process 1256 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe 1256 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1256 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe Token: SeDebugPrivilege 1208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exeExplorer.EXEdescription pid process target process PID 1256 wrote to memory of 2040 1256 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe cmd.exe PID 1256 wrote to memory of 2040 1256 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe cmd.exe PID 1256 wrote to memory of 2040 1256 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe cmd.exe PID 1256 wrote to memory of 2040 1256 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe cmd.exe PID 1256 wrote to memory of 1208 1256 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe Explorer.EXE PID 1208 wrote to memory of 1108 1208 Explorer.EXE taskhost.exe PID 1208 wrote to memory of 1184 1208 Explorer.EXE Dwm.exe PID 1208 wrote to memory of 1256 1208 Explorer.EXE 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe PID 1208 wrote to memory of 2040 1208 Explorer.EXE cmd.exe PID 1208 wrote to memory of 2040 1208 Explorer.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2925~1.BAT"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms2925246.batFilesize
201B
MD50d4feb60a8a707dcfc70b6fbc1468487
SHA18e9623fc7d3b1741ef94b9a7bac6befcac42ec4b
SHA2560b8263bb39e6350e8fb8366785dc966c50cde720f8823f395e90d35b467741b1
SHA51281fa96d421711ad39560ee40aec40ff48576464e2a801b9deb3468e3b50c19499984f02dbcc4de1fe6918bae55bfd7fd5031fa2c06de29a52a386d27deab5734
-
memory/1108-77-0x0000000001DA0000-0x0000000001DB7000-memory.dmpFilesize
92KB
-
memory/1108-71-0x0000000036D70000-0x0000000036D80000-memory.dmpFilesize
64KB
-
memory/1184-72-0x0000000036D70000-0x0000000036D80000-memory.dmpFilesize
64KB
-
memory/1184-76-0x0000000001C30000-0x0000000001C47000-memory.dmpFilesize
92KB
-
memory/1208-75-0x0000000002970000-0x0000000002987000-memory.dmpFilesize
92KB
-
memory/1208-58-0x0000000002970000-0x0000000002987000-memory.dmpFilesize
92KB
-
memory/1208-60-0x0000000036D70000-0x0000000036D80000-memory.dmpFilesize
64KB
-
memory/1256-74-0x0000000001050000-0x00000000010A4000-memory.dmpFilesize
336KB
-
memory/1256-54-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/1256-73-0x0000000000110000-0x000000000011E000-memory.dmpFilesize
56KB
-
memory/1256-65-0x0000000000480000-0x0000000000494000-memory.dmpFilesize
80KB
-
memory/2040-78-0x0000000036F20000-0x0000000036F30000-memory.dmpFilesize
64KB
-
memory/2040-79-0x0000000036F20000-0x0000000036F30000-memory.dmpFilesize
64KB
-
memory/2040-80-0x00000000000A0000-0x00000000000B4000-memory.dmpFilesize
80KB
-
memory/2040-81-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/2040-57-0x0000000000000000-mapping.dmp