af11adb713872473fda53fbd77c0ed15f89bfd05b260852a5e15c0097dba4bea

General

Target

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Size

160KB
MD5

93c5ce9d871d19cdcf01de0865472c2f
SHA1

f2d1525e8bb81544e03406144fd3dcb9501befe2
SHA256

4e09d0ad9688191056413511441739c7246d6052b322dff889615c3d82ee8b98
SHA512

10bafb2b1184c642558cc7e6dddce7e04d03e1b5b0f696b5c7cb2a9c487f232eb788e3c57cbe9944649e0ae425a77645505198ec97554872165400e5c5be2b80
SSDEEP

3072:B7tIqiClxus4ZkEMb0rG7bat/A1rBykr7MlSRmV6/v7v:BtImlxus4Z1tt/AZBykrZugvD

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1252 cmd.exe

pid	process
1252	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

description	pid	process	target process
PID 1120 set thread context of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exeExplorer.EXE

pid	process
1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1532	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1532	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1284 Explorer.EXE

pid	process
1284	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1532	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Token: SeDebugPrivilege	1284	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1284 Explorer.EXE
1284 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1284 Explorer.EXE
1284 Explorer.EXE

pid	process
1284	Explorer.EXE
1284	Explorer.EXE

pid	process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

pid	process
1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exeExplorer.EXE

description	pid	process	target process
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1120 wrote to memory of 1532	1120	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 1532 wrote to memory of 1252	1532	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	cmd.exe
PID 1532 wrote to memory of 1252	1532	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	cmd.exe
PID 1532 wrote to memory of 1252	1532	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	cmd.exe
PID 1532 wrote to memory of 1252	1532	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	cmd.exe
PID 1532 wrote to memory of 1284	1532	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	Explorer.EXE
PID 1284 wrote to memory of 1128	1284	Explorer.EXE	taskhost.exe
PID 1284 wrote to memory of 1220	1284	Explorer.EXE	Dwm.exe
PID 1284 wrote to memory of 1252	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1252	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1052	1284	Explorer.EXE	conhost.exe
PID 1284 wrote to memory of 1052	1284	Explorer.EXE	conhost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms525478.bat"
4⤵
- Deletes itself
PID:1252

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1220

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-978413527-671147033-169569890864978759-19828003671927373744-321206093-251449120"
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms525478.bat
Filesize
201B

MD5
9b75602c1a62b24448285d840d047fcb

SHA1
fac07da6d3a527378867823d78a294ec089d292d

SHA256
b2e98d378d2754a8f1c0bcea80bd5b420ec14e5e7598a23da8501fa6e900a151

SHA512
98a7b32ec5a51234aac5ce1f2c09967f6b4e69863f0cad63936c41899e55924e313f971dae04006b6556ea997d4ec4a58a62ab4ddbf2046a543cb54d41e422c3

Download Submit
memory/1052-92-0x0000000001A30000-0x0000000001A47000-memory.dmp

Filesize
92KB

Download
memory/1052-91-0x0000000036DA0000-0x0000000036DB0000-memory.dmp

Filesize
64KB

Download
memory/1120-65-0x0000000000370000-0x0000000000374000-memory.dmp

Filesize
16KB

Download
memory/1120-54-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

Filesize
8KB

Download
memory/1128-93-0x0000000000410000-0x0000000000427000-memory.dmp

Filesize
92KB

Download
memory/1128-87-0x0000000036DA0000-0x0000000036DB0000-memory.dmp

Filesize
64KB

Download
memory/1220-95-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1220-89-0x0000000036DA0000-0x0000000036DB0000-memory.dmp

Filesize
64KB

Download
memory/1252-71-0x0000000000000000-mapping.dmp

Download
memory/1252-80-0x00000000000C0000-0x00000000000D4000-memory.dmp

Filesize
80KB

Download
memory/1284-72-0x0000000002A20000-0x0000000002A37000-memory.dmp

Filesize
92KB

Download
memory/1284-94-0x0000000002A20000-0x0000000002A37000-memory.dmp

Filesize
92KB

Download
memory/1284-75-0x0000000036DA0000-0x0000000036DB0000-memory.dmp

Filesize
64KB

Download
memory/1532-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1532-64-0x00000000004010C0-mapping.dmp

Download
memory/1532-67-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1532-63-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1532-62-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1532-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1532-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1532-74-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1532-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads