Analysis
-
max time kernel
146s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 02:18
Static task
static1
Behavioral task
behavioral1
Sample
2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
Resource
win10v2004-20220901-en
General
-
Target
2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
-
Size
204KB
-
MD5
bf08a33a6aa04fd576d4661bfe409d63
-
SHA1
33bac2b5647c3cf464e5b2cbd7e108aa75877be9
-
SHA256
796c421ab9d0cb0b7e2de528cc7535c3eccabb31c888a04796593654ec37a0e2
-
SHA512
4f11e2e9e606c68afaa534f700f54706f1ce23e99c42398a09e4df7a2481a8c6b07f6ffb2d19db5b2dc2fea7e5b6488692af5eeac52e16ae2b13062d8a3c8140
-
SSDEEP
3072:KbbbeGI6JRubMVHhRJO13oreqjc2K9FZn0f1MsWzdT6V:hGLRdVHheeOFZ0fGL16V
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 576 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exedescription pid process target process PID 1356 set thread context of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exeExplorer.EXEpid process 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 1216 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 1216 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1216 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe Token: SeDebugPrivilege 1256 Explorer.EXE Token: SeShutdownPrivilege 1256 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exepid process 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exeExplorer.EXEdescription pid process target process PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1356 wrote to memory of 1216 1356 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe PID 1216 wrote to memory of 576 1216 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe cmd.exe PID 1216 wrote to memory of 576 1216 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe cmd.exe PID 1216 wrote to memory of 576 1216 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe cmd.exe PID 1216 wrote to memory of 576 1216 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe cmd.exe PID 1216 wrote to memory of 1256 1216 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe Explorer.EXE PID 1256 wrote to memory of 1120 1256 Explorer.EXE taskhost.exe PID 1256 wrote to memory of 1188 1256 Explorer.EXE Dwm.exe PID 1256 wrote to memory of 576 1256 Explorer.EXE cmd.exe PID 1256 wrote to memory of 576 1256 Explorer.EXE cmd.exe PID 1256 wrote to memory of 292 1256 Explorer.EXE conhost.exe PID 1256 wrote to memory of 292 1256 Explorer.EXE conhost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exeC:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2476~1.BAT"4⤵
- Deletes itself
PID:576
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1188
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "8986425151596731253-467848583-640807211010442485-565959821-126160094-381291423"1⤵PID:292
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms2476501.batFilesize
201B
MD589e657c512fbc5aa47308b1bcc3ad2e8
SHA1f87f4e9a8dd1d615aba678a5af2ad39764148356
SHA256e7290d4108cf67eabd8188c4932a906372952ab71af91dd0d492ed9c6f5d9f67
SHA512568ec87e014cc664110ba309e54f422d0af89e66256ed98b00bbfd18157f9a3e76411a8e7e6f78f7bf50273afe5f38d98d974a05fdbdcec8b6e14a12988d0f92
-
memory/292-91-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/292-97-0x00000000001B0000-0x00000000001C7000-memory.dmpFilesize
92KB
-
memory/292-96-0x00000000001D0000-0x00000000001E7000-memory.dmpFilesize
92KB
-
memory/292-92-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/576-73-0x0000000000000000-mapping.dmp
-
memory/576-81-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1120-95-0x0000000001DA0000-0x0000000001DB7000-memory.dmpFilesize
92KB
-
memory/1120-89-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1188-93-0x0000000000120000-0x0000000000137000-memory.dmpFilesize
92KB
-
memory/1188-90-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1216-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-65-0x00000000004010C0-mapping.dmp
-
memory/1216-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1256-94-0x0000000002A20000-0x0000000002A37000-memory.dmpFilesize
92KB
-
memory/1256-76-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1256-74-0x0000000002A20000-0x0000000002A37000-memory.dmpFilesize
92KB
-
memory/1356-54-0x0000000000300000-0x00000000003AC000-memory.dmpFilesize
688KB
-
memory/1356-66-0x0000000000260000-0x0000000000264000-memory.dmpFilesize
16KB
-
memory/1356-55-0x00000000760A1000-0x00000000760A3000-memory.dmpFilesize
8KB