5f7a7924e445d2f77382fb783658871b170c21c5c43fa9c8f789549fd9792d36

Analysis

max time kernel
38s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
Size

176KB
MD5

0bdbb242c3d65c99b0c4b3bdad19a793
SHA1

1b2a37b64b1a7ca71b801125faca273408bb7e67
SHA256

942b643d07c0cb4ac1593dccd846fe4bcda402f5f74fa4ba1437248e7c89e0c3
SHA512

387c6455dc286989d0de8b418505b5453ce82c262132eba2975006b59057a698bb5fe33bfa428690d0db30b3396ba6b699a1ad2b68482bc04df27975ca19206e
SSDEEP

3072:bBfHcmI+fMEJRvGGs4Edlb9kMv0UNLp+CSYnzyZyvBwwQlF9KwrrznF19AaROhze:blH80NJ5ZEdT8UlpaYzyZeBzQJPrrjFt

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
3088	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
3088	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80
PID 2824 wrote to memory of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80
PID 2824 wrote to memory of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80
PID 2824 wrote to memory of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80
PID 2824 wrote to memory of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80
PID 2824 wrote to memory of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80
PID 2824 wrote to memory of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80
PID 2824 wrote to memory of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80
PID 2824 wrote to memory of 3088	2824	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	80
PID 3088 wrote to memory of 4848	3088	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	81
PID 3088 wrote to memory of 4848	3088	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	81
PID 3088 wrote to memory of 4848	3088	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	81
PID 3088 wrote to memory of 2152	3088	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	46

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2152
- C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
  "C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
    C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS8171~1.BAT"
      4⤵
      PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-140-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/2824-132-0x0000000000A20000-0x0000000000ADF000-memory.dmp

Filesize
764KB

Download
memory/3088-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3088-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3088-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3088-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download