d869dc7e1f70c86e40622598abe190ee1d58f32f1c6f7222235d5a1ebff4074f

General

Target

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Size

160KB
MD5

177b75910ae8c0091bafef4950c0b224
SHA1

d4dfb2d2b40224310fbd6d928bf7eded03d814bd
SHA256

3d5fda867fdfb3f414b8edcdda6cefd89118df4399043c35f8e901dae66f7b1b
SHA512

c315ba1d9255fc93ae42a20549645e4a2f2eddddc89b65422c3b8b78f951cba432eff66ab2fac6c1061cfd0738d0918b7730a0b0af4ccfc322a1f97c30e5dc47
SSDEEP

3072:A7tcYSClxQuNuqBkXhQRFFO98DZsJxV1bhZuHKYUl9DGLeb+crM8:otcclxTRjfDZs/Ph4HKYfBt8

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1232	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ypbkryye.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ypbkryye.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1932	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1932	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Token: SeDebugPrivilege	1244	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1440 wrote to memory of 1932	1440	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	28
PID 1932 wrote to memory of 1232	1932	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	29
PID 1932 wrote to memory of 1232	1932	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	29
PID 1932 wrote to memory of 1232	1932	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	29
PID 1932 wrote to memory of 1232	1932	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	29
PID 1932 wrote to memory of 1244	1932	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	9
PID 1244 wrote to memory of 1128	1244	Explorer.EXE	17
PID 1244 wrote to memory of 1188	1244	Explorer.EXE	16
PID 1244 wrote to memory of 1232	1244	Explorer.EXE	29
PID 1244 wrote to memory of 1348	1244	Explorer.EXE	30
PID 1244 wrote to memory of 1348	1244	Explorer.EXE	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
  "C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
    C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6980~1.BAT"
      4⤵
      Deletes itself
      PID:1232

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1188

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-849404140806649969-500632266520989680-1661860255-1203093762600755711434771071"
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms6980848.bat

Filesize
201B

MD5
a50e86cf6ff44dc4bf3a45b5218faff0

SHA1
d2d7e9888fac1889d23a151759fd41de0aa1b89f

SHA256
d7b6143042a88e1105eee1c390de3491a21a19dfc21e1802fcba8a79d5185b05

SHA512
710443c7ef7a3183a86dc8e2a670e55c1b1f6c484b2bd2ed089a543e841304bdeac9d014ea881fd1087b74d84ae3bd927dd0791267f1f873b37d8f90b1c86d57

Download Submit
memory/1128-96-0x0000000000300000-0x0000000000317000-memory.dmp

Filesize
92KB

Download
memory/1128-80-0x0000000037C40000-0x0000000037C50000-memory.dmp

Filesize
64KB

Download
memory/1188-97-0x0000000001AD0000-0x0000000001AE7000-memory.dmp

Filesize
92KB

Download
memory/1188-83-0x0000000037C40000-0x0000000037C50000-memory.dmp

Filesize
64KB

Download
memory/1232-91-0x0000000000200000-0x0000000000214000-memory.dmp

Filesize
80KB

Download
memory/1232-89-0x0000000037DF0000-0x0000000037E00000-memory.dmp

Filesize
64KB

Download
memory/1232-81-0x0000000000200000-0x0000000000214000-memory.dmp

Filesize
80KB

Download
memory/1244-95-0x00000000029E0000-0x00000000029F7000-memory.dmp

Filesize
92KB

Download
memory/1244-75-0x0000000037C40000-0x0000000037C50000-memory.dmp

Filesize
64KB

Download
memory/1244-72-0x00000000029E0000-0x00000000029F7000-memory.dmp

Filesize
92KB

Download
memory/1348-94-0x0000000001B10000-0x0000000001B27000-memory.dmp

Filesize
92KB

Download
memory/1348-92-0x0000000037C40000-0x0000000037C50000-memory.dmp

Filesize
64KB

Download
memory/1348-90-0x0000000037C40000-0x0000000037C50000-memory.dmp

Filesize
64KB

Download
memory/1348-93-0x00000000000D0000-0x00000000000E7000-memory.dmp

Filesize
92KB

Download
memory/1440-65-0x0000000000340000-0x0000000000344000-memory.dmp

Filesize
16KB

Download
memory/1440-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1932-63-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1932-74-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1932-67-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1932-62-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1932-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1932-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1932-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1932-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing