c8898a69dd9c13706beb282653105652be78ed644f78766099151a3df48348f2

General

Target

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
Size

160KB
MD5

177b75910ae8c0091bafef4950c0b224
SHA1

d4dfb2d2b40224310fbd6d928bf7eded03d814bd
SHA256

3d5fda867fdfb3f414b8edcdda6cefd89118df4399043c35f8e901dae66f7b1b
SHA512

c315ba1d9255fc93ae42a20549645e4a2f2eddddc89b65422c3b8b78f951cba432eff66ab2fac6c1061cfd0738d0918b7730a0b0af4ccfc322a1f97c30e5dc47
SSDEEP

3072:A7tcYSClxQuNuqBkXhQRFFO98DZsJxV1bhZuHKYUl9DGLeb+crM8:otcclxTRjfDZs/Ph4HKYfBt8

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
696	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
1736	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
1736	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1284	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
Token: SeDebugPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 2028 wrote to memory of 1736	2028	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1736 wrote to memory of 696	1736	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	29
PID 1736 wrote to memory of 696	1736	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	29
PID 1736 wrote to memory of 696	1736	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	29
PID 1736 wrote to memory of 696	1736	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	29
PID 1736 wrote to memory of 1284	1736	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	15
PID 1284 wrote to memory of 1140	1284	Explorer.EXE	12
PID 1284 wrote to memory of 1248	1284	Explorer.EXE	13
PID 1284 wrote to memory of 1736	1284	Explorer.EXE	28
PID 1284 wrote to memory of 696	1284	Explorer.EXE	29
PID 1284 wrote to memory of 596	1284	Explorer.EXE	30
PID 1284 wrote to memory of 596	1284	Explorer.EXE	30

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1140

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1248

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
  "C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
    C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9336~1.BAT"
      4⤵
      Deletes itself
      PID:696

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-905949363-881897106-1796388776-142554341553651409-18886426421023073940-566815484"
1⤵
PID:596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms9336058.bat

Filesize
201B

MD5
762f48ce93670c84a61ae2367032c309

SHA1
75d475fa35b20cac3a94896b2aa97f449200be07

SHA256
0d42aaad9eb478be36919f268833ce3219e19e6af634bef3c6efd710f2cdedde

SHA512
c616d28f591d3b1230f25d9c6142fac4263e299189d821e72a93486f0b43ae2a9af7ac330dafd8f46e5bfdd425338cc91490f16d190b943904543d5a10e2cdf3

Download Submit
memory/596-90-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/596-91-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/596-94-0x00000000000D0000-0x00000000000E7000-memory.dmp

Filesize
92KB

Download
memory/596-93-0x00000000000F0000-0x0000000000107000-memory.dmp

Filesize
92KB

Download
memory/1140-89-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1140-97-0x0000000001CA0000-0x0000000001CB7000-memory.dmp

Filesize
92KB

Download
memory/1248-95-0x0000000000120000-0x0000000000137000-memory.dmp

Filesize
92KB

Download
memory/1248-88-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1284-96-0x0000000002200000-0x0000000002217000-memory.dmp

Filesize
92KB

Download
memory/1284-75-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1284-72-0x0000000002200000-0x0000000002217000-memory.dmp

Filesize
92KB

Download
memory/1736-63-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1736-80-0x0000000000270000-0x0000000000284000-memory.dmp

Filesize
80KB

Download
memory/1736-74-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1736-67-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1736-62-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1736-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1736-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1736-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1736-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2028-65-0x00000000002C0000-0x00000000002C4000-memory.dmp

Filesize
16KB

Download
memory/2028-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing