e5319526bf0a00af0448a08685bdafa14a94b71d2774ca42491b12859030844c

Analysis

max time kernel
45s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
Size

144KB
MD5

5d24900b14b68b029005d07c1e56e537
SHA1

0659a9a2c0e8182757bf0f77fbd74360315d528b
SHA256

999cf93e01dfd4e6dd7258381e5a3cf93f0c516130b7a7ee0cbfa2ee6f3f7d60
SHA512

89dc83192c8ae91a4e83ee02b5a60a9fca6faefe8018a07b07a8f2210702d74996d85c6c4a190fde9306d230a72ea7bef631aa9dc5cb2c0d5e9dc45a5bb15443
SSDEEP

3072:CQq8+Jd06U0a/t1DKd6neha4lDpzhy7GwDs:28e0dt1LOawDaSx

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2720 set thread context of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
4204	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
4204	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82
PID 2720 wrote to memory of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82
PID 2720 wrote to memory of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82
PID 2720 wrote to memory of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82
PID 2720 wrote to memory of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82
PID 2720 wrote to memory of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82
PID 2720 wrote to memory of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82
PID 2720 wrote to memory of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82
PID 2720 wrote to memory of 4204	2720	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	82
PID 4204 wrote to memory of 4728	4204	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	83
PID 4204 wrote to memory of 4728	4204	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	83
PID 4204 wrote to memory of 4728	4204	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	83
PID 4204 wrote to memory of 2744	4204	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	39

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2744
- C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
  "C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
    C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7015~1.BAT"
      4⤵
      PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2720-135-0x0000000002D10000-0x0000000002D14000-memory.dmp

Filesize
16KB

Download
memory/4204-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4204-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download