6cba950ddc2839f1fe786619cf78373c9d24afbb489e2fbe0619c4f741101a85

General

Target

1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Size

172KB
MD5

3d83c8e629e7a271448568b4edf53627
SHA1

28f376dbfb54f68fa87dbb20255574cc1fa9f63e
SHA256

b5281c0c00bdc0ebde811cb4ae7458eefd4c4add80eb4d8ef3e4a90280b06133
SHA512

b68333badf1c5147e11cd1c0299732eda31268bbc690521beb1304370b007dc9cc786033d0c6e332d42d2ac90699c49e1fdd832a603b03b7f26d0fe36092fbb0
SSDEEP

3072:Aac0KMWBexMF+4eXsy3cvf5ftCC6ofPBPK5dTLiwCOv8G7PAPplKrrz:AbKXxI+4GZcXgohPKLF8Coh

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1380 cmd.exe

pid	process
1380	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe

description	pid	process	target process
PID 1048 set thread context of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe

Modifies registry class 14 IoCs

Processes:

1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\print\command	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\printto	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1_1_KU~1.EXE,0"	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1_1_KU~1.EXE \"%1\""	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\printto\command	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1_1_KU~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\ = "Tif Document"	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\open	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1_1_KU~1.EXE /p \"%1\""	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\open\command	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\print	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\DefaultIcon	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exeExplorer.EXE

pid	process
1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
948	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
948	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE

pid	process
1400	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	948	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Token: SeDebugPrivilege	1400	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe

pid	process
1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE

pid	process
1400	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exeExplorer.EXE

description	pid	process	target process
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 1048 wrote to memory of 948	1048	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
PID 948 wrote to memory of 1380	948	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	cmd.exe
PID 948 wrote to memory of 1380	948	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	cmd.exe
PID 948 wrote to memory of 1380	948	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	cmd.exe
PID 948 wrote to memory of 1380	948	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	cmd.exe
PID 948 wrote to memory of 1400	948	1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe	Explorer.EXE
PID 1400 wrote to memory of 1264	1400	Explorer.EXE	taskhost.exe
PID 1400 wrote to memory of 1340	1400	Explorer.EXE	Dwm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
  "C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
    C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6137~1.BAT"
      4⤵
      Deletes itself
      PID:1380

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1340

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms6137067.bat

Filesize
201B

MD5
af6720bc57444c4427162a1092cd423b

SHA1
60b5a677fdab0419c424bbf99c44680538927711

SHA256
0a597a293e4f21b0665af2759e01552fcba5900539cd4e505b1af90683e1ff50

SHA512
5cd28cf9c77426fa1162a7b5a947f09471bfff06e91afc2f8c5ec4e0ef49a2418c1f6f40c63e9a8a0784effbf9a419e860da3f57ae7ed4183c8b9e013fde7ecd

Download Submit
memory/948-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/948-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/948-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/948-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/948-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/948-64-0x00000000004010C0-mapping.dmp

Download
memory/948-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/948-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/948-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1048-65-0x00000000001D0000-0x00000000001D4000-memory.dmp

Filesize
16KB

Download
memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1264-81-0x00000000376A0000-0x00000000376B0000-memory.dmp

Filesize
64KB

Download
memory/1264-84-0x0000000001D20000-0x0000000001D37000-memory.dmp

Filesize
92KB

Download
memory/1340-82-0x00000000376A0000-0x00000000376B0000-memory.dmp

Filesize
64KB

Download
memory/1340-85-0x0000000000120000-0x0000000000137000-memory.dmp

Filesize
92KB

Download
memory/1380-71-0x0000000000000000-mapping.dmp

Download
memory/1400-75-0x00000000376A0000-0x00000000376B0000-memory.dmp

Filesize
64KB

Download
memory/1400-72-0x00000000026E0000-0x00000000026F7000-memory.dmp

Filesize
92KB

Download
memory/1400-83-0x00000000026E0000-0x00000000026F7000-memory.dmp

Filesize
92KB

Download
memory/1400-86-0x00000000026E0000-0x00000000026F7000-memory.dmp

Filesize
92KB

Download
memory/1400-87-0x000007FEF6BA0000-0x000007FEF6CE3000-memory.dmp

Filesize
1.3MB

Download
memory/1400-88-0x000007FEB7180000-0x000007FEB718A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads