4c4ce1f5d2a9009dd1e180cde19c89680485a4dc2f8577ae84a484d97c0c0551

Analysis

max time kernel
3s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Size

164KB
MD5

d84e5bbf8c16e91fec275230fa6de7a6
SHA1

e4855f1d90ad6f0755988bf5f090dee9f3ca403e
SHA256

674f447b67fa6481c04d7d4c7dc47ecc0d3956c0c7b9006c845efebbc8fb318f
SHA512

4c3418c993eb0e0bf27106e672d2e2ba60ad0f1cb6c8ec1f85b6c5c6459e061c755ffd05cb887e0d6eecd48212ef55832f2189f0afe7be2e72ca67f30d0c534b
SSDEEP

3072:ZJ/YG2oBFOU2IG7N1f0ufvLFz5+pWwW14Ih2M7XygCQJz9Jf+yY:ZJ/GoD/2VN1fpfTv+Iv14IhrzyFQt

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4216 set thread context of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
644	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
644	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81
PID 4216 wrote to memory of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81
PID 4216 wrote to memory of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81
PID 4216 wrote to memory of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81
PID 4216 wrote to memory of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81
PID 4216 wrote to memory of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81
PID 4216 wrote to memory of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81
PID 4216 wrote to memory of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81
PID 4216 wrote to memory of 644	4216	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	81
PID 644 wrote to memory of 5080	644	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	82
PID 644 wrote to memory of 5080	644	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	82
PID 644 wrote to memory of 5080	644	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	82
PID 644 wrote to memory of 2724	644	ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe	54

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2724
- C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
  "C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
    C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7640~1.BAT"
      4⤵
      PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/644-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/644-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4216-133-0x0000000000540000-0x0000000000544000-memory.dmp

Filesize
16KB

Download