6d273bfaf4339e6d40c9b0ebfdc9818d746f62ce71c6e0a34d45e75408a4734e

Analysis

max time kernel
169s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
Size

144KB
MD5

165e0668c9007305f4335ff6ed4c9854
SHA1

b8ff03c73b8df5f9a840378b6862c39bd2b5eb5a
SHA256

9bfb04be2ce0a624be8edc3666d93686b73ead053644430876047c4a88862881
SHA512

a0232ea13fc9e30b9fbe89cd865a608ddb5137d03642ccb9674bfb8cd12590ac8560f6f6adc0ef2ee6040e50216f0abc1110d7d457b468534649eb2de8e5984b
SSDEEP

3072:UT6NN25fPi/Xaxa6keLTCYAo4RaHOP6AU59ZvHa3B:5fMXi/XaxBn3C3o4ROOybLCR

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
2792	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
2792	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80
PID 1108 wrote to memory of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80
PID 1108 wrote to memory of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80
PID 1108 wrote to memory of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80
PID 1108 wrote to memory of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80
PID 1108 wrote to memory of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80
PID 1108 wrote to memory of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80
PID 1108 wrote to memory of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80
PID 1108 wrote to memory of 2792	1108	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	80
PID 2792 wrote to memory of 4224	2792	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	81
PID 2792 wrote to memory of 4224	2792	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	81
PID 2792 wrote to memory of 4224	2792	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	81
PID 2792 wrote to memory of 1048	2792	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	44

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1048
- C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
  "C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
    C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3944~1.BAT"
      4⤵
      PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-139-0x00007FFAC2D90000-0x00007FFAC2DA0000-memory.dmp

Filesize
64KB

Download
memory/1108-135-0x00000000014A0000-0x00000000014A4000-memory.dmp

Filesize
16KB

Download
memory/2792-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2792-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2792-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2792-140-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download