9c0a0d3fcf81863693c5659c71c9e7eb10fe1005715b79c318adf579e7c3f4fc

Analysis

max time kernel
44s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
Size

148KB
MD5

cf8a95fdfdac0838c986c0bf0d3e0644
SHA1

dfb8489d7fa3486e89af729eb60241e7611b1b92
SHA256

caa59a2cbbfed250b7f776e36907a17710c12cdcf2bd8a04ec7a4f3be8125e29
SHA512

7739e52ec9eb778664cf151e16d5b29496ed875431cd3cf4b6924dba992d280dc1769a38ecf63c4601a24a3e0460629afce64611427cd9b90b45a436bdc58aae
SSDEEP

3072:ssKHHVQIy7lIK08RVIizYafDikD1a9InMv90VG3F:7KKAK08RVL0+DiGhnMFyG3

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
3284	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
3284	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3284	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84
PID 3024 wrote to memory of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84
PID 3024 wrote to memory of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84
PID 3024 wrote to memory of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84
PID 3024 wrote to memory of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84
PID 3024 wrote to memory of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84
PID 3024 wrote to memory of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84
PID 3024 wrote to memory of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84
PID 3024 wrote to memory of 3284	3024	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	84
PID 3284 wrote to memory of 4876	3284	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	85
PID 3284 wrote to memory of 4876	3284	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	85
PID 3284 wrote to memory of 4876	3284	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	85
PID 3284 wrote to memory of 2744	3284	de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2744
- C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
  "C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
    C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3309~1.BAT"
      4⤵
      PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-140-0x00007FFB04130000-0x00007FFB04140000-memory.dmp

Filesize
64KB

Download
memory/3024-135-0x00000000014C0000-0x00000000014C4000-memory.dmp

Filesize
16KB

Download
memory/3284-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3284-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3284-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3284-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download