Analysis
-
max time kernel
50s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe
Resource
win10v2004-20221111-en
General
-
Target
Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe
-
Size
117KB
-
MD5
0dff505738ec8703e40edbf5f643d2ae
-
SHA1
3461115ad15fea2eb45773e2a842222ce8ec204a
-
SHA256
f54b108aa1be2ea97262233f5233ced23ca3c5a9174bf625591f13c3537a4476
-
SHA512
d76052613726e9bc1f738dc2e153bc5e2719c0bc5c1a90802dc133972734a0e4ecd16e72fba1b9f494b7ab203dbe7fc2fbeae50a77ec40f622ac23feacc1c164
-
SSDEEP
3072:+GegrRkXIWxsa2zk8xqcMVgNWBckfKmEJI:+GfVRWSdku1tAykSmSI
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1764 rvffdxqpjj.pre 824 rvffdxqpjj.pre -
resource yara_rule behavioral1/memory/832-60-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/memory/832-59-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/memory/832-57-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/memory/832-65-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/memory/832-66-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/memory/832-69-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/memory/824-95-0x0000000000400000-0x0000000000412000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1864 svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 1864 svchost.exe 1864 svchost.exe 1764 rvffdxqpjj.pre -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\bycuqpvu = "C:\\Users\\Admin\\AppData\\Roaming\\Hmwmpmkycyc\\pnfnbmfqpvu.exe" svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1324 set thread context of 832 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 28 PID 1764 set thread context of 824 1764 rvffdxqpjj.pre 35 -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 1764 rvffdxqpjj.pre 1764 rvffdxqpjj.pre -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 1764 rvffdxqpjj.pre -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1100 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 27 PID 1324 wrote to memory of 1100 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 27 PID 1324 wrote to memory of 1100 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 27 PID 1324 wrote to memory of 1100 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 27 PID 1324 wrote to memory of 832 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 28 PID 1324 wrote to memory of 832 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 28 PID 1324 wrote to memory of 832 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 28 PID 1324 wrote to memory of 832 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 28 PID 1324 wrote to memory of 832 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 28 PID 1324 wrote to memory of 832 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 28 PID 1324 wrote to memory of 832 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 28 PID 1324 wrote to memory of 832 1324 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 28 PID 832 wrote to memory of 1864 832 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 30 PID 832 wrote to memory of 1864 832 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 30 PID 832 wrote to memory of 1864 832 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 30 PID 832 wrote to memory of 1864 832 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 30 PID 1100 wrote to memory of 1988 1100 cmd.exe 31 PID 1100 wrote to memory of 1988 1100 cmd.exe 31 PID 1100 wrote to memory of 1988 1100 cmd.exe 31 PID 1100 wrote to memory of 1988 1100 cmd.exe 31 PID 1988 wrote to memory of 1640 1988 net.exe 32 PID 1988 wrote to memory of 1640 1988 net.exe 32 PID 1988 wrote to memory of 1640 1988 net.exe 32 PID 1988 wrote to memory of 1640 1988 net.exe 32 PID 832 wrote to memory of 1864 832 Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe 30 PID 1864 wrote to memory of 1764 1864 svchost.exe 33 PID 1864 wrote to memory of 1764 1864 svchost.exe 33 PID 1864 wrote to memory of 1764 1864 svchost.exe 33 PID 1864 wrote to memory of 1764 1864 svchost.exe 33 PID 1764 wrote to memory of 588 1764 rvffdxqpjj.pre 34 PID 1764 wrote to memory of 588 1764 rvffdxqpjj.pre 34 PID 1764 wrote to memory of 588 1764 rvffdxqpjj.pre 34 PID 1764 wrote to memory of 588 1764 rvffdxqpjj.pre 34 PID 1764 wrote to memory of 824 1764 rvffdxqpjj.pre 35 PID 1764 wrote to memory of 824 1764 rvffdxqpjj.pre 35 PID 1764 wrote to memory of 824 1764 rvffdxqpjj.pre 35 PID 1764 wrote to memory of 824 1764 rvffdxqpjj.pre 35 PID 1764 wrote to memory of 824 1764 rvffdxqpjj.pre 35 PID 1764 wrote to memory of 824 1764 rvffdxqpjj.pre 35 PID 1764 wrote to memory of 824 1764 rvffdxqpjj.pre 35 PID 1764 wrote to memory of 824 1764 rvffdxqpjj.pre 35 PID 588 wrote to memory of 1580 588 cmd.exe 37 PID 588 wrote to memory of 1580 588 cmd.exe 37 PID 588 wrote to memory of 1580 588 cmd.exe 37 PID 588 wrote to memory of 1580 588 cmd.exe 37 PID 824 wrote to memory of 1104 824 rvffdxqpjj.pre 38 PID 824 wrote to memory of 1104 824 rvffdxqpjj.pre 38 PID 824 wrote to memory of 1104 824 rvffdxqpjj.pre 38 PID 824 wrote to memory of 1104 824 rvffdxqpjj.pre 38 PID 1580 wrote to memory of 1912 1580 net.exe 39 PID 1580 wrote to memory of 1912 1580 net.exe 39 PID 1580 wrote to memory of 1912 1580 net.exe 39 PID 1580 wrote to memory of 1912 1580 net.exe 39 PID 824 wrote to memory of 1104 824 rvffdxqpjj.pre 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe"C:\Users\Admin\AppData\Local\Temp\Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:1640
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe"C:\Users\Admin\AppData\Local\Temp\Ausgleich der stornierten Buchung Ihrer Bestellung 22.08.2013.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\rvffdxqpjj.preC:\Users\Admin\AppData\Local\Temp\rvffdxqpjj.pre4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc5⤵
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc6⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc7⤵PID:1912
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rvffdxqpjj.preC:\Users\Admin\AppData\Local\Temp\rvffdxqpjj.pre5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\svchost.exesvchost.exe6⤵
- Adds Run key to start application
PID:1104
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD50dff505738ec8703e40edbf5f643d2ae
SHA13461115ad15fea2eb45773e2a842222ce8ec204a
SHA256f54b108aa1be2ea97262233f5233ced23ca3c5a9174bf625591f13c3537a4476
SHA512d76052613726e9bc1f738dc2e153bc5e2719c0bc5c1a90802dc133972734a0e4ecd16e72fba1b9f494b7ab203dbe7fc2fbeae50a77ec40f622ac23feacc1c164
-
Filesize
117KB
MD50dff505738ec8703e40edbf5f643d2ae
SHA13461115ad15fea2eb45773e2a842222ce8ec204a
SHA256f54b108aa1be2ea97262233f5233ced23ca3c5a9174bf625591f13c3537a4476
SHA512d76052613726e9bc1f738dc2e153bc5e2719c0bc5c1a90802dc133972734a0e4ecd16e72fba1b9f494b7ab203dbe7fc2fbeae50a77ec40f622ac23feacc1c164
-
Filesize
117KB
MD50dff505738ec8703e40edbf5f643d2ae
SHA13461115ad15fea2eb45773e2a842222ce8ec204a
SHA256f54b108aa1be2ea97262233f5233ced23ca3c5a9174bf625591f13c3537a4476
SHA512d76052613726e9bc1f738dc2e153bc5e2719c0bc5c1a90802dc133972734a0e4ecd16e72fba1b9f494b7ab203dbe7fc2fbeae50a77ec40f622ac23feacc1c164
-
Filesize
117KB
MD50dff505738ec8703e40edbf5f643d2ae
SHA13461115ad15fea2eb45773e2a842222ce8ec204a
SHA256f54b108aa1be2ea97262233f5233ced23ca3c5a9174bf625591f13c3537a4476
SHA512d76052613726e9bc1f738dc2e153bc5e2719c0bc5c1a90802dc133972734a0e4ecd16e72fba1b9f494b7ab203dbe7fc2fbeae50a77ec40f622ac23feacc1c164
-
Filesize
117KB
MD50dff505738ec8703e40edbf5f643d2ae
SHA13461115ad15fea2eb45773e2a842222ce8ec204a
SHA256f54b108aa1be2ea97262233f5233ced23ca3c5a9174bf625591f13c3537a4476
SHA512d76052613726e9bc1f738dc2e153bc5e2719c0bc5c1a90802dc133972734a0e4ecd16e72fba1b9f494b7ab203dbe7fc2fbeae50a77ec40f622ac23feacc1c164
-
Filesize
117KB
MD50dff505738ec8703e40edbf5f643d2ae
SHA13461115ad15fea2eb45773e2a842222ce8ec204a
SHA256f54b108aa1be2ea97262233f5233ced23ca3c5a9174bf625591f13c3537a4476
SHA512d76052613726e9bc1f738dc2e153bc5e2719c0bc5c1a90802dc133972734a0e4ecd16e72fba1b9f494b7ab203dbe7fc2fbeae50a77ec40f622ac23feacc1c164