80c7d29a1d98676c27132672175396193cb92ee30bdcfbf6a6c0ceb41b3d9616

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zahlungsbestätigung.exe
Size

1.6MB
MD5

f711e5126f671f7a3b4e124bd553bcdb
SHA1

8ab7bcc77eee7973845299edc8209e7a94c3cc4b
SHA256

80c7d29a1d98676c27132672175396193cb92ee30bdcfbf6a6c0ceb41b3d9616
SHA512

af8c950452169d34a5d56761b20f1968cf99577211668d9f9aa8511d5076fa330b0653a58fcde7ececd8ad5695acffa0460f13affc48831222646c5e4e4fcd6e
SSDEEP

24576:keq3CCnM8MvCqPS9mL04ya8zoKUjXpjXssz3POkTqiB/:zCnTMK2+mcroKUjXNXNZ

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2196	powershell.exe
2144	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zahlungsbestätigung.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2356	Zahlungsbestätigung.exe
2356	Zahlungsbestätigung.exe
2356	Zahlungsbestätigung.exe
2356	Zahlungsbestätigung.exe
2356	Zahlungsbestätigung.exe
2356	Zahlungsbestätigung.exe
2356	Zahlungsbestätigung.exe
2356	Zahlungsbestätigung.exe
2356	Zahlungsbestätigung.exe
2356	Zahlungsbestätigung.exe
2144	powershell.exe
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	Zahlungsbestätigung.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2196	2356	Zahlungsbestätigung.exe	31
PID 2356 wrote to memory of 2196	2356	Zahlungsbestätigung.exe	31
PID 2356 wrote to memory of 2196	2356	Zahlungsbestätigung.exe	31
PID 2356 wrote to memory of 2196	2356	Zahlungsbestätigung.exe	31
PID 2356 wrote to memory of 2144	2356	Zahlungsbestätigung.exe	33
PID 2356 wrote to memory of 2144	2356	Zahlungsbestätigung.exe	33
PID 2356 wrote to memory of 2144	2356	Zahlungsbestätigung.exe	33
PID 2356 wrote to memory of 2144	2356	Zahlungsbestätigung.exe	33
PID 2356 wrote to memory of 2720	2356	Zahlungsbestätigung.exe	35
PID 2356 wrote to memory of 2720	2356	Zahlungsbestätigung.exe	35
PID 2356 wrote to memory of 2720	2356	Zahlungsbestätigung.exe	35
PID 2356 wrote to memory of 2720	2356	Zahlungsbestätigung.exe	35
PID 2356 wrote to memory of 2944	2356	Zahlungsbestätigung.exe	37
PID 2356 wrote to memory of 2944	2356	Zahlungsbestätigung.exe	37
PID 2356 wrote to memory of 2944	2356	Zahlungsbestätigung.exe	37
PID 2356 wrote to memory of 2944	2356	Zahlungsbestätigung.exe	37
PID 2356 wrote to memory of 2732	2356	Zahlungsbestätigung.exe	38
PID 2356 wrote to memory of 2732	2356	Zahlungsbestätigung.exe	38
PID 2356 wrote to memory of 2732	2356	Zahlungsbestätigung.exe	38
PID 2356 wrote to memory of 2732	2356	Zahlungsbestätigung.exe	38
PID 2356 wrote to memory of 2132	2356	Zahlungsbestätigung.exe	39
PID 2356 wrote to memory of 2132	2356	Zahlungsbestätigung.exe	39
PID 2356 wrote to memory of 2132	2356	Zahlungsbestätigung.exe	39
PID 2356 wrote to memory of 2132	2356	Zahlungsbestätigung.exe	39
PID 2356 wrote to memory of 2604	2356	Zahlungsbestätigung.exe	40
PID 2356 wrote to memory of 2604	2356	Zahlungsbestätigung.exe	40
PID 2356 wrote to memory of 2604	2356	Zahlungsbestätigung.exe	40
PID 2356 wrote to memory of 2604	2356	Zahlungsbestätigung.exe	40
PID 2356 wrote to memory of 2908	2356	Zahlungsbestätigung.exe	41
PID 2356 wrote to memory of 2908	2356	Zahlungsbestätigung.exe	41
PID 2356 wrote to memory of 2908	2356	Zahlungsbestätigung.exe	41
PID 2356 wrote to memory of 2908	2356	Zahlungsbestätigung.exe	41

C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe
"C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GFoZjxH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GFoZjxH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF5C4.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe
  "C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe"
  2⤵
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe
  "C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe"
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe
  "C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe"
  2⤵
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe
  "C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe"
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe
  "C:\Users\Admin\AppData\Local\Temp\Zahlungsbestätigung.exe"
  2⤵
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF5C4.tmp

Filesize
1KB

MD5
7c03438ebd88c523d79f1c053f15bd3b

SHA1
e35347bf1f31dd74b1f87e3d1b5863763ff51e24

SHA256
2a6f74cd2125bf888468867238827bcd3aad2e9200288eabaed916aab4149c51

SHA512
0da06c47925a0f54dc53ec9c0f1c1f5c54d14febed7e287d193b90e3a47fd83a4b388b78008cb1ec39824969ca2a5c44a1e68b98df606c69d51b32e23590f9fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C636TX4YJLP4BGZGJTEX.temp

Filesize
7KB

MD5
6aa40ac45d7dee8c101055f2d1034caa

SHA1
7a8a7a808aaf313b26b3902e79c82cbbb867790f

SHA256
a0ea71b291c01d314ce9ae136ed98af0b2b06b93fbf15e6e5b32927edb430302

SHA512
d349fbd6bb43fa70fc603be0fb05f23ad95be97dbf334ab1e404d836282ae1d198c6bdfffbc3e3e55bdda3047f25eb8817f5482c0ee9b66e19aabe0bea280e50

Download Submit
memory/2356-0-0x000000007470E000-0x000000007470F000-memory.dmp

Filesize
4KB

Download
memory/2356-1-0x0000000000340000-0x0000000000414000-memory.dmp

Filesize
848KB

Download
memory/2356-2-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-3-0x0000000000680000-0x000000000068E000-memory.dmp

Filesize
56KB

Download
memory/2356-4-0x000000007470E000-0x000000007470F000-memory.dmp

Filesize
4KB

Download
memory/2356-5-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-6-0x0000000005CC0000-0x0000000005D44000-memory.dmp

Filesize
528KB

Download
memory/2356-19-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download