c8b7d76b904d86567e05ea52486147d3a00db05dd12fd172486aa31d0f8c124f

General

Target

Abrechnung53534.exe
Size

728KB
MD5

c55825824295fb010050e0a8929088dd
SHA1

e3047fa2e4128af1ca2cd5a854a9772421ab185e
SHA256

0a77fc85a49ed22e8a829c57253cffff4af89a690cec2125ebdb53be09f64e86
SHA512

7be00b8a624438b37d7d10b5327accb94e9ed0ab68ff809fd4a18699bf1f64cb6700827431225be366cf2ef4410c90ce314e2256b55bcc474a208de6e2f0b6d8
SSDEEP

12288:cLgIvdjsT2N167Tn/VHbiaPzvLOyx1v2ef0j/uakSB0aA+PmLgaYM:eDvCD7/V+aPzSe1vto/T0aA+a5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5016	bjikobd.exe
3100	bjikobd.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2332 set thread context of 1804	2332	Abrechnung53534.exe	86
PID 5016 set thread context of 3100	5016	bjikobd.exe	88

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3144	3100	WerFault.exe	88
2744	3100	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abrechnung53534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bjikobd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bjikobd.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ff55ba41-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00660066003500350062006100340031002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00660066003500350062006100340031002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ff55ba41-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ff55ba41-0000-0000-0000-d01200000000}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ff55ba41-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ff55ba41-0000-0000-0000-f0ff3a000000}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ff55ba41-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133729338228566125"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133729338232628519"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133727673558404184"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133727673561060157"	svchost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2332	Abrechnung53534.exe
2332	Abrechnung53534.exe
1804	Abrechnung53534.exe
1804	Abrechnung53534.exe
5016	bjikobd.exe
5016	bjikobd.exe
3100	bjikobd.exe
3100	bjikobd.exe
3100	bjikobd.exe
3100	bjikobd.exe
3100	bjikobd.exe
3100	bjikobd.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	bjikobd.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2332	Abrechnung53534.exe
5016	bjikobd.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1804	2332	Abrechnung53534.exe	86
PID 2332 wrote to memory of 1804	2332	Abrechnung53534.exe	86
PID 2332 wrote to memory of 1804	2332	Abrechnung53534.exe	86
PID 2332 wrote to memory of 1804	2332	Abrechnung53534.exe	86
PID 2332 wrote to memory of 1804	2332	Abrechnung53534.exe	86
PID 2332 wrote to memory of 1804	2332	Abrechnung53534.exe	86
PID 2332 wrote to memory of 1804	2332	Abrechnung53534.exe	86
PID 5016 wrote to memory of 3100	5016	bjikobd.exe	88
PID 5016 wrote to memory of 3100	5016	bjikobd.exe	88
PID 5016 wrote to memory of 3100	5016	bjikobd.exe	88
PID 5016 wrote to memory of 3100	5016	bjikobd.exe	88
PID 5016 wrote to memory of 3100	5016	bjikobd.exe	88
PID 5016 wrote to memory of 3100	5016	bjikobd.exe	88
PID 5016 wrote to memory of 3100	5016	bjikobd.exe	88
PID 3100 wrote to memory of 780	3100	bjikobd.exe	8
PID 780 wrote to memory of 2184	780	svchost.exe	94
PID 780 wrote to memory of 2184	780	svchost.exe	94
PID 780 wrote to memory of 2788	780	svchost.exe	96
PID 780 wrote to memory of 2788	780	svchost.exe	96
PID 780 wrote to memory of 4524	780	svchost.exe	97
PID 780 wrote to memory of 4524	780	svchost.exe	97
PID 780 wrote to memory of 4524	780	svchost.exe	97

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:2184
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:2788
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4524

C:\Users\Admin\AppData\Local\Temp\Abrechnung53534.exe
"C:\Users\Admin\AppData\Local\Temp\Abrechnung53534.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\Abrechnung53534.exe
  C:\Users\Admin\AppData\Local\Temp\Abrechnung53534.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804

C:\Users\Admin\AppData\Local\Temp\bjikobd.exe
C:\Users\Admin\AppData\Local\Temp\bjikobd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\bjikobd.exe
  C:\Users\Admin\AppData\Local\Temp\bjikobd.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 656
    3⤵
    - Program crash
    PID:3144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 664
    3⤵
    - Program crash
    PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3100 -ip 3100
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3100 -ip 3100
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\regid.1991-06.com.microsoft\znhmfgj

Filesize
654B

MD5
92125334f01fd050804771e1669ea39d

SHA1
68206bdab392de285a11f3a4eca674600660dafa

SHA256
04c1be3466e34faf06f24303a46e2d9d8d3cb10aa37f54bed4a8f80be752547f

SHA512
7231240bc48107714d686bb622fe29316bb707dfe6f2f86193cf9e160d9e4e80b1116358952a20a6af4d17a8e7d5b016574a227ea4f735701547157f52d0a127

Download Submit
C:\Users\Admin\AppData\Local\Temp\bjikobd.exe

Filesize
728KB

MD5
c55825824295fb010050e0a8929088dd

SHA1
e3047fa2e4128af1ca2cd5a854a9772421ab185e

SHA256
0a77fc85a49ed22e8a829c57253cffff4af89a690cec2125ebdb53be09f64e86

SHA512
7be00b8a624438b37d7d10b5327accb94e9ed0ab68ff809fd4a18699bf1f64cb6700827431225be366cf2ef4410c90ce314e2256b55bcc474a208de6e2f0b6d8

Download Submit
F:\$RECYCLE.BIN\S-1-5-18\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
memory/780-19-0x0000000035220000-0x0000000035297000-memory.dmp

Filesize
476KB

Download
memory/780-21-0x0000000035220000-0x0000000035297000-memory.dmp

Filesize
476KB

Download
memory/780-3421-0x0000000035220000-0x0000000035297000-memory.dmp

Filesize
476KB

Download
memory/780-235-0x0000000035220000-0x0000000035297000-memory.dmp

Filesize
476KB

Download
memory/780-29-0x0000000035220000-0x0000000035297000-memory.dmp

Filesize
476KB

Download
memory/780-25-0x0000000035220000-0x0000000035297000-memory.dmp

Filesize
476KB

Download
memory/780-27-0x0000000035220000-0x0000000035297000-memory.dmp

Filesize
476KB

Download
memory/780-22-0x0000000035220000-0x0000000035297000-memory.dmp

Filesize
476KB

Download
memory/1804-4-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1804-1-0x0000000000400000-0x0000000004429000-memory.dmp

Filesize
64.2MB

Download
memory/1804-5-0x0000000004990000-0x0000000004BDB000-memory.dmp

Filesize
2.3MB

Download
memory/1804-2-0x0000000000400000-0x0000000004429000-memory.dmp

Filesize
64.2MB

Download
memory/1804-3-0x0000000004770000-0x000000000498A000-memory.dmp

Filesize
2.1MB

Download
memory/2332-0-0x0000000000670000-0x0000000000675000-memory.dmp

Filesize
20KB

Download
memory/3100-15-0x00000000049C0000-0x0000000004C0B000-memory.dmp

Filesize
2.3MB

Download
memory/3100-13-0x0000000000400000-0x00000000004A4400-memory.dmp

Filesize
657KB

Download
memory/5016-9-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download

Analysis

Sharing