Resubmissions

22-11-2024 22:54

241122-2vh7gaxmfl 10

22-11-2024 03:27

241122-dzqkcatmht 10

22-11-2024 03:16

241122-dsgc4atlgs 10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 22:54

General

  • Target

    Abrechnung.exe

  • Size

    103KB

  • MD5

    81ff324d2023d8ecb98a127b87d51450

  • SHA1

    acd24c80f6a02f7fe7a388a6779ea49be64674bc

  • SHA256

    7d9fc496bc0ade736bf75e05564e9c93167362ef18450d75222deef0664f9ed5

  • SHA512

    38b17683e835e7259a6972d0f920f9ac7f5823591962c624aa795c39c3213d0735bacd76c72b7255be1cefeb9c298ffc31266513f088684969e5e18ad4e0a139

  • SSDEEP

    1536:o7ZrIoIlP/A765noAXMoiCQ/5NSDy+Ud1IE9vpFARgHsjoCje6fLCy:odIp/A0noAcoiCQ/5NS6ERnECnfLCy

Malware Config

Signatures

  • Disables RegEdit via registry modification 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
    "C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
      C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
          C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3300
          • C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
            C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2452
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              6⤵
              • Disables RegEdit via registry modification
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4132
              • C:\Windows\SysWOW64\reg.exe
                reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:860
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3084
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre

    Filesize

    103KB

    MD5

    81ff324d2023d8ecb98a127b87d51450

    SHA1

    acd24c80f6a02f7fe7a388a6779ea49be64674bc

    SHA256

    7d9fc496bc0ade736bf75e05564e9c93167362ef18450d75222deef0664f9ed5

    SHA512

    38b17683e835e7259a6972d0f920f9ac7f5823591962c624aa795c39c3213d0735bacd76c72b7255be1cefeb9c298ffc31266513f088684969e5e18ad4e0a139

  • memory/2092-5-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2092-3-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2092-0-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2092-4-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2452-23-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3300-17-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/3460-1-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/4132-25-0x000000007FCD0000-0x000000007FCE1000-memory.dmp

    Filesize

    68KB

  • memory/4132-21-0x000000007FCD0000-0x000000007FCE1000-memory.dmp

    Filesize

    68KB

  • memory/4132-26-0x000000007FCD0000-0x000000007FCE1000-memory.dmp

    Filesize

    68KB

  • memory/4132-30-0x000000007FCD0000-0x000000007FCE1000-memory.dmp

    Filesize

    68KB

  • memory/4948-6-0x000000007FBF0000-0x000000007FC01000-memory.dmp

    Filesize

    68KB

  • memory/4948-13-0x000000007FBF0000-0x000000007FC01000-memory.dmp

    Filesize

    68KB