Overview
overview
10Static
static
6AES-NI.exe
windows7-x64
10Abrechnung.exe
windows7-x64
8Box (2).exe
windows7-x64
3Box.exe
windows7-x64
3a66dde2298...43.exe
windows7-x64
9a7768f4973...e0.exe
windows7-x64
10aa7ff3bc28...1e.exe
windows7-x64
7aace43af8d...99.exe
windows7-x64
8ad3cc219a8...ws.dll
windows7-x64
10aee03626b8...b1.exe
windows7-x64
6afd3b729cf...2e.exe
windows7-x64
10b56c4569d6...ss.exe
windows7-x64
3b7989d9eac...ss.zip
windows7-x64
1zsgblrbrum...ke.exe
windows7-x64
7b7d9f11c16...b0.exe
windows7-x64
5b8f60c64c7...af.exe
windows7-x64
10Saldo.Pdf_...__.exe
windows7-x64
9Transazion...__.exe
windows7-x64
9bc557a7bfe...8f.exe
windows7-x64
7bd2d4d4300...17.vbs
windows7-x64
1be03e43db0...5F.exe
windows7-x64
7be03e43db0...8A.exe
windows7-x64
7be514549a2...1f.exe
windows7-x64
9bldjad.ex1.exe
windows7-x64
1bldjad.exe
windows7-x64
1bldjad2.exe
windows7-x64
5c145a26dd6...a0.exe
windows7-x64
3c325092750...db.apk
windows7-x64
3c36c46f4de...6e.exe
windows7-x64
3c3dd2e3cf0...04.exe
windows7-x64
7c71c26bf89...3_.exe
windows7-x64
7c846282987...fd.exe
windows7-x64
5Analysis
-
max time kernel
357s -
max time network
359s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:09
Behavioral task
behavioral1
Sample
AES-NI.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Abrechnung.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral3
Sample
Box (2).exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
Box.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral5
Sample
a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
a7768f4973ad7cf8217212a4d12dbae0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
aace43af8d0932a7b01c5b8fb71c8199.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral9
Sample
ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
b7989d9eacb5a8b224fd183f6ba65e4e6bd30a4f0e4e1a299f0d2b63dcb56730_Archive_useless.zip
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
zsgblrbrumorwxfizuke.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
Saldo.Pdf______________________________________________________________.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral18
Sample
Transazione.Pdf______________________________________________________________.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
bd2d4d43009623941f49554f5932188154fc9d16d820e00db1281d057468b017.vbs
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral23
Sample
be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
bldjad.ex1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
bldjad.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral26
Sample
bldjad2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
c325092750dd55898c47be7ec8a7622c3bf8d1a79c40b160ef7901c2ef18f5db.apk
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
c36c46f4de045ef332decc006694db6e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
Resource
win7-20241010-en
windows7-x64
General
-
Target
Abrechnung.exe
-
Size
103KB
-
MD5
81ff324d2023d8ecb98a127b87d51450
-
SHA1
acd24c80f6a02f7fe7a388a6779ea49be64674bc
-
SHA256
7d9fc496bc0ade736bf75e05564e9c93167362ef18450d75222deef0664f9ed5
-
SHA512
38b17683e835e7259a6972d0f920f9ac7f5823591962c624aa795c39c3213d0735bacd76c72b7255be1cefeb9c298ffc31266513f088684969e5e18ad4e0a139
-
SSDEEP
1536:o7ZrIoIlP/A765noAXMoiCQ/5NSDy+Ud1IE9vpFARgHsjoCje6fLCy:odIp/A0noAcoiCQ/5NS6ERnECnfLCy
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" svchost.exe -
Deletes itself 1 IoCs
pid Process 2536 svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 604 mzfxiwlech.pre 2724 mzfxiwlech.pre -
Loads dropped DLL 3 IoCs
pid Process 2536 svchost.exe 2536 svchost.exe 604 mzfxiwlech.pre -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\A5101B22 = "C:\\Users\\Admin\\AppData\\Roaming\\Klyizcnws\\730CD576A5101B224500.exe" svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2104 set thread context of 2580 2104 Abrechnung.exe 31 PID 604 set thread context of 2724 604 mzfxiwlech.pre 34 -
resource yara_rule behavioral2/memory/2580-18-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2580-12-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2580-11-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2580-10-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2580-8-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2580-4-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2580-2-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2724-51-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abrechnung.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abrechnung.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mzfxiwlech.pre Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mzfxiwlech.pre -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeBackupPrivilege 2668 vssvc.exe Token: SeRestorePrivilege 2668 vssvc.exe Token: SeAuditPrivilege 2668 vssvc.exe Token: SeRestorePrivilege 1752 DrvInst.exe Token: SeRestorePrivilege 1752 DrvInst.exe Token: SeRestorePrivilege 1752 DrvInst.exe Token: SeRestorePrivilege 1752 DrvInst.exe Token: SeRestorePrivilege 1752 DrvInst.exe Token: SeRestorePrivilege 1752 DrvInst.exe Token: SeRestorePrivilege 1752 DrvInst.exe Token: SeLoadDriverPrivilege 1752 DrvInst.exe Token: SeLoadDriverPrivilege 1752 DrvInst.exe Token: SeLoadDriverPrivilege 1752 DrvInst.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2580 2104 Abrechnung.exe 31 PID 2104 wrote to memory of 2580 2104 Abrechnung.exe 31 PID 2104 wrote to memory of 2580 2104 Abrechnung.exe 31 PID 2104 wrote to memory of 2580 2104 Abrechnung.exe 31 PID 2104 wrote to memory of 2580 2104 Abrechnung.exe 31 PID 2104 wrote to memory of 2580 2104 Abrechnung.exe 31 PID 2104 wrote to memory of 2580 2104 Abrechnung.exe 31 PID 2104 wrote to memory of 2580 2104 Abrechnung.exe 31 PID 2580 wrote to memory of 2536 2580 Abrechnung.exe 32 PID 2580 wrote to memory of 2536 2580 Abrechnung.exe 32 PID 2580 wrote to memory of 2536 2580 Abrechnung.exe 32 PID 2580 wrote to memory of 2536 2580 Abrechnung.exe 32 PID 2580 wrote to memory of 2536 2580 Abrechnung.exe 32 PID 2536 wrote to memory of 604 2536 svchost.exe 33 PID 2536 wrote to memory of 604 2536 svchost.exe 33 PID 2536 wrote to memory of 604 2536 svchost.exe 33 PID 2536 wrote to memory of 604 2536 svchost.exe 33 PID 604 wrote to memory of 2724 604 mzfxiwlech.pre 34 PID 604 wrote to memory of 2724 604 mzfxiwlech.pre 34 PID 604 wrote to memory of 2724 604 mzfxiwlech.pre 34 PID 604 wrote to memory of 2724 604 mzfxiwlech.pre 34 PID 604 wrote to memory of 2724 604 mzfxiwlech.pre 34 PID 604 wrote to memory of 2724 604 mzfxiwlech.pre 34 PID 604 wrote to memory of 2724 604 mzfxiwlech.pre 34 PID 604 wrote to memory of 2724 604 mzfxiwlech.pre 34 PID 2724 wrote to memory of 2468 2724 mzfxiwlech.pre 35 PID 2724 wrote to memory of 2468 2724 mzfxiwlech.pre 35 PID 2724 wrote to memory of 2468 2724 mzfxiwlech.pre 35 PID 2724 wrote to memory of 2468 2724 mzfxiwlech.pre 35 PID 2724 wrote to memory of 2468 2724 mzfxiwlech.pre 35 PID 2468 wrote to memory of 2288 2468 svchost.exe 36 PID 2468 wrote to memory of 2288 2468 svchost.exe 36 PID 2468 wrote to memory of 2288 2468 svchost.exe 36 PID 2468 wrote to memory of 2288 2468 svchost.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe"C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\Abrechnung.exeC:\Users\Admin\AppData\Local\Temp\Abrechnung.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\mzfxiwlech.preC:\Users\Admin\AppData\Local\Temp\mzfxiwlech.pre4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Users\Admin\AppData\Local\Temp\mzfxiwlech.preC:\Users\Admin\AppData\Local\Temp\mzfxiwlech.pre5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\svchost.exesvchost.exe6⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"7⤵
- System Location Discovery: System Language Discovery
PID:2288
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A8" "0000000000000498"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD581ff324d2023d8ecb98a127b87d51450
SHA1acd24c80f6a02f7fe7a388a6779ea49be64674bc
SHA2567d9fc496bc0ade736bf75e05564e9c93167362ef18450d75222deef0664f9ed5
SHA51238b17683e835e7259a6972d0f920f9ac7f5823591962c624aa795c39c3213d0735bacd76c72b7255be1cefeb9c298ffc31266513f088684969e5e18ad4e0a139