Analysis
- max time kernel
147s - max time network
143s - platform
windows10_x64 - resource
win10 - submitted
20/07/2020, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
DHL Shipment Notification Status.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL Shipment Notification Status.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target DHL Shipment Notification Status.exe
- Size 615KB
- Sample200720-9db5w5kp8e
- SHA256 e257a0a26f932ddedd2134e0a56eadc8c19d03049c7c6d9b7d3ca93720106b91
- MD5 c5dcec26d689f1fd82a71629883f1911
- SHA1 346b8e5f5a5e1840237aeefb7fe68d6a12b1f173
- SHA512 5af3129ce3149f78ed35b0caeee4ede08285e320c36da71b23212000275de49b8b0b424b5972fdce9cd2ed4f8ec9e90a50c6cffaf211f39eab9e7076e4930aa0
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3588 DHL Shipment Notification Status.exe 3588 DHL Shipment Notification Status.exe 3792 DHL Shipment Notification Status.exe 3792 DHL Shipment Notification Status.exe 3792 DHL Shipment Notification Status.exe 3792 DHL Shipment Notification Status.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3588 wrote to memory of 3792 3588 DHL Shipment Notification Status.exe 67 PID 3588 wrote to memory of 3792 3588 DHL Shipment Notification Status.exe 67 PID 3588 wrote to memory of 3792 3588 DHL Shipment Notification Status.exe 67 PID 2988 wrote to memory of 3924 2988 Explorer.EXE 68 PID 2988 wrote to memory of 3924 2988 Explorer.EXE 68 PID 2988 wrote to memory of 3924 2988 Explorer.EXE 68 PID 3924 wrote to memory of 3968 3924 wscript.exe 69 PID 3924 wrote to memory of 3968 3924 wscript.exe 69 PID 3924 wrote to memory of 3968 3924 wscript.exe 69 PID 3924 wrote to memory of 3412 3924 wscript.exe 71 PID 3924 wrote to memory of 3412 3924 wscript.exe 71 PID 3924 wrote to memory of 3412 3924 wscript.exe 71 PID 3924 wrote to memory of 3324 3924 wscript.exe 73 PID 3924 wrote to memory of 3324 3924 wscript.exe 73 PID 3924 wrote to memory of 3324 3924 wscript.exe 73 - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3588 DHL Shipment Notification Status.exe 3792 DHL Shipment Notification Status.exe 3792 DHL Shipment Notification Status.exe 3792 DHL Shipment Notification Status.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe 3924 wscript.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3588 set thread context of 3792 3588 DHL Shipment Notification Status.exe 67 PID 3792 set thread context of 2988 3792 DHL Shipment Notification Status.exe 56 PID 3924 set thread context of 2988 3924 wscript.exe 56 - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3792 DHL Shipment Notification Status.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeDebugPrivilege 3924 wscript.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 Explorer.EXE - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DXOHMZ = "C:\\Program Files (x86)\\G1b3d\\mst8z42pp.exe" wscript.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wscript.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2988 Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\G1b3d\mst8z42pp.exe wscript.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3792
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds policy Run key to start application
- Modifies Internet Explorer settings
- System policy modification
- Drops file in Program Files directory
PID:3924 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status.exe"3⤵PID:3968
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3412
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3324
-
-