3dd21ae8c324bb02e1ef2df922789c07e833d31b11a91855a911e901728e3166 | Triage

Analysis

max time kernel
141s
max time network
146s
platform
windows10_x64
resource
win10v20201028
submitted
09-11-2020 19:38

Sharing

Report Analysis Logs

General

Target

DHL Shipment Notification.exe
Size

893KB
MD5

0fe924b060d2c51a422bf649d329cb70
SHA1

f4f3404092affcd4e005d3ef585428fbb13662e5
SHA256

3dd21ae8c324bb02e1ef2df922789c07e833d31b11a91855a911e901728e3166
SHA512

ed861b8e8e5223ad22e768e01a8aa85ed3756920d28819b35118fe4cd113a0601013d08043cfd0132378a48af889724cd6adb6db30a13a2e1c6815708be0f309

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dw20.exe

pid process

2884 dw20.exe
2884 dw20.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DHL Shipment Notification.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	636	DHL Shipment Notification.exe
Token: SeRestorePrivilege	2884	dw20.exe
Token: SeBackupPrivilege	2884	dw20.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

DHL Shipment Notification.exe

pid process

636 DHL Shipment Notification.exe
636 DHL Shipment Notification.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DHL Shipment Notification.exe

description	pid	process	target process
PID 636 wrote to memory of 2884	636	DHL Shipment Notification.exe	dw20.exe
PID 636 wrote to memory of 2884	636	DHL Shipment Notification.exe	dw20.exe
PID 636 wrote to memory of 2884	636	DHL Shipment Notification.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 89540
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-2-0x0000000000000000-mapping.dmp

Download
memory/2884-3-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/2884-4-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/2884-6-0x0000000003010000-0x0000000003011000-memory.dmp

Filesize
4KB

Download