Analysis
- max time kernel
150s - max time network
149s - platform
windows7_x64 - resource
win7v20201028 - submitted
07/04/2021, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
DHL Paket.jar
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL Paket.jar
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target DHL Paket.jar
- Size 187KB
- Sample210407-fdwfcvfq1x
- SHA256 abda456f2f4994e4e619ecfe2ef5dd2e1a4fd6d4e3be8d27074052703362eb15
- MD5 0820fe7a5db15cc5cac299cd26e4c95d
- SHA1 40e266ee6285586405bb3a9d75193672bbac72a7
- SHA512 0994ff4ac1041b2e752eaee0b5482d16d1136aa5201733e3f6ea9ee1480e83613ccf0707f508499b3fd953fab849964f5ac2d7b17abbdce7a8c7aae9abf82a19
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egabwuul.txt java.exe - Loads dropped DLL 2 IoCs
pid Process 1048 java.exe 1656 java.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\egabwuul = "\"C:\\Users\\Admin\\AppData\\Roaming\\egabwuul.txt\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egabwuul = "\"C:\\Users\\Admin\\AppData\\Roaming\\egabwuul.txt\"" java.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1716 schtasks.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe Token: SeSystemProfilePrivilege 1872 WMIC.exe Token: SeSystemtimePrivilege 1872 WMIC.exe Token: SeProfSingleProcessPrivilege 1872 WMIC.exe Token: SeIncBasePriorityPrivilege 1872 WMIC.exe Token: SeCreatePagefilePrivilege 1872 WMIC.exe Token: SeBackupPrivilege 1872 WMIC.exe Token: SeRestorePrivilege 1872 WMIC.exe Token: SeShutdownPrivilege 1872 WMIC.exe Token: SeDebugPrivilege 1872 WMIC.exe Token: SeSystemEnvironmentPrivilege 1872 WMIC.exe Token: SeRemoteShutdownPrivilege 1872 WMIC.exe Token: SeUndockPrivilege 1872 WMIC.exe Token: SeManageVolumePrivilege 1872 WMIC.exe Token: 33 1872 WMIC.exe Token: 34 1872 WMIC.exe Token: 35 1872 WMIC.exe Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe Token: SeSystemProfilePrivilege 1872 WMIC.exe Token: SeSystemtimePrivilege 1872 WMIC.exe Token: SeProfSingleProcessPrivilege 1872 WMIC.exe Token: SeIncBasePriorityPrivilege 1872 WMIC.exe Token: SeCreatePagefilePrivilege 1872 WMIC.exe Token: SeBackupPrivilege 1872 WMIC.exe Token: SeRestorePrivilege 1872 WMIC.exe Token: SeShutdownPrivilege 1872 WMIC.exe Token: SeDebugPrivilege 1872 WMIC.exe Token: SeSystemEnvironmentPrivilege 1872 WMIC.exe Token: SeRemoteShutdownPrivilege 1872 WMIC.exe Token: SeUndockPrivilege 1872 WMIC.exe Token: SeManageVolumePrivilege 1872 WMIC.exe Token: 33 1872 WMIC.exe Token: 34 1872 WMIC.exe Token: 35 1872 WMIC.exe Token: SeIncreaseQuotaPrivilege 1404 WMIC.exe Token: SeSecurityPrivilege 1404 WMIC.exe Token: SeTakeOwnershipPrivilege 1404 WMIC.exe Token: SeLoadDriverPrivilege 1404 WMIC.exe Token: SeSystemProfilePrivilege 1404 WMIC.exe Token: SeSystemtimePrivilege 1404 WMIC.exe Token: SeProfSingleProcessPrivilege 1404 WMIC.exe Token: SeIncBasePriorityPrivilege 1404 WMIC.exe Token: SeCreatePagefilePrivilege 1404 WMIC.exe Token: SeBackupPrivilege 1404 WMIC.exe Token: SeRestorePrivilege 1404 WMIC.exe Token: SeShutdownPrivilege 1404 WMIC.exe Token: SeDebugPrivilege 1404 WMIC.exe Token: SeSystemEnvironmentPrivilege 1404 WMIC.exe Token: SeRemoteShutdownPrivilege 1404 WMIC.exe Token: SeUndockPrivilege 1404 WMIC.exe Token: SeManageVolumePrivilege 1404 WMIC.exe Token: 33 1404 WMIC.exe Token: 34 1404 WMIC.exe Token: 35 1404 WMIC.exe Token: SeIncreaseQuotaPrivilege 1404 WMIC.exe Token: SeSecurityPrivilege 1404 WMIC.exe Token: SeTakeOwnershipPrivilege 1404 WMIC.exe Token: SeLoadDriverPrivilege 1404 WMIC.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1340 wrote to memory of 1324 1340 java.exe 27 PID 1340 wrote to memory of 1324 1340 java.exe 27 PID 1340 wrote to memory of 1324 1340 java.exe 27 PID 1324 wrote to memory of 560 1324 wscript.exe 28 PID 1324 wrote to memory of 560 1324 wscript.exe 28 PID 1324 wrote to memory of 560 1324 wscript.exe 28 PID 560 wrote to memory of 1048 560 javaw.exe 33 PID 560 wrote to memory of 1048 560 javaw.exe 33 PID 560 wrote to memory of 1048 560 javaw.exe 33 PID 1048 wrote to memory of 968 1048 java.exe 35 PID 1048 wrote to memory of 968 1048 java.exe 35 PID 1048 wrote to memory of 968 1048 java.exe 35 PID 1048 wrote to memory of 1656 1048 java.exe 34 PID 1048 wrote to memory of 1656 1048 java.exe 34 PID 1048 wrote to memory of 1656 1048 java.exe 34 PID 968 wrote to memory of 1716 968 cmd.exe 38 PID 968 wrote to memory of 1716 968 cmd.exe 38 PID 968 wrote to memory of 1716 968 cmd.exe 38 PID 1656 wrote to memory of 596 1656 java.exe 40 PID 1656 wrote to memory of 596 1656 java.exe 40 PID 1656 wrote to memory of 596 1656 java.exe 40 PID 596 wrote to memory of 1872 596 cmd.exe 41 PID 596 wrote to memory of 1872 596 cmd.exe 41 PID 596 wrote to memory of 1872 596 cmd.exe 41 PID 1656 wrote to memory of 1668 1656 java.exe 45 PID 1656 wrote to memory of 1668 1656 java.exe 45 PID 1656 wrote to memory of 1668 1656 java.exe 45 PID 1668 wrote to memory of 1404 1668 cmd.exe 43 PID 1668 wrote to memory of 1404 1668 cmd.exe 43 PID 1668 wrote to memory of 1404 1668 cmd.exe 43 PID 1656 wrote to memory of 1736 1656 java.exe 47 PID 1656 wrote to memory of 1736 1656 java.exe 47 PID 1656 wrote to memory of 1736 1656 java.exe 47 PID 1736 wrote to memory of 1636 1736 cmd.exe 48 PID 1736 wrote to memory of 1636 1736 cmd.exe 48 PID 1736 wrote to memory of 1636 1736 cmd.exe 48 PID 1656 wrote to memory of 1640 1656 java.exe 51 PID 1656 wrote to memory of 1640 1656 java.exe 51 PID 1656 wrote to memory of 1640 1656 java.exe 51 PID 1640 wrote to memory of 1112 1640 cmd.exe 49 PID 1640 wrote to memory of 1112 1640 cmd.exe 49 PID 1640 wrote to memory of 1112 1640 cmd.exe 49
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\DHL Paket.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\system32\wscript.exewscript C:\Users\Admin\vcvqiyhoim.js2⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\egabwuul.txt"3⤵
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\egabwuul.txt"4⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\egabwuul.txt"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:1668
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list7⤵PID:1636
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:1640
-
-
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\egabwuul.txt"5⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\egabwuul.txt"6⤵
- Creates scheduled task(s)
PID:1716
-
-
-
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list1⤵PID:1112