Analysis
- max time kernel
147s - max time network
147s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/09/2021, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
INV.DHL202,PDF.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
INV.DHL202,PDF.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target INV.DHL202,PDF.exe
- Size 692KB
- Sample210929-sn192afbg9
- SHA256 4ffcb3a19eb6bf00bf22b12ce006f2bf4599c6fa875c06e12b57e3cf585dce60
- MD5 8cf2c9a1f1a3ecd41ea8ecf88ce91c2a
- SHA1 c605e6328931730ebfd2dcc2aa9d609778bc4e83
- SHA512 9e3be226596beda771e12d1343e9bc68f1fb31d3355a61574437b0ef0187012b6e85d9dc93a0ea89ec8210b121fe9ad7c4b983360ceb9fe820e4c13433a5333b
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Oxxkztu = "C:\\Users\\Public\\Libraries\\utzkxxO.url" INV.DHL202,PDF.exe - Program crash 1 IoCs
pid pid_target Process procid_target 492 2480 WerFault.exe 70 - Modifies registry key 1 TTPs 3 IoCs
pid Process 3008 reg.exe 2192 reg.exe 3584 reg.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe 492 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 492 WerFault.exe Token: SeBackupPrivilege 492 WerFault.exe Token: SeDebugPrivilege 492 WerFault.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2480 664 INV.DHL202,PDF.exe 70 PID 664 wrote to memory of 2732 664 INV.DHL202,PDF.exe 71 PID 664 wrote to memory of 2732 664 INV.DHL202,PDF.exe 71 PID 664 wrote to memory of 2732 664 INV.DHL202,PDF.exe 71 PID 2732 wrote to memory of 3972 2732 cmd.exe 75 PID 2732 wrote to memory of 3972 2732 cmd.exe 75 PID 2732 wrote to memory of 3972 2732 cmd.exe 75 PID 3972 wrote to memory of 3008 3972 cmd.exe 77 PID 3972 wrote to memory of 3008 3972 cmd.exe 77 PID 3972 wrote to memory of 3008 3972 cmd.exe 77 PID 3972 wrote to memory of 2192 3972 cmd.exe 78 PID 3972 wrote to memory of 2192 3972 cmd.exe 78 PID 3972 wrote to memory of 2192 3972 cmd.exe 78 PID 3972 wrote to memory of 3168 3972 cmd.exe 79 PID 3972 wrote to memory of 3168 3972 cmd.exe 79 PID 3972 wrote to memory of 3168 3972 cmd.exe 79 PID 664 wrote to memory of 3768 664 INV.DHL202,PDF.exe 82 PID 664 wrote to memory of 3768 664 INV.DHL202,PDF.exe 82 PID 664 wrote to memory of 3768 664 INV.DHL202,PDF.exe 82 PID 3768 wrote to memory of 3584 3768 cmd.exe 84 PID 3768 wrote to memory of 3584 3768 cmd.exe 84 PID 3768 wrote to memory of 3584 3768 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV.DHL202,PDF.exe"C:\Users\Admin\AppData\Local\Temp\INV.DHL202,PDF.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵PID:2480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 4883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:492
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:3008
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:2192
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:3168
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f3⤵
- Modifies registry key
PID:3584
-
-