Analysis
- max time kernel
146s - max time network
136s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
06/10/2021, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
DHL_100621 de documentos de la compra,pdf.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL_100621 de documentos de la compra,pdf.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target DHL_100621 de documentos de la compra,pdf.exe
- Size 938KB
- Sample211006-wpv17abgbr
- SHA256 a8eaa88b749a304422b842993d8060cdd5523cf0dadabc5539386f2f4dfbefa9
- MD5 78961e8be792bba5a71ca34b01393504
- SHA1 92d2842f5ad3a79021d3da487eef9c637184c74d
- SHA512 206e39e01b6bbebc053d2202c2f26a6d7be90dec00cab356a8f0bfe15d19587096ae2bae76aa9cbc5bc9c26dac0eccd4a712fb5bf5eb47a6b4c780295c19894e
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hojwzdy = "C:\\Users\\Public\\Libraries\\ydzwjoH.url" DHL_100621 de documentos de la compra,pdf.exe - Program crash 1 IoCs
pid pid_target Process procid_target 556 524 WerFault.exe 29 - Modifies registry key 1 TTPs 3 IoCs
pid Process 2000 reg.exe 424 reg.exe 1348 reg.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 556 WerFault.exe 556 WerFault.exe 556 WerFault.exe 556 WerFault.exe 556 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 556 WerFault.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 556 WerFault.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 524 1524 DHL_100621 de documentos de la compra,pdf.exe 29 PID 1524 wrote to memory of 1476 1524 DHL_100621 de documentos de la compra,pdf.exe 30 PID 1524 wrote to memory of 1476 1524 DHL_100621 de documentos de la compra,pdf.exe 30 PID 1524 wrote to memory of 1476 1524 DHL_100621 de documentos de la compra,pdf.exe 30 PID 1524 wrote to memory of 1476 1524 DHL_100621 de documentos de la compra,pdf.exe 30 PID 524 wrote to memory of 556 524 secinit.exe 32 PID 524 wrote to memory of 556 524 secinit.exe 32 PID 524 wrote to memory of 556 524 secinit.exe 32 PID 524 wrote to memory of 556 524 secinit.exe 32 PID 1476 wrote to memory of 1240 1476 cmd.exe 33 PID 1476 wrote to memory of 1240 1476 cmd.exe 33 PID 1476 wrote to memory of 1240 1476 cmd.exe 33 PID 1476 wrote to memory of 1240 1476 cmd.exe 33 PID 1240 wrote to memory of 2000 1240 cmd.exe 35 PID 1240 wrote to memory of 2000 1240 cmd.exe 35 PID 1240 wrote to memory of 2000 1240 cmd.exe 35 PID 1240 wrote to memory of 2000 1240 cmd.exe 35 PID 1240 wrote to memory of 424 1240 cmd.exe 36 PID 1240 wrote to memory of 424 1240 cmd.exe 36 PID 1240 wrote to memory of 424 1240 cmd.exe 36 PID 1240 wrote to memory of 424 1240 cmd.exe 36 PID 1240 wrote to memory of 1660 1240 cmd.exe 37 PID 1240 wrote to memory of 1660 1240 cmd.exe 37 PID 1240 wrote to memory of 1660 1240 cmd.exe 37 PID 1240 wrote to memory of 1660 1240 cmd.exe 37 PID 1524 wrote to memory of 1556 1524 DHL_100621 de documentos de la compra,pdf.exe 38 PID 1524 wrote to memory of 1556 1524 DHL_100621 de documentos de la compra,pdf.exe 38 PID 1524 wrote to memory of 1556 1524 DHL_100621 de documentos de la compra,pdf.exe 38 PID 1524 wrote to memory of 1556 1524 DHL_100621 de documentos de la compra,pdf.exe 38 PID 1556 wrote to memory of 1348 1556 cmd.exe 40 PID 1556 wrote to memory of 1348 1556 cmd.exe 40 PID 1556 wrote to memory of 1348 1556 cmd.exe 40 PID 1556 wrote to memory of 1348 1556 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_100621 de documentos de la compra,pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_100621 de documentos de la compra,pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\secinit.exeC:\Windows\System32\secinit.exe2⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 1723⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Trast.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2000
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:424
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:1660
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\nest.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f3⤵
- Modifies registry key
PID:1348
-
-