ddf8299e0a1e35d69a3a0157d5238d754c60e6d1acc944da7345868a9fac2fa6

Analysis

max time kernel
119s
max time network
149s
platform
windows10_x64
resource
win10-en-20210920
submitted
27/10/2021, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_102521 Receipt Document,pdf.exe
Size 1.0MB
Sample211027-mbebvabff3
SHA256 ddf8299e0a1e35d69a3a0157d5238d754c60e6d1acc944da7345868a9fac2fa6
MD5 c97946822bc09386452975b735456654
SHA1 fa17f8ccd7e96ee1e05b7fa2a67f224801655417
SHA512 aafb5f081aa3344b2c238f4786235c0ddb1e08f73324ac8b8266bf0defab65485bd73a4470e8c2098d7260235d902e3001469ea52cedfa346553c15ad574ce62
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ufccwf = "C:\\Users\\Public\\Libraries\\\\fwccfU.url"	DHL_102521 Receipt Document,pdf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4112	4336	WerFault.exe	70

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
812	reg.exe
68	reg.exe
1656	reg.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4112	WerFault.exe
Token: SeBackupPrivilege	4112	WerFault.exe
Token: SeDebugPrivilege	4112	WerFault.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 4336	3704	DHL_102521 Receipt Document,pdf.exe	70
PID 3704 wrote to memory of 3736	3704	DHL_102521 Receipt Document,pdf.exe	72
PID 3704 wrote to memory of 3736	3704	DHL_102521 Receipt Document,pdf.exe	72
PID 3704 wrote to memory of 3736	3704	DHL_102521 Receipt Document,pdf.exe	72
PID 3736 wrote to memory of 4164	3736	cmd.exe	74
PID 3736 wrote to memory of 4164	3736	cmd.exe	74
PID 3736 wrote to memory of 4164	3736	cmd.exe	74
PID 4164 wrote to memory of 812	4164	cmd.exe	77
PID 4164 wrote to memory of 812	4164	cmd.exe	77
PID 4164 wrote to memory of 812	4164	cmd.exe	77
PID 4164 wrote to memory of 68	4164	cmd.exe	78
PID 4164 wrote to memory of 68	4164	cmd.exe	78
PID 4164 wrote to memory of 68	4164	cmd.exe	78
PID 4164 wrote to memory of 3172	4164	cmd.exe	79
PID 4164 wrote to memory of 3172	4164	cmd.exe	79
PID 4164 wrote to memory of 3172	4164	cmd.exe	79
PID 3704 wrote to memory of 1380	3704	DHL_102521 Receipt Document,pdf.exe	80
PID 3704 wrote to memory of 1380	3704	DHL_102521 Receipt Document,pdf.exe	80
PID 3704 wrote to memory of 1380	3704	DHL_102521 Receipt Document,pdf.exe	80
PID 1380 wrote to memory of 1656	1380	cmd.exe	82
PID 1380 wrote to memory of 1656	1380	cmd.exe	82
PID 1380 wrote to memory of 1656	1380	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\DHL_102521 Receipt Document,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_102521 Receipt Document,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 360
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:812
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:68
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:3172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3704-115-0x0000000002260000-0x0000000002261000-memory.dmp

Download

memory/3704-116-0x00000000023F1000-0x0000000002405000-memory.dmp

Download

memory/4336-126-0x0000000002590000-0x0000000002591000-memory.dmp

Download

memory/4336-125-0x00000000024D0000-0x00000000024D1000-memory.dmp

Download

memory/4336-127-0x0000000002530000-0x0000000002531000-memory.dmp

Download