8bd946b1e3dc26464602dfc0f7de0b2bb90637f4774213c7dcbea93dcc0e02fd

General

Target

DHL Shipment Notification 1953341372.pdf.exe
Size

468KB
MD5

621452b83a5cdf0a1e03ea6d3c56c595
SHA1

0710b1580784a673daeaef5aeb259f05df5aee1e
SHA256

8bd946b1e3dc26464602dfc0f7de0b2bb90637f4774213c7dcbea93dcc0e02fd
SHA512

ce9960e5b0c534186a547341130422e2f6c76983f5d03a0acb88447997c412aa3927c5b2b8725036ad10e393fe1895f2ac0972f35b8b712479d73f2e9f9830ab

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1144 304 WerFault.exe DHL Shipment Notification 1953341372.pdf.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

740 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

WerFault.exepowershell.exe

pid process

1144 WerFault.exe
1144 WerFault.exe
1144 WerFault.exe
1144 WerFault.exe
1144 WerFault.exe
824 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WerFault.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1144 WerFault.exe
Token: SeDebugPrivilege 824 powershell.exe

pid	pid_target	process	target process
1144	304	WerFault.exe	DHL Shipment Notification 1953341372.pdf.exe

pid	process
740	schtasks.exe

pid	process
1144	WerFault.exe
1144	WerFault.exe
1144	WerFault.exe
1144	WerFault.exe
1144	WerFault.exe
824	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1144	WerFault.exe
Token: SeDebugPrivilege	824	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

DHL Shipment Notification 1953341372.pdf.exe

description	pid	process	target process
PID 304 wrote to memory of 824	304	DHL Shipment Notification 1953341372.pdf.exe	powershell.exe
PID 304 wrote to memory of 824	304	DHL Shipment Notification 1953341372.pdf.exe	powershell.exe
PID 304 wrote to memory of 824	304	DHL Shipment Notification 1953341372.pdf.exe	powershell.exe
PID 304 wrote to memory of 824	304	DHL Shipment Notification 1953341372.pdf.exe	powershell.exe
PID 304 wrote to memory of 740	304	DHL Shipment Notification 1953341372.pdf.exe	schtasks.exe
PID 304 wrote to memory of 740	304	DHL Shipment Notification 1953341372.pdf.exe	schtasks.exe
PID 304 wrote to memory of 740	304	DHL Shipment Notification 1953341372.pdf.exe	schtasks.exe
PID 304 wrote to memory of 740	304	DHL Shipment Notification 1953341372.pdf.exe	schtasks.exe
PID 304 wrote to memory of 1144	304	DHL Shipment Notification 1953341372.pdf.exe	WerFault.exe
PID 304 wrote to memory of 1144	304	DHL Shipment Notification 1953341372.pdf.exe	WerFault.exe
PID 304 wrote to memory of 1144	304	DHL Shipment Notification 1953341372.pdf.exe	WerFault.exe
PID 304 wrote to memory of 1144	304	DHL Shipment Notification 1953341372.pdf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification 1953341372.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification 1953341372.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:304

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wKLJLmiJQVwUSn.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKLJLmiJQVwUSn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCA61.tmp"
2⤵
- Creates scheduled task(s)
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 972
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCA61.tmp
MD5
c9ab5fa5990a2face44d01b24aa98e88

SHA1
d39c4ee80372761d1bfe0e48f07fa2e042e1c3c8

SHA256
377fbae8029cb9edd42a3064eb602ede8e462c3131a6690e79de45811dc43f55

SHA512
4f46f718d312e690edb1e5e0cce1287b0174e54d869b2611f068018cb364fc0d097b14493e9901c1aef2af203c03fb0f290402f166b226e1e4ba678848eef112

Download Submit
memory/304-55-0x0000000000010000-0x0000000000011000-memory.dmp

Filesize
4KB

Download
memory/304-57-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/304-58-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/304-59-0x0000000000410000-0x0000000000418000-memory.dmp

Filesize
32KB

Download
memory/304-60-0x0000000004810000-0x0000000004879000-memory.dmp

Filesize
420KB

Download
memory/740-62-0x0000000000000000-mapping.dmp

Download
memory/824-61-0x0000000000000000-mapping.dmp

Download
memory/824-66-0x0000000002390000-0x0000000002FDA000-memory.dmp

Filesize
12.3MB

Download
memory/824-67-0x0000000002390000-0x0000000002FDA000-memory.dmp

Filesize
12.3MB

Download
memory/824-69-0x0000000002390000-0x0000000002FDA000-memory.dmp

Filesize
12.3MB

Download
memory/1144-65-0x0000000000000000-mapping.dmp

Download
memory/1144-68-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads