Analysis
- max time kernel
151s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
14/02/2022, 01:51
Static task
static1
Behavioral task
behavioral1
Sample
DHL Shipping documents.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL Shipping documents.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target DHL Shipping documents.exe
- Size 804KB
- Sample220214-b9tzeadch4
- SHA256 7fe467ef6f392039c0ce5edaadf85c19a8406a0b0b7332131e2b2ddc9f074bb6
- MD5 9c3560d3fc389d4c97893bf4656fd2e5
- SHA1 00227a442e784d346eb261cd8ca69c6d39c6661e
- SHA512 133ee02a5defef13a259078e11017718d1b4793a12c0179fb67c38ca73a7856980ef88aec4ed21cd7c88ec6f832bbd6239cee6557ed6779753ee9f3c176a0dd2
- MD5 SHA1 SHA512
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3584 DHL Shipping documents.exe 3584 DHL Shipping documents.exe 3584 DHL Shipping documents.exe 3584 DHL Shipping documents.exe 3584 DHL Shipping documents.exe 3584 DHL Shipping documents.exe 3584 DHL Shipping documents.exe 3584 DHL Shipping documents.exe 3584 DHL Shipping documents.exe 3584 DHL Shipping documents.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1292 svchost.exe Token: SeCreatePagefilePrivilege 1292 svchost.exe Token: SeShutdownPrivilege 1292 svchost.exe Token: SeCreatePagefilePrivilege 1292 svchost.exe Token: SeShutdownPrivilege 1292 svchost.exe Token: SeCreatePagefilePrivilege 1292 svchost.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe Token: SeRestorePrivilege 3204 TiWorker.exe Token: SeSecurityPrivilege 3204 TiWorker.exe Token: SeBackupPrivilege 3204 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3584 wrote to memory of 4028 3584 DHL Shipping documents.exe 102 PID 3584 wrote to memory of 4028 3584 DHL Shipping documents.exe 102 PID 3584 wrote to memory of 4028 3584 DHL Shipping documents.exe 102 PID 3584 wrote to memory of 3076 3584 DHL Shipping documents.exe 103 PID 3584 wrote to memory of 3076 3584 DHL Shipping documents.exe 103 PID 3584 wrote to memory of 3076 3584 DHL Shipping documents.exe 103 PID 3584 wrote to memory of 3648 3584 DHL Shipping documents.exe 104 PID 3584 wrote to memory of 3648 3584 DHL Shipping documents.exe 104 PID 3584 wrote to memory of 3648 3584 DHL Shipping documents.exe 104 PID 3584 wrote to memory of 1460 3584 DHL Shipping documents.exe 105 PID 3584 wrote to memory of 1460 3584 DHL Shipping documents.exe 105 PID 3584 wrote to memory of 1460 3584 DHL Shipping documents.exe 105 PID 3584 wrote to memory of 1624 3584 DHL Shipping documents.exe 106 PID 3584 wrote to memory of 1624 3584 DHL Shipping documents.exe 106 PID 3584 wrote to memory of 1624 3584 DHL Shipping documents.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"2⤵PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"2⤵PID:3076
-
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"2⤵PID:3648
-
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"2⤵PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipping documents.exe"2⤵PID:1624
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3204