Analysis

  • max time kernel
    188s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    14-02-2022 07:12

General

  • Target

    DHL DELIVERY DOCUMENT.exe

  • Size

    423KB

  • MD5

    1f05c4fe505d798e57a409f494f3b3c5

  • SHA1

    faf7ab8e478cb203a11fd1de53974a3224a9670e

  • SHA256

    2a170cc5086a00b41ce8ff4bcf8fce45f85aef342d4cf4d08f018943cc5221ac

  • SHA512

    3aabe23832e5d9c7891284e7f05153ce22c89dd284f1c0be86c9c94f9331b0a85e2518250e352ae463505e9b921be3521acd278d8b5118e154a8edbb8be06e46

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY DOCUMENT.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY DOCUMENT.exe"
    1⤵
      PID:1476
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
      1⤵
      • Checks processor information in registry
      PID:2800
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:3096
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3140

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1476-130-0x000000007499E000-0x000000007499F000-memory.dmp
      Filesize

      4KB

    • memory/1476-131-0x0000000000070000-0x00000000000E0000-memory.dmp
      Filesize

      448KB

    • memory/1476-132-0x0000000004A00000-0x0000000004A9C000-memory.dmp
      Filesize

      624KB

    • memory/1476-133-0x00000000050E0000-0x0000000005684000-memory.dmp
      Filesize

      5.6MB

    • memory/1476-134-0x0000000004BD0000-0x0000000004C62000-memory.dmp
      Filesize

      584KB

    • memory/1476-135-0x0000000004D20000-0x0000000004D21000-memory.dmp
      Filesize

      4KB

    • memory/1476-136-0x00000000009A0000-0x00000000009AA000-memory.dmp
      Filesize

      40KB

    • memory/1476-137-0x0000000000A20000-0x0000000000A76000-memory.dmp
      Filesize

      344KB