8f1c0906f013938aba4f1da70a773afc04c8fcf3640a9f4224d9e997eddb4a2f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2022, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL Shipment documents.exe
Size 932KB
Sample220822-jgeb9affa3
SHA256 8f1c0906f013938aba4f1da70a773afc04c8fcf3640a9f4224d9e997eddb4a2f
MD5 ff3a0f66d491103dfad0041f8b04ab35
SHA1 3e4504d01293be0483d1c218dd7b7600b9176180
SHA512 089bffad0afff4cbbfdf45548a6c90074d93e6e07075eb0d1dbcebb6f53605314cbf8b72893485306be38d57415804c7dce63e0338e326de0e55a52d9d1487ab
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DHL Shipment documents.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 2732	1368	DHL Shipment documents.exe	96
PID 2732 set thread context of 380	2732	DHL Shipment documents.exe	41
PID 1440 set thread context of 380	1440	mstsc.exe	41

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2732	DHL Shipment documents.exe
2732	DHL Shipment documents.exe
2732	DHL Shipment documents.exe
2732	DHL Shipment documents.exe
2732	DHL Shipment documents.exe
2732	DHL Shipment documents.exe
2732	DHL Shipment documents.exe
2732	DHL Shipment documents.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe
1440	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
380	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2732	DHL Shipment documents.exe
2732	DHL Shipment documents.exe
2732	DHL Shipment documents.exe
1440	mstsc.exe
1440	mstsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	DHL Shipment documents.exe
Token: SeDebugPrivilege	1440	mstsc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2732	1368	DHL Shipment documents.exe	96
PID 1368 wrote to memory of 2732	1368	DHL Shipment documents.exe	96
PID 1368 wrote to memory of 2732	1368	DHL Shipment documents.exe	96
PID 1368 wrote to memory of 2732	1368	DHL Shipment documents.exe	96
PID 1368 wrote to memory of 2732	1368	DHL Shipment documents.exe	96
PID 1368 wrote to memory of 2732	1368	DHL Shipment documents.exe	96
PID 380 wrote to memory of 1440	380	Explorer.EXE	98
PID 380 wrote to memory of 1440	380	Explorer.EXE	98
PID 380 wrote to memory of 1440	380	Explorer.EXE	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment documents.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Shipment documents.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\DHL Shipment documents.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL Shipment documents.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/380-143-0x0000000005110000-0x00000000051F9000-memory.dmp

Download

memory/380-151-0x00000000082E0000-0x0000000008457000-memory.dmp

Download

memory/380-149-0x00000000082E0000-0x0000000008457000-memory.dmp

Download

memory/1368-133-0x00000000055D0000-0x0000000005B74000-memory.dmp

Download

memory/1368-134-0x0000000005020000-0x00000000050B2000-memory.dmp

Download

memory/1368-135-0x00000000050C0000-0x00000000050CA000-memory.dmp

Download

memory/1368-136-0x00000000076F0000-0x000000000778C000-memory.dmp

Download

memory/1368-132-0x0000000000590000-0x000000000067E000-memory.dmp

Download

memory/1440-145-0x0000000000910000-0x0000000000A4A000-memory.dmp

Download

memory/1440-146-0x00000000008D0000-0x00000000008FD000-memory.dmp

Download

memory/1440-147-0x0000000002D30000-0x000000000307A000-memory.dmp

Download

memory/1440-148-0x0000000002B40000-0x0000000002BD0000-memory.dmp

Download

memory/1440-150-0x00000000008D0000-0x00000000008FD000-memory.dmp

Download

memory/2732-142-0x00000000012D0000-0x00000000012E1000-memory.dmp

Download

memory/2732-141-0x00000000017C0000-0x0000000001B0A000-memory.dmp

Download

memory/2732-140-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2732-138-0x0000000000400000-0x000000000042D000-memory.dmp

Download