Analysis
- max time kernel
198s - max time network
200s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
08/11/2022, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
DHL Consignment_pdf.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
General
- Target DHL Consignment_pdf.exe
- Size 1.2MB
- Sample221108-s2ggsaebd3
- SHA256 d638e7ea6048de830f145ff0e37950b009c10da0b49be87a145a9418541a0cdd
- MD5 61d279d26034207f8a9f541056c0901f
- SHA1 214414bfab84865ce5d2c2d353b8dfe8e06cfdfc
- SHA512 debaf1500c97e8a7f8b58f77e12f35f8ad0b4154b9ebdd25bce49115c90fce0691f365575625b5a07f162466304f6cae3de98942690193e0263ef0aaf50d2c2c
- SSDEEP 24576:8sE1XkMdsLrBJL0sSdwMltzQEhvVUObS:bERkbLdJLOJLzhvVRb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Campaign
-
figc
Decoy
-
47NW9KXrL+jgHgkaH/SBm7e9+eE=
-
ZiDP2+PQatbRpw==
-
McLVGasjijBUTSo=
-
7pCDHTcZBQCyFKFSb/4E
-
YwIKwvCFzlnbzcNqDNZ3WH77
-
yFJV/xjTQINSFzg=
-
HJb3EiH2afruNRSvM8UmOTJszaNv
-
vpTsJ8xRpExCgnlkzaoM
-
hUfQlYHe4Qb+DVchQM/mlOM2kjVisoJUMQ==
-
0URByQED2NCVrO2x5w==
-
0rjp8oD4ZRKfuI9GPlhwJA==
-
dxYJqqoonh7bHhMqMNIxXJnL5biDg2uv
-
N8ICb2IiuRdOx0dgucigiZ0DBA==
-
xmZ3s1jrZPStPdn5PlhwJA==
-
UxQyYwqi37V3q59to3PU5ZOZtoEGTcin
-
SpBGRe06ITs14S8=
-
spVKc4gldemrMNzf
-
6IBwrjx2XTs14S8=
-
FOp6CqjQtLdXT25kzaoM
-
P/O46RkpqQ8Uvw==
-
ky4t4R/xYuxdUXVkzaoM
-
VvVr5YfjxMAqhQPG5mw/5j8MI/g=
-
a+pFYGDbkR/nvX0+dQQDCgtIwZZl
-
tW2y7He3xvLluEp13Jzvaa4=
-
MgTK9CICUduRX+q+hAaUIQ==
-
CZaMFivjRfrAbtmHjSh3WH77
-
WQByCJSCCbaj27tYz5/C0bX3GOk=
-
HN2eGsENvTPjZJ43w5/C0bX3GOk=
-
ul9T5wfLlJSE9V9y7w==
-
YStggTiRZpdR1k6fLr4=
-
sIxhB67Dho4OmdyhUttIwJhMd1R9hKD1OQ==
-
I66oQy0AwlC+
-
624EQmEEX7dqX4jB
-
E/+WRoGOatbRpw==
-
8rXXZ4de9W8tiZ21t1ytBar2I+4=
-
O+tmTwaN9Ts14S8=
-
z0rSgQoORhGrp8LZ
-
LxS0XQtROWYYr2yRDgWUIQ==
-
nxqJD6e9lMZOtzLpH+m8fb4FEw==
-
k/pg+XhFqD0ndH9G68PSWKw=
-
8cSDk56Se3V2B5ifMr4=
-
vVxeqjy4t6Mjt0KjL7Y=
-
E4oLvGyRf41LdDb3FN53WH77
-
6bRX6Wf8ze0=
-
Bpqs83OrnK43u11f7Jv0BvsBQeo/ew==
-
GLCbxUuNkrIus0KjL7Y=
-
SQFIiiRa60HtFwcRGqCu9MBSg3OIhKD1OQ==
-
noFIgotFuHQhLga1136JkI8QUSiWqPq+
-
Rd690WG5sbydrO2x5w==
-
NLLDeJVHpkfp50ojIr8=
-
zYLyOtwB39iWrO2x5w==
-
At0Gnb9ZmUkHvy8/ypp7KLe9+eE=
-
BJe1a4AajRS1Ntv4i18vvyvzFPg=
-
ikWQzjeEW2Vfq7N9Ibc=
-
Cl+up0yUZzs14S8=
-
PA4ryveT744aLPmakyR3WH77
-
lnKD3xqP8m4sdXlkzaoM
-
yD9MkQpFJlAUuUKjL7Y=
-
LrxXFcsXuQAKt7x1E7A=
-
hx4FGtysJcCi1r1sFNZ3WH77
-
blIRPUzyCqWsdZnH
-
33ZacRmjEbdCT3RkzaoM
-
3F48XdkN8ybtJUKjL7Y=
-
xJb1FaEfiTwpc3tkzaoM
-
artglass.shop
Signatures
- Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation DHL Consignment_pdf.exe - Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 792 set thread context of 848 792 DHL Consignment_pdf.exe 27 PID 848 set thread context of 1236 848 DHL Consignment_pdf.exe 14 PID 1776 set thread context of 1236 1776 NETSTAT.EXE 14 PID 1776 set thread context of 592 1776 NETSTAT.EXE 29 PID 1776 set thread context of 1576 1776 NETSTAT.EXE 32 PID 1776 set thread context of 1908 1776 NETSTAT.EXE 34 - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1776 NETSTAT.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe - Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 792 DHL Consignment_pdf.exe 792 DHL Consignment_pdf.exe 792 DHL Consignment_pdf.exe 792 DHL Consignment_pdf.exe 792 DHL Consignment_pdf.exe 848 DHL Consignment_pdf.exe 848 DHL Consignment_pdf.exe 848 DHL Consignment_pdf.exe 848 DHL Consignment_pdf.exe 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE - Suspicious behavior: MapViewOfSection 12 IoCs
pid Process 848 DHL Consignment_pdf.exe 848 DHL Consignment_pdf.exe 848 DHL Consignment_pdf.exe 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE 1776 NETSTAT.EXE - Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeDebugPrivilege 792 DHL Consignment_pdf.exe Token: SeDebugPrivilege 848 DHL Consignment_pdf.exe Token: SeDebugPrivilege 1776 NETSTAT.EXE Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: 33 708 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 708 AUDIODG.EXE Token: 33 708 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 708 AUDIODG.EXE Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 592 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1908 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe Token: SeShutdownPrivilege 1716 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 592 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 792 wrote to memory of 848 792 DHL Consignment_pdf.exe 27 PID 792 wrote to memory of 848 792 DHL Consignment_pdf.exe 27 PID 792 wrote to memory of 848 792 DHL Consignment_pdf.exe 27 PID 792 wrote to memory of 848 792 DHL Consignment_pdf.exe 27 PID 792 wrote to memory of 848 792 DHL Consignment_pdf.exe 27 PID 792 wrote to memory of 848 792 DHL Consignment_pdf.exe 27 PID 792 wrote to memory of 848 792 DHL Consignment_pdf.exe 27 PID 1236 wrote to memory of 1776 1236 Explorer.EXE 28 PID 1236 wrote to memory of 1776 1236 Explorer.EXE 28 PID 1236 wrote to memory of 1776 1236 Explorer.EXE 28 PID 1236 wrote to memory of 1776 1236 Explorer.EXE 28
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\DHL Consignment_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Consignment_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\DHL Consignment_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Consignment_pdf.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:592
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4981⤵
- Suspicious use of AdjustPrivilegeToken
PID:708
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1576
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1908
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:1716