59c2540923ba4f86f095bd4b5f4d737e29c864bee454da46b506d4710221651a

Analysis

max time kernel
44s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

documentos DHL.exe
Size

329KB
MD5

058e351fe877089e0654c39407931da9
SHA1

da278c26f15d6527ce9b4fb5b2d15b46199e3a7c
SHA256

59c2540923ba4f86f095bd4b5f4d737e29c864bee454da46b506d4710221651a
SHA512

22b89e2401279828846ad41f1741545317bf19cf013007018763e11f08bbe8ad54b958a827839bfe085bb82572489d7948af206946f2984521385ef3567a9a22
SSDEEP

6144:YIw3Q/Id1TZuGuUbWJLqBiBNVWUzSuTpT9NXOjJeoyL:TQPYG/WZqBQWnEF9N+lnyL

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1084	documentos DHL.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Jobberiets\Monarki\nonsubtile.Cid	documentos DHL.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Transcriptive.ini	documentos DHL.exe
File opened for modification	C:\Windows\resources\Fornemmelsernes\Landstrygeres.Ren	documentos DHL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\documentos DHL.exe
"C:\Users\Admin\AppData\Local\Temp\documentos DHL.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso3AD4.tmp\System.dll

Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit
memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1084-56-0x00000000024E0000-0x000000000312A000-memory.dmp

Filesize
12.3MB

Download