Analysis
-
max time kernel
147s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 14:19
Static task
static1
Behavioral task
behavioral1
Sample
DHL AWB-5024310182_061222.exe
Resource
win7-20221111-en
General
-
Target
DHL AWB-5024310182_061222.exe
-
Size
788KB
-
MD5
4bc8ce54beb8016d78f09425034b3d03
-
SHA1
8a3f23548ac66a45a5fba76561757df9bb301c8b
-
SHA256
ec4741cb3671f0c7563788e27e03fd2cfae2b7470108cbf9e1603b138d034a11
-
SHA512
2f24cb9e3246826dd851723de0ecfcc561621c8ebe0111d509e1d42fa69967b49ad9f288d2e172a7b56744368d91344da0cacfc7bdfd8b568e20da56c94d6711
-
SSDEEP
24576:momxiPQFQNWbvquj44kgP6Y/mXYGAsjl:moKmQSNWbvn4hs/y
Malware Config
Extracted
formbook
d8ax
wQDD4HkJc+vErnk=
j7vdn039QTY5Gcs43SDb8R4gwLgFCI7s
ZqPN0enMl4As
kKK00fOMq6KZmHv6kZjEiTm3l1o=
CxCTti/0Dcs5qly/AVHoTg==
5TwVtD3wcevErnk=
/ieoWNXMl4As
caK67QvHGhmiEuKpidX2RA==
Bbyy3J6D1Qw=
LV5N2gOocvpbA/OB/w==
k7k2OMNsBY67libDOi4=
wuDokhS1jLo4mA==
RVGz6anMl4As
la40BCHFwoI/rpugbdoaWQ==
XmVnfY0nNACG5si5u8Ds6F79xw==
dpyQTuytl0/bShsFIYUaHRzIL4quYwxgTA==
yvmesDDPpTSrLhf5GlvvdaCZekhAsg==
obTEXhervaSWkSbDOi4=
ClZogXcOT1DcPyvgOKJM
Drlokv/cjLo4mA==
V4oZcMaLgjLLXfXt+g==
8BRWc4dCh+vErnk=
gZs1StGIWxHCXfXt+g==
kNWGiRXrqi1iPQlc/GU8hYQ=
nJQn54uLlWECXfXt+g==
2AU1AaNCuTog/+7M7vL++nxyjAYhug==
gLTciPW1cBLCXfXt+g==
7h7ZsWhwmJQ9Yhfd
NlFTcDIRY5WSlA==
KVxtg4EkZ5y2mybDOi4=
vc7dlj8GnRU5KNelbdoaWQ==
+hol4ZAxhsDDnSbDOi4=
0tlf7fGn6GENckSlV1dqs5o=
FVb6DpNaVBG+XfXt+g==
UNsBOPIUJJ8ud24=
1SbXAalJ3GCPfjtUDDXEVg==
OV4aRNJh6jVcNvy/xcS5Kjxc
hZqaRL5W4UlWPx16GpE2ySHpekhAsg==
QmTiBn1ALazBlibDOi4=
9jToDI8w5WJ7WCyhMmU8hYQ=
ECSrOEcC+aAef2VeVSE/tjm3l1o=
0tp9JDPs5pgphEIP41zldsC8zw==
HD7IzWMMmQt4I9wzbdoaWQ==
cKdMehnTerbJqCbDOi4=
RWhnXi5ZIGqjgmQ=
0fRlIEMHSE49Yhfd
bqrQ+DHBm4g1rJSRvsLs6F79xw==
rOoQJyHHH1VnPv1O1QiiuwbYnW74
g4SVt952e2RtcD6fKWU8hYQ=
R1huOuCLWV+pfwLgOKJM
pChMES6ijLo4mA==
9yWJOJyjtdIgzoTTZrq4iDm3l1o=
utfRc/OFAD4wFdk3bdoaWQ==
fpIYx++FK5+9spOpmf8YTg==
Jt0GgpzIjLo4mA==
srzO4u1vfXUKglbgOKJM
oK5G2NiBmWz7VRH241zldsC8zw==
LzzMZHMwGtevgmQ=
DFPw/EEd4Yc9Yhfd
cL7kACe5n07ZcfTD4w==
g8QFmC3VK2KCt0mmKyw=
mtl0BPzHDEsEWf1g3yC7UQ==
bZ/RdPiCxerz56ebbdoaWQ==
ZYALGqMrqw6bCd83bdoaWQ==
linktau-roads.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 8 1208 msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DHL AWB-5024310182_061222.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation DHL AWB-5024310182_061222.exe -
Loads dropped DLL 1 IoCs
Processes:
msiexec.exepid process 1208 msiexec.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
DHL AWB-5024310182_061222.exeDHL AWB-5024310182_061222.exemsiexec.exedescription pid process target process PID 1788 set thread context of 728 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 728 set thread context of 1376 728 DHL AWB-5024310182_061222.exe Explorer.EXE PID 728 set thread context of 1376 728 DHL AWB-5024310182_061222.exe Explorer.EXE PID 1208 set thread context of 1376 1208 msiexec.exe Explorer.EXE -
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
DHL AWB-5024310182_061222.exeDHL AWB-5024310182_061222.exemsiexec.exepid process 1788 DHL AWB-5024310182_061222.exe 728 DHL AWB-5024310182_061222.exe 728 DHL AWB-5024310182_061222.exe 728 DHL AWB-5024310182_061222.exe 728 DHL AWB-5024310182_061222.exe 728 DHL AWB-5024310182_061222.exe 1208 msiexec.exe 1208 msiexec.exe 1208 msiexec.exe 1208 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
DHL AWB-5024310182_061222.exemsiexec.exepid process 728 DHL AWB-5024310182_061222.exe 728 DHL AWB-5024310182_061222.exe 728 DHL AWB-5024310182_061222.exe 728 DHL AWB-5024310182_061222.exe 1208 msiexec.exe 1208 msiexec.exe 1208 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
DHL AWB-5024310182_061222.exeDHL AWB-5024310182_061222.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1788 DHL AWB-5024310182_061222.exe Token: SeDebugPrivilege 728 DHL AWB-5024310182_061222.exe Token: SeDebugPrivilege 1208 msiexec.exe Token: SeShutdownPrivilege 1376 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
DHL AWB-5024310182_061222.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1788 wrote to memory of 1852 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 1852 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 1852 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 1852 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 728 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 728 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 728 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 728 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 728 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 728 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1788 wrote to memory of 728 1788 DHL AWB-5024310182_061222.exe DHL AWB-5024310182_061222.exe PID 1376 wrote to memory of 1208 1376 Explorer.EXE msiexec.exe PID 1376 wrote to memory of 1208 1376 Explorer.EXE msiexec.exe PID 1376 wrote to memory of 1208 1376 Explorer.EXE msiexec.exe PID 1376 wrote to memory of 1208 1376 Explorer.EXE msiexec.exe PID 1376 wrote to memory of 1208 1376 Explorer.EXE msiexec.exe PID 1376 wrote to memory of 1208 1376 Explorer.EXE msiexec.exe PID 1376 wrote to memory of 1208 1376 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 1716 1208 msiexec.exe Firefox.exe PID 1208 wrote to memory of 1716 1208 msiexec.exe Firefox.exe PID 1208 wrote to memory of 1716 1208 msiexec.exe Firefox.exe PID 1208 wrote to memory of 1716 1208 msiexec.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB-5024310182_061222.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB-5024310182_061222.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB-5024310182_061222.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB-5024310182_061222.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB-5024310182_061222.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB-5024310182_061222.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
932KB
MD5661fd92d4eaeea3740649af5a484d7c8
SHA1c93f868890fee1475f8ec9e7607e26f5dce67d54
SHA25658a478f0560ea22c1bc194263f07cf6f3ecfe47d0c8b534a7bba185f28a1141f
SHA5121fac03c20139fde41d121e0adbd02d127261ce061509996087fc1c80baf2fe0d0f70fed6b83d38a85cfa2e07d038ff809161c7ecce31ec44ac8b89740d3db15d
-
memory/728-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/728-79-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/728-78-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/728-75-0x0000000000330000-0x0000000000340000-memory.dmpFilesize
64KB
-
memory/728-74-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/728-70-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/728-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/728-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/728-64-0x00000000004012B0-mapping.dmp
-
memory/728-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/728-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/728-68-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/728-69-0x0000000000820000-0x0000000000B23000-memory.dmpFilesize
3.0MB
-
memory/728-71-0x00000000001B0000-0x00000000001C0000-memory.dmpFilesize
64KB
-
memory/1208-82-0x0000000000850000-0x0000000000864000-memory.dmpFilesize
80KB
-
memory/1208-83-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1208-87-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1208-85-0x0000000000B00000-0x0000000000B8F000-memory.dmpFilesize
572KB
-
memory/1208-84-0x0000000002240000-0x0000000002543000-memory.dmpFilesize
3.0MB
-
memory/1208-77-0x0000000000000000-mapping.dmp
-
memory/1376-86-0x0000000006AC0000-0x0000000006BBE000-memory.dmpFilesize
1016KB
-
memory/1376-81-0x00000000061A0000-0x0000000006284000-memory.dmpFilesize
912KB
-
memory/1376-76-0x00000000061A0000-0x0000000006284000-memory.dmpFilesize
912KB
-
memory/1376-72-0x0000000005DF0000-0x0000000005F6C000-memory.dmpFilesize
1.5MB
-
memory/1376-88-0x0000000006AC0000-0x0000000006BBE000-memory.dmpFilesize
1016KB
-
memory/1788-56-0x0000000000340000-0x000000000035A000-memory.dmpFilesize
104KB
-
memory/1788-54-0x0000000000070000-0x000000000013A000-memory.dmpFilesize
808KB
-
memory/1788-57-0x0000000000290000-0x000000000029E000-memory.dmpFilesize
56KB
-
memory/1788-58-0x0000000004F80000-0x0000000004FFA000-memory.dmpFilesize
488KB
-
memory/1788-59-0x0000000002400000-0x0000000002440000-memory.dmpFilesize
256KB
-
memory/1788-55-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB