f8067bcbd115afe0e506baf9b9de74c07f088a6b9a4cbdaa70826c26b0d0fa95

Analysis

max time kernel
56s
max time network
119s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/01/2023, 19:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL document.exe
Size 731KB
Sample230110-xnnfdsch8t
SHA256 f8067bcbd115afe0e506baf9b9de74c07f088a6b9a4cbdaa70826c26b0d0fa95
MD5 e941c79a8f3641006716dace21ca1bc1
SHA1 7ee09c71043a0ffe868134d7142c88d14a2e323e
SHA512 4076582688feefc68287924fbd8fa6f7a01a88e6c8bc3e6c26de3ac1e00f16ca7bdafd1e551eecfbd28429b5d3f6c9b2554de09f12cfb58accd4fba50a2b7be9
SSDEEP 12288:87IOlv71BDg6uM6hkbJMuPICbazFYx/LfbMw4qE4iVV/r7VWCt8gfzGY3U:kIOlv71BDg6uYdj44f4qEZV/NWCKgfzq
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 1156	1908	DHL document.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1908	DHL document.exe
1908	DHL document.exe
1136	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	DHL document.exe
Token: SeDebugPrivilege	1156	RegSvcs.exe
Token: SeDebugPrivilege	1136	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1156	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1136	1908	DHL document.exe	28
PID 1908 wrote to memory of 1136	1908	DHL document.exe	28
PID 1908 wrote to memory of 1136	1908	DHL document.exe	28
PID 1908 wrote to memory of 1136	1908	DHL document.exe	28
PID 1908 wrote to memory of 1616	1908	DHL document.exe	30
PID 1908 wrote to memory of 1616	1908	DHL document.exe	30
PID 1908 wrote to memory of 1616	1908	DHL document.exe	30
PID 1908 wrote to memory of 1616	1908	DHL document.exe	30
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32
PID 1908 wrote to memory of 1156	1908	DHL document.exe	32

C:\Users\Admin\AppData\Local\Temp\DHL document.exe
"C:\Users\Admin\AppData\Local\Temp\DHL document.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yAVvexgcxLjQP.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yAVvexgcxLjQP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9E53.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp9E53.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9E53.tmp
Size 1KB
SHA256 29a2df15b61ed5360598c2c03d53a94b7023694f3f6c2fbd3ef1d5b017b02e03
MD5 cfd470aff67a900b6d754ea4757b42e7
SHA1 84197a02377f98896f4d85a082794cd185f64f0d
SHA512 69bf7ec6795ab738d01263f78821a63d3b35330d3974eeeb57664aef9671677927cda43a904598b696186d26d651788da283d0a7668adb6ff487637249d87606
MD5 SHA1 SHA512

Submit Download

memory/1136-77-0x000000006F120000-0x000000006F6CB000-memory.dmp

Download

memory/1136-76-0x000000006F120000-0x000000006F6CB000-memory.dmp

Download

memory/1156-64-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1156-72-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1156-74-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1156-69-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1156-65-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1156-67-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1156-68-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1908-58-0x0000000000FF0000-0x000000000105A000-memory.dmp

Download

memory/1908-63-0x0000000004FA0000-0x0000000004FD0000-memory.dmp

Download

memory/1908-54-0x0000000001060000-0x000000000111C000-memory.dmp

Download

memory/1908-57-0x0000000000460000-0x000000000046A000-memory.dmp

Download

memory/1908-56-0x0000000000340000-0x0000000000356000-memory.dmp

Download

memory/1908-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Download