Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2023, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
DHL doc.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DHL doc.exe
Resource
win10v2004-20230220-en
General
-
Target
DHL doc.exe
-
Size
1.4MB
-
MD5
6d4b2188167e36105b407dac8185bf10
-
SHA1
9777d98556ef004559dc67cd4a600e5b16ceb9be
-
SHA256
8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f
-
SHA512
c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a
-
SSDEEP
24576:pPLaVUH999wnomY9hpGlpO3FvAcZ7CXCXBEfgP2xRyfmSOKC7R4EAzFSC4E/Yzwf:xBH9qomY9hglpcqCXBEfgZfmSOKC7R45
Malware Config
Extracted
lokibot
http://161.35.102.56/~nikol/?p=4479137330
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation DHL doc.exe Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 4 IoCs
pid Process 2296 ._cache_DHL doc.exe 4664 Synaptics.exe 796 Synaptics.exe 1628 ._cache_Synaptics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ._cache_DHL doc.exe Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook ._cache_DHL doc.exe Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ._cache_DHL doc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" DHL doc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4540 set thread context of 2652 4540 DHL doc.exe 91 PID 4664 set thread context of 796 4664 Synaptics.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ DHL doc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4092 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2296 ._cache_DHL doc.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 4540 wrote to memory of 2652 4540 DHL doc.exe 91 PID 2652 wrote to memory of 2296 2652 DHL doc.exe 92 PID 2652 wrote to memory of 2296 2652 DHL doc.exe 92 PID 2652 wrote to memory of 2296 2652 DHL doc.exe 92 PID 2652 wrote to memory of 4664 2652 DHL doc.exe 93 PID 2652 wrote to memory of 4664 2652 DHL doc.exe 93 PID 2652 wrote to memory of 4664 2652 DHL doc.exe 93 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 4664 wrote to memory of 796 4664 Synaptics.exe 94 PID 796 wrote to memory of 1628 796 Synaptics.exe 95 PID 796 wrote to memory of 1628 796 Synaptics.exe 95 PID 796 wrote to memory of 1628 796 Synaptics.exe 95 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ._cache_DHL doc.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ._cache_DHL doc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL doc.exe"C:\Users\Admin\AppData\Local\Temp\DHL doc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\DHL doc.exe"C:\Users\Admin\AppData\Local\Temp\DHL doc.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\._cache_DHL doc.exe"C:\Users\Admin\AppData\Local\Temp\._cache_DHL doc.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2296
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- Executes dropped EXE
PID:1628
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4092
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD56d4b2188167e36105b407dac8185bf10
SHA19777d98556ef004559dc67cd4a600e5b16ceb9be
SHA2568926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f
SHA512c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a
-
Filesize
1.4MB
MD56d4b2188167e36105b407dac8185bf10
SHA19777d98556ef004559dc67cd4a600e5b16ceb9be
SHA2568926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f
SHA512c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a
-
Filesize
1.4MB
MD56d4b2188167e36105b407dac8185bf10
SHA19777d98556ef004559dc67cd4a600e5b16ceb9be
SHA2568926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f
SHA512c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a
-
Filesize
1.4MB
MD56d4b2188167e36105b407dac8185bf10
SHA19777d98556ef004559dc67cd4a600e5b16ceb9be
SHA2568926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f
SHA512c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a
-
Filesize
104KB
MD53d81dc8162f2c97463d9b4487c2a1308
SHA198ba9509e131f36742200cd116733c338b4b1971
SHA256e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee
SHA5124c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892
-
Filesize
104KB
MD53d81dc8162f2c97463d9b4487c2a1308
SHA198ba9509e131f36742200cd116733c338b4b1971
SHA256e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee
SHA5124c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892
-
Filesize
104KB
MD53d81dc8162f2c97463d9b4487c2a1308
SHA198ba9509e131f36742200cd116733c338b4b1971
SHA256e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee
SHA5124c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892
-
Filesize
104KB
MD53d81dc8162f2c97463d9b4487c2a1308
SHA198ba9509e131f36742200cd116733c338b4b1971
SHA256e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee
SHA5124c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892
-
Filesize
104KB
MD53d81dc8162f2c97463d9b4487c2a1308
SHA198ba9509e131f36742200cd116733c338b4b1971
SHA256e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee
SHA5124c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2548970870-3691742953-3895070203-1000\0f5007522459c86e95ffcc62f32308f1_3c2ddb0c-d60d-4dbd-84ce-ab7caca42e67
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2548970870-3691742953-3895070203-1000\0f5007522459c86e95ffcc62f32308f1_3c2ddb0c-d60d-4dbd-84ce-ab7caca42e67
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b