Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:21
Static task
static1
Behavioral task
behavioral1
Sample
DHL_AWB#6078538091.exe
Resource
win7-20231215-en
General
-
Target
DHL_AWB#6078538091.exe
-
Size
743KB
-
MD5
2685c5b3d73fe94a815a84c1dd5813ef
-
SHA1
edf893ff59c3437e942fd8cd40c9381ef536dbf2
-
SHA256
27769f4bb96d0e605bdc282658c6a729e4ceb8447cd9e1f9880c69862258e66f
-
SHA512
a989d2198b0a9d8bddff535bd821c124b347cbdb0a2ffb91ce76b9d91a4847e38ffd2a58300e53366004628729d5ac9d9dfc10539ae6808ab6c3d26877e6fc65
-
SSDEEP
12288:X4nWcI58atfrHsfjGrfrtofP/l1rkxNVOIiB3bow5404ni0C0eb:X4Y5JDsfjStMn3rkxNo+w5/4+0
Malware Config
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
DHL_AWB#6078538091.exeDHL_AWB#6078538091.exedvdplay.exedescription pid process target process PID 1104 set thread context of 4676 1104 DHL_AWB#6078538091.exe DHL_AWB#6078538091.exe PID 4676 set thread context of 3460 4676 DHL_AWB#6078538091.exe Explorer.EXE PID 4676 set thread context of 1424 4676 DHL_AWB#6078538091.exe dvdplay.exe PID 1424 set thread context of 3460 1424 dvdplay.exe Explorer.EXE -
Processes:
dvdplay.exedescription ioc process Key created \Registry\User\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 dvdplay.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
DHL_AWB#6078538091.exeDHL_AWB#6078538091.exedvdplay.exepid process 1104 DHL_AWB#6078538091.exe 1104 DHL_AWB#6078538091.exe 1104 DHL_AWB#6078538091.exe 1104 DHL_AWB#6078538091.exe 1104 DHL_AWB#6078538091.exe 1104 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 4676 DHL_AWB#6078538091.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
DHL_AWB#6078538091.exeExplorer.EXEdvdplay.exepid process 4676 DHL_AWB#6078538091.exe 3460 Explorer.EXE 3460 Explorer.EXE 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe 1424 dvdplay.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DHL_AWB#6078538091.exedescription pid process Token: SeDebugPrivilege 1104 DHL_AWB#6078538091.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3460 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
DHL_AWB#6078538091.exeExplorer.EXEdvdplay.exedescription pid process target process PID 1104 wrote to memory of 4676 1104 DHL_AWB#6078538091.exe DHL_AWB#6078538091.exe PID 1104 wrote to memory of 4676 1104 DHL_AWB#6078538091.exe DHL_AWB#6078538091.exe PID 1104 wrote to memory of 4676 1104 DHL_AWB#6078538091.exe DHL_AWB#6078538091.exe PID 1104 wrote to memory of 4676 1104 DHL_AWB#6078538091.exe DHL_AWB#6078538091.exe PID 1104 wrote to memory of 4676 1104 DHL_AWB#6078538091.exe DHL_AWB#6078538091.exe PID 1104 wrote to memory of 4676 1104 DHL_AWB#6078538091.exe DHL_AWB#6078538091.exe PID 3460 wrote to memory of 1424 3460 Explorer.EXE dvdplay.exe PID 3460 wrote to memory of 1424 3460 Explorer.EXE dvdplay.exe PID 3460 wrote to memory of 1424 3460 Explorer.EXE dvdplay.exe PID 1424 wrote to memory of 1948 1424 dvdplay.exe Firefox.exe PID 1424 wrote to memory of 1948 1424 dvdplay.exe Firefox.exe PID 1424 wrote to memory of 1948 1424 dvdplay.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4676 -
C:\Windows\SysWOW64\dvdplay.exe"C:\Windows\SysWOW64\dvdplay.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1104-15-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/1104-1-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/1104-2-0x0000000005C00000-0x00000000061A4000-memory.dmpFilesize
5.6MB
-
memory/1104-3-0x0000000005650000-0x00000000056E2000-memory.dmpFilesize
584KB
-
memory/1104-4-0x00000000058C0000-0x00000000058D0000-memory.dmpFilesize
64KB
-
memory/1104-5-0x00000000055F0000-0x00000000055FA000-memory.dmpFilesize
40KB
-
memory/1104-6-0x0000000005BC0000-0x0000000005BD8000-memory.dmpFilesize
96KB
-
memory/1104-7-0x0000000005BE0000-0x0000000005BE8000-memory.dmpFilesize
32KB
-
memory/1104-8-0x00000000068D0000-0x00000000068DC000-memory.dmpFilesize
48KB
-
memory/1104-9-0x0000000006C20000-0x0000000006CA0000-memory.dmpFilesize
512KB
-
memory/1104-10-0x0000000009250000-0x00000000092EC000-memory.dmpFilesize
624KB
-
memory/1104-11-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/1104-12-0x00000000058C0000-0x00000000058D0000-memory.dmpFilesize
64KB
-
memory/1104-0-0x0000000000B60000-0x0000000000C20000-memory.dmpFilesize
768KB
-
memory/1424-25-0x0000000000E90000-0x00000000011DA000-memory.dmpFilesize
3.3MB
-
memory/1424-26-0x0000000000800000-0x000000000083C000-memory.dmpFilesize
240KB
-
memory/1424-29-0x0000000000800000-0x000000000083C000-memory.dmpFilesize
240KB
-
memory/1424-22-0x0000000000800000-0x000000000083C000-memory.dmpFilesize
240KB
-
memory/1424-23-0x0000000000800000-0x000000000083C000-memory.dmpFilesize
240KB
-
memory/1424-27-0x0000000001290000-0x0000000001332000-memory.dmpFilesize
648KB
-
memory/3460-38-0x00000000081A0000-0x00000000082BE000-memory.dmpFilesize
1.1MB
-
memory/3460-31-0x00000000081A0000-0x00000000082BE000-memory.dmpFilesize
1.1MB
-
memory/3460-30-0x00000000081A0000-0x00000000082BE000-memory.dmpFilesize
1.1MB
-
memory/3460-21-0x000000000CB30000-0x000000000D94B000-memory.dmpFilesize
14.1MB
-
memory/3460-28-0x000000000CB30000-0x000000000D94B000-memory.dmpFilesize
14.1MB
-
memory/4676-19-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/4676-13-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/4676-24-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/4676-16-0x0000000001060000-0x00000000013AA000-memory.dmpFilesize
3.3MB
-
memory/4676-20-0x0000000000BD0000-0x0000000000BF3000-memory.dmpFilesize
140KB
-
memory/4676-18-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/4676-17-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB