ccc2d47913200e1b73cc2195fd00798181dc8ef052aae7ae6b6df00ae45e6ea7

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_AWB#6078538091.exe
Size 1.2MB
Sample240408-rfjvcaec51
SHA256 ccc2d47913200e1b73cc2195fd00798181dc8ef052aae7ae6b6df00ae45e6ea7
MD5 1f474a80ef53faf305ef6e0c1f3c6eab
SHA1 9b6d4d236f6a6c71440ec81dc18d97ad6d8a8c9f
SHA512 2e5b5d4d5abe683d1e1aa67cadf654da2287e2aafd0ad8d5dcd2e5991005e3439ccacfc412e7a5f22fe7d0b9286526301ece39fe7eb04b54fa79eba131e91a10
SSDEEP 24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8adcAw3Mr7lVFTdxBB:2TvC/MTQYxsWR7ad7hlrd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2656	dvdplay.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2184 set thread context of 2400	2184	DHL_AWB#6078538091.exe	28
PID 2400 set thread context of 1372	2400	svchost.exe	21
PID 2400 set thread context of 2656	2400	svchost.exe	29
PID 2656 set thread context of 1372	2656	dvdplay.exe	21

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3627615824-4061627003-3019543961-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	dvdplay.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2400	svchost.exe
2400	svchost.exe
2400	svchost.exe
2400	svchost.exe
2400	svchost.exe
2400	svchost.exe
2400	svchost.exe
2400	svchost.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2184	DHL_AWB#6078538091.exe
2400	svchost.exe
1372	Explorer.EXE
1372	Explorer.EXE
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe
2656	dvdplay.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2184	DHL_AWB#6078538091.exe
2184	DHL_AWB#6078538091.exe
1372	Explorer.EXE
1372	Explorer.EXE
1372	Explorer.EXE
1372	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2184	DHL_AWB#6078538091.exe
2184	DHL_AWB#6078538091.exe
1372	Explorer.EXE
1372	Explorer.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2400	2184	DHL_AWB#6078538091.exe	28
PID 2184 wrote to memory of 2400	2184	DHL_AWB#6078538091.exe	28
PID 2184 wrote to memory of 2400	2184	DHL_AWB#6078538091.exe	28
PID 2184 wrote to memory of 2400	2184	DHL_AWB#6078538091.exe	28
PID 2184 wrote to memory of 2400	2184	DHL_AWB#6078538091.exe	28
PID 1372 wrote to memory of 2656	1372	Explorer.EXE	29
PID 1372 wrote to memory of 2656	1372	Explorer.EXE	29
PID 1372 wrote to memory of 2656	1372	Explorer.EXE	29
PID 1372 wrote to memory of 2656	1372	Explorer.EXE	29
PID 2656 wrote to memory of 1668	2656	dvdplay.exe	33
PID 2656 wrote to memory of 1668	2656	dvdplay.exe	33
PID 2656 wrote to memory of 1668	2656	dvdplay.exe	33
PID 2656 wrote to memory of 1668	2656	dvdplay.exe	33
PID 2656 wrote to memory of 1668	2656	dvdplay.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2400
- C:\Windows\SysWOW64\dvdplay.exe
  "C:\Windows\SysWOW64\dvdplay.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

caulds

Path C:\Users\Admin\AppData\Local\Temp\caulds
Size 252KB
SHA256 db4d116e4fcd6320f433f2452f044857c1a0038901ca5ed89df17ac38672fdf3
MD5 c487ed89f1f02a1e9bb5069d654d135e
SHA1 bac4a49aa86bb0a7ff7a91bbc9b6e7c5fc5c640f
SHA512 baf888c4688dc8a92f297c696e991456cab056565ace58de4ad95b82d13881d997a133c6285bb93a4fc4be4ed4f7477927a8717aeb7cf8927f76629684b8a7b3
SSDEEP 6144:1W20k69kTjdc9bDIrbfiEBWh3f/i74ybGzzuCIF/sKHvGNo:Yk69kTOCniEshXiky7bmOvGi
MD5 SHA1 SHA512 SSDEEP

Submit Download

pjtprdyh.zip

Path C:\Users\Admin\AppData\Local\Temp\pjtprdyh.zip
Size 478KB
SHA256 70a11669bb8ad1099fd7fba9da92e1a75124bef0d16a01fd10dcdc45e9582092
MD5 72b88067a5a1a4f8d52c45e6621d13fe
SHA1 f84542474b8583f4371749282e5cc4d52661c222
SHA512 a8bf75fd4f38e4c8dee5e6f2527062c5be21f5a8bae4ea561f4aa28139d65a6f215afb212f1e4857ee482e16e813fc0d63ef8ec43ec94d5f8a722489e89e154d
SSDEEP 12288:0Gn2z5Z856xpFey2bIDSAi/QFx+bOob68pnyolxraS:n2z5256xpFeymuSfZGs
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 910KB
SHA256 57d89a52061d70d87e40281f1196d53273f87860c4d707d667a8c7d9573da675
MD5 d79258c5189103d69502eac786addb04
SHA1 f34b33681cfe8ce649218173a7f58b237821c1ef
SHA512 da797f4dd1ad628aa4e8004b2e00b7c278facbc57a313f56b70dc8fcfbdb0050ea8b025b3475098223cce96ea53537d678273656d46c2d33d81b496d90da34b2
SSDEEP 24576:Rbv4aZ7CJa5zzDfVoOLVizxd4c0ReY/kCq:RkhKzzrpLVizxdzYK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1372-24-0x0000000008D30000-0x000000000905C000-memory.dmp

Download

memory/1372-69-0x0000000005200000-0x0000000005307000-memory.dmp

Download

memory/1372-27-0x0000000005200000-0x0000000005307000-memory.dmp

Download

memory/1372-26-0x0000000005200000-0x0000000005307000-memory.dmp

Download

memory/1372-18-0x0000000008D30000-0x000000000905C000-memory.dmp

Download

memory/2184-11-0x0000000000120000-0x0000000000124000-memory.dmp

Download

memory/2400-16-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2400-13-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Download

memory/2400-21-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2400-12-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2400-14-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2400-15-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2400-17-0x0000000000250000-0x0000000000273000-memory.dmp

Download

memory/2656-25-0x00000000003A0000-0x0000000000442000-memory.dmp

Download

memory/2656-19-0x0000000000130000-0x000000000016C000-memory.dmp

Download

memory/2656-23-0x0000000000130000-0x000000000016C000-memory.dmp

Download

memory/2656-20-0x0000000000130000-0x000000000016C000-memory.dmp

Download

memory/2656-66-0x0000000000130000-0x000000000016C000-memory.dmp

Download

memory/2656-67-0x0000000061E00000-0x0000000061ECF000-memory.dmp

Download

memory/2656-68-0x00000000003A0000-0x0000000000442000-memory.dmp

Download

memory/2656-22-0x0000000000830000-0x0000000000B33000-memory.dmp

Download