25bbd4a45d4d02d8bacdf482696505ab302ad8591b5e06da57481f7098324f9e

General

Target

DHL_Delivery Documents.exe
Size

917KB
MD5

9c930da2ac186c1f945a7bc74aa491ed
SHA1

3b24459060ab8590b7c550d34bd0243cbade3e2a
SHA256

25bbd4a45d4d02d8bacdf482696505ab302ad8591b5e06da57481f7098324f9e
SHA512

99c5621f5bb2fd33f780d956d46ab4c61e179aa489fe58f97bc91371e4270ee7676c671c45cb681197ca4c5b17f0b875dd269170e4ef12f4798f1a6bd31fe91c
SSDEEP

12288:T83vsUudRAh+fPkiqchEjXHHfYlFajGI8+xKGDPm2c4i1Sp+LrJ26AQ8:T8/kAhGhEj3wlFa6wxTCD4iDL43l

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2500 powershell.exe
2640 powershell.exe

pid	process
2500	powershell.exe
2640	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

DHL_Delivery Documents.exeDHL_Delivery Documents.exesetx.exe

description	pid	process	target process
PID 2776 set thread context of 2764	2776	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 2764 set thread context of 1200	2764	DHL_Delivery Documents.exe	Explorer.EXE
PID 2764 set thread context of 1944	2764	DHL_Delivery Documents.exe	setx.exe
PID 1944 set thread context of 1200	1944	setx.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2688 schtasks.exe

pid	process
2688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

powershell.exepowershell.exeDHL_Delivery Documents.exesetx.exe

pid	process
2640	powershell.exe
2500	powershell.exe
2764	DHL_Delivery Documents.exe
2764	DHL_Delivery Documents.exe
2764	DHL_Delivery Documents.exe
2764	DHL_Delivery Documents.exe
2764	DHL_Delivery Documents.exe
2764	DHL_Delivery Documents.exe
2764	DHL_Delivery Documents.exe
2764	DHL_Delivery Documents.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe
1944	setx.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

DHL_Delivery Documents.exeExplorer.EXEsetx.exe

pid process

2764 DHL_Delivery Documents.exe
1200 Explorer.EXE
1200 Explorer.EXE
1944 setx.exe
1944 setx.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2500 powershell.exe
Token: SeDebugPrivilege 2640 powershell.exe

pid	process
2764	DHL_Delivery Documents.exe
1200	Explorer.EXE
1200	Explorer.EXE
1944	setx.exe
1944	setx.exe

description	pid	process
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

DHL_Delivery Documents.exeExplorer.EXE

description	pid	process	target process
PID 2776 wrote to memory of 2500	2776	DHL_Delivery Documents.exe	powershell.exe
PID 2776 wrote to memory of 2500	2776	DHL_Delivery Documents.exe	powershell.exe
PID 2776 wrote to memory of 2500	2776	DHL_Delivery Documents.exe	powershell.exe
PID 2776 wrote to memory of 2500	2776	DHL_Delivery Documents.exe	powershell.exe
PID 2776 wrote to memory of 2640	2776	DHL_Delivery Documents.exe	powershell.exe
PID 2776 wrote to memory of 2640	2776	DHL_Delivery Documents.exe	powershell.exe
PID 2776 wrote to memory of 2640	2776	DHL_Delivery Documents.exe	powershell.exe
PID 2776 wrote to memory of 2640	2776	DHL_Delivery Documents.exe	powershell.exe
PID 2776 wrote to memory of 2688	2776	DHL_Delivery Documents.exe	schtasks.exe
PID 2776 wrote to memory of 2688	2776	DHL_Delivery Documents.exe	schtasks.exe
PID 2776 wrote to memory of 2688	2776	DHL_Delivery Documents.exe	schtasks.exe
PID 2776 wrote to memory of 2688	2776	DHL_Delivery Documents.exe	schtasks.exe
PID 2776 wrote to memory of 2764	2776	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 2776 wrote to memory of 2764	2776	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 2776 wrote to memory of 2764	2776	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 2776 wrote to memory of 2764	2776	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 2776 wrote to memory of 2764	2776	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 2776 wrote to memory of 2764	2776	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 2776 wrote to memory of 2764	2776	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 1200 wrote to memory of 1944	1200	Explorer.EXE	setx.exe
PID 1200 wrote to memory of 1944	1200	Explorer.EXE	setx.exe
PID 1200 wrote to memory of 1944	1200	Explorer.EXE	setx.exe
PID 1200 wrote to memory of 1944	1200	Explorer.EXE	setx.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YybGLWQSx.exe"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YybGLWQSx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBC9B.tmp"
3⤵
- Creates scheduled task(s)
PID:2688

C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2764

C:\Windows\SysWOW64\setx.exe
"C:\Windows\SysWOW64\setx.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1944

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBC9B.tmp
Filesize
1KB

MD5
56d417001290c6c0c0c9cd6cadff0c9a

SHA1
eb21218f981631e0234af9031860f9484bb4701e

SHA256
cf063f67057a5102547efff0d79e574b796638377eb031f0120437c1d37a3bc0

SHA512
0bc710ea81ee311ca5cd8bc23f237728c9d41d486722a024dc7ec0b80a4fecdf4637b1f0c461ed60930e762640f745ab412a8c5db7fee2570f95a8e46e6221bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8P7I1F89WM79FRYAQ029.temp
Filesize
7KB

MD5
f12a37306545735548cb3962eba13244

SHA1
33756947a252fa842bc57bff0ed5b1f46783cf29

SHA256
6355d28d1fbcba2896558944c9b0f1bbd0bdb3b3e7ce5df122259a4e4f5803db

SHA512
6947ffa1b7a620510de23fee108b9425f27e0930f269b8733de7ca59d248b11cb42aa5e45991c617a893d4f73c636ca278882648209b4acc148611caf8a7d703

Download Submit
memory/1944-27-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/1944-26-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2764-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2764-25-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2764-20-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2764-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-19-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2776-4-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2776-5-0x0000000005130000-0x00000000051BA000-memory.dmp

Filesize
552KB

Download
memory/2776-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

Filesize
4KB

Download
memory/2776-24-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/2776-3-0x00000000002A0000-0x00000000002BA000-memory.dmp

Filesize
104KB

Download
memory/2776-2-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/2776-1-0x0000000000920000-0x0000000000A0C000-memory.dmp

Filesize
944KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads