25bbd4a45d4d02d8bacdf482696505ab302ad8591b5e06da57481f7098324f9e

General

Target

DHL_Delivery Documents.exe
Size

917KB
MD5

9c930da2ac186c1f945a7bc74aa491ed
SHA1

3b24459060ab8590b7c550d34bd0243cbade3e2a
SHA256

25bbd4a45d4d02d8bacdf482696505ab302ad8591b5e06da57481f7098324f9e
SHA512

99c5621f5bb2fd33f780d956d46ab4c61e179aa489fe58f97bc91371e4270ee7676c671c45cb681197ca4c5b17f0b875dd269170e4ef12f4798f1a6bd31fe91c
SSDEEP

12288:T83vsUudRAh+fPkiqchEjXHHfYlFajGI8+xKGDPm2c4i1Sp+LrJ26AQ8:T8/kAhGhEj3wlFa6wxTCD4iDL43l

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1256 powershell.exe
2856 powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DHL_Delivery Documents.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	DHL_Delivery Documents.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

DHL_Delivery Documents.exeDHL_Delivery Documents.exesetx.exe

description	pid	process	target process
PID 3392 set thread context of 1352	3392	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 1352 set thread context of 3488	1352	DHL_Delivery Documents.exe	Explorer.EXE
PID 1352 set thread context of 4372	1352	DHL_Delivery Documents.exe	setx.exe
PID 4372 set thread context of 3488	4372	setx.exe	Explorer.EXE
PID 4372 set thread context of 4560	4372	setx.exe	Firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3052 schtasks.exe

pid	process
3052	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

setx.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	setx.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

powershell.exepowershell.exeDHL_Delivery Documents.exesetx.exe

pid	process
1256	powershell.exe
1256	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
1256	powershell.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
1352	DHL_Delivery Documents.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

DHL_Delivery Documents.exeExplorer.EXEsetx.exe

pid process

1352 DHL_Delivery Documents.exe
3488 Explorer.EXE
3488 Explorer.EXE
4372 setx.exe
4372 setx.exe
4372 setx.exe
4372 setx.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1256 powershell.exe
Token: SeDebugPrivilege 2856 powershell.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3488 Explorer.EXE

pid	process
1352	DHL_Delivery Documents.exe
3488	Explorer.EXE
3488	Explorer.EXE
4372	setx.exe
4372	setx.exe
4372	setx.exe
4372	setx.exe

description	pid	process
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe

pid	process
3488	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

DHL_Delivery Documents.exeExplorer.EXEsetx.exe

description	pid	process	target process
PID 3392 wrote to memory of 1256	3392	DHL_Delivery Documents.exe	powershell.exe
PID 3392 wrote to memory of 1256	3392	DHL_Delivery Documents.exe	powershell.exe
PID 3392 wrote to memory of 1256	3392	DHL_Delivery Documents.exe	powershell.exe
PID 3392 wrote to memory of 2856	3392	DHL_Delivery Documents.exe	powershell.exe
PID 3392 wrote to memory of 2856	3392	DHL_Delivery Documents.exe	powershell.exe
PID 3392 wrote to memory of 2856	3392	DHL_Delivery Documents.exe	powershell.exe
PID 3392 wrote to memory of 3052	3392	DHL_Delivery Documents.exe	schtasks.exe
PID 3392 wrote to memory of 3052	3392	DHL_Delivery Documents.exe	schtasks.exe
PID 3392 wrote to memory of 3052	3392	DHL_Delivery Documents.exe	schtasks.exe
PID 3392 wrote to memory of 1352	3392	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 3392 wrote to memory of 1352	3392	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 3392 wrote to memory of 1352	3392	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 3392 wrote to memory of 1352	3392	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 3392 wrote to memory of 1352	3392	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 3392 wrote to memory of 1352	3392	DHL_Delivery Documents.exe	DHL_Delivery Documents.exe
PID 3488 wrote to memory of 4372	3488	Explorer.EXE	setx.exe
PID 3488 wrote to memory of 4372	3488	Explorer.EXE	setx.exe
PID 3488 wrote to memory of 4372	3488	Explorer.EXE	setx.exe
PID 4372 wrote to memory of 4560	4372	setx.exe	Firefox.exe
PID 4372 wrote to memory of 4560	4372	setx.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3488

C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3392

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YybGLWQSx.exe"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YybGLWQSx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp63BB.tmp"
3⤵
- Creates scheduled task(s)
PID:3052

C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Delivery Documents.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1352

C:\Windows\SysWOW64\setx.exe
"C:\Windows\SysWOW64\setx.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4372

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
864fcda281fe5ba7d0bc4a041d1bbd07

SHA1
c999a5d1447b13a71190a10eb02e2a0db96beb95

SHA256
b5995cc5b4e9521435825264376a2992d406b03ec50209128832a297c46bcec2

SHA512
31fb58620427c62d8d6b743b725359b68b81d99f50f07206a4d9b5b136633829d0605ceedad40c628417bd1eeceaef79e8a6ba00502f6dd9db2c24ace6c17e7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qipxzccl.3g4.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp63BB.tmp
Filesize
1KB

MD5
994eae1b14ead414dc148a00ff03441d

SHA1
484e13d50788255428990548ae48994d20604748

SHA256
d4849436f062d570bb704dbeb156537273cb2ec2e564a0ff85613083c576de4e

SHA512
d911f0f953167ca71037042bb8db7b926fad29049d72fc52627e8d7bf52e6ccca163994204b650d2189a8fb4bf8300a0bbf534f4c6a9cebb12350ff83f18b65c

Download Submit
memory/1256-77-0x0000000007C20000-0x0000000007C31000-memory.dmp

Filesize
68KB

Download
memory/1256-75-0x0000000007A90000-0x0000000007A9A000-memory.dmp

Filesize
40KB

Download
memory/1256-50-0x0000000007670000-0x00000000076A2000-memory.dmp

Filesize
200KB

Download
memory/1256-84-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/1256-81-0x0000000007D40000-0x0000000007D48000-memory.dmp

Filesize
32KB

Download
memory/1256-79-0x0000000007C60000-0x0000000007C74000-memory.dmp

Filesize
80KB

Download
memory/1256-14-0x0000000005130000-0x0000000005166000-memory.dmp

Filesize
216KB

Download
memory/1256-15-0x0000000005910000-0x0000000005F38000-memory.dmp

Filesize
6.2MB

Download
memory/1256-16-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/1256-17-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/1256-18-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/1256-72-0x00000000078E0000-0x0000000007983000-memory.dmp

Filesize
652KB

Download
memory/1256-74-0x0000000007A20000-0x0000000007A3A000-memory.dmp

Filesize
104KB

Download
memory/1256-73-0x0000000008060000-0x00000000086DA000-memory.dmp

Filesize
6.5MB

Download
memory/1256-23-0x00000000056D0000-0x0000000005736000-memory.dmp

Filesize
408KB

Download
memory/1256-61-0x00000000078B0000-0x00000000078CE000-memory.dmp

Filesize
120KB

Download
memory/1256-24-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/1256-22-0x0000000005630000-0x0000000005652000-memory.dmp

Filesize
136KB

Download
memory/1256-51-0x0000000075190000-0x00000000751DC000-memory.dmp

Filesize
304KB

Download
memory/1352-89-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1352-45-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2856-78-0x0000000007950000-0x000000000795E000-memory.dmp

Filesize
56KB

Download
memory/2856-76-0x00000000079A0000-0x0000000007A36000-memory.dmp

Filesize
600KB

Download
memory/2856-48-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/2856-49-0x0000000006970000-0x00000000069BC000-memory.dmp

Filesize
304KB

Download
memory/2856-40-0x0000000005E00000-0x0000000006154000-memory.dmp

Filesize
3.3MB

Download
memory/2856-62-0x0000000075190000-0x00000000751DC000-memory.dmp

Filesize
304KB

Download
memory/2856-88-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/2856-80-0x0000000007A60000-0x0000000007A7A000-memory.dmp

Filesize
104KB

Download
memory/2856-21-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/2856-20-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/2856-19-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3392-5-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3392-3-0x00000000059C0000-0x0000000005A52000-memory.dmp

Filesize
584KB

Download
memory/3392-1-0x0000000000EB0000-0x0000000000F9C000-memory.dmp

Filesize
944KB

Download
memory/3392-9-0x0000000008C50000-0x0000000008CEC000-memory.dmp

Filesize
624KB

Download
memory/3392-4-0x0000000005950000-0x000000000595A000-memory.dmp

Filesize
40KB

Download
memory/3392-8-0x0000000006630000-0x00000000066BA000-memory.dmp

Filesize
552KB

Download
memory/3392-7-0x0000000005940000-0x0000000005950000-memory.dmp

Filesize
64KB

Download
memory/3392-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/3392-2-0x0000000005F70000-0x0000000006514000-memory.dmp

Filesize
5.6MB

Download
memory/3392-47-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3392-6-0x0000000005960000-0x000000000597A000-memory.dmp

Filesize
104KB

Download
memory/3488-92-0x00000000081F0000-0x0000000008305000-memory.dmp

Filesize
1.1MB

Download
memory/4372-90-0x0000000000D10000-0x0000000000D4F000-memory.dmp

Filesize
252KB

Download
memory/4372-91-0x0000000000D10000-0x0000000000D4F000-memory.dmp

Filesize
252KB

Download
memory/4560-99-0x000001593E940000-0x000001593E9EB000-memory.dmp

Filesize
684KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads