Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 08:50
Static task
static1
Behavioral task
behavioral1
Sample
Proof Of Payment.pdf.scr
Resource
win7
General
-
Target
Proof Of Payment.pdf.scr
-
Size
802KB
-
MD5
def46fa8f7ed19921147161cb4d20164
-
SHA1
56322d0751e48e4a8ee48dcd3c44a058d2f224cd
-
SHA256
38bf20255640821b131eaa9c22c16a6e55e61e18a6cd4e248aa07b919847d626
-
SHA512
ca4c063e5dbb3389958b865cc572f618ce8810d90a8d88a638742f53e808f254bcd07a55f4c7f4f6fd93ff81a6fcec6a8356326ba2087ec09e25eca3d9de0187
Malware Config
Extracted
nanocore
1.2.2.0
harolds.ooguy.com:6051
harold.jetos.com:6051
501fcca9-f8c3-4f9b-a6ac-05c50b2994da
-
activate_away_mode
true
-
backup_connection_host
harold.jetos.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-12T14:32:58.481672636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6051
-
default_group
Spartan
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
501fcca9-f8c3-4f9b-a6ac-05c50b2994da
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
harolds.ooguy.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Proof Of Payment.pdf.scrdescription pid process target process PID 1484 wrote to memory of 1600 1484 Proof Of Payment.pdf.scr notepad.exe PID 1484 wrote to memory of 1600 1484 Proof Of Payment.pdf.scr notepad.exe PID 1484 wrote to memory of 1600 1484 Proof Of Payment.pdf.scr notepad.exe PID 1484 wrote to memory of 1600 1484 Proof Of Payment.pdf.scr notepad.exe PID 1484 wrote to memory of 1600 1484 Proof Of Payment.pdf.scr notepad.exe PID 1484 wrote to memory of 1652 1484 Proof Of Payment.pdf.scr Proof Of Payment.pdf.scr PID 1484 wrote to memory of 1652 1484 Proof Of Payment.pdf.scr Proof Of Payment.pdf.scr PID 1484 wrote to memory of 1652 1484 Proof Of Payment.pdf.scr Proof Of Payment.pdf.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Proof Of Payment.pdf.scrdescription pid process Token: SeDebugPrivilege 1652 Proof Of Payment.pdf.scr -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Proof Of Payment.pdf.scrpid process 1652 Proof Of Payment.pdf.scr -
Processes:
Proof Of Payment.pdf.scrdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Proof Of Payment.pdf.scr -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\just.vbs notepad.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Proof Of Payment.pdf.scrProof Of Payment.pdf.scrpid process 1484 Proof Of Payment.pdf.scr 1484 Proof Of Payment.pdf.scr 1652 Proof Of Payment.pdf.scr 1652 Proof Of Payment.pdf.scr 1652 Proof Of Payment.pdf.scr -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Proof Of Payment.pdf.scrpid process 1484 Proof Of Payment.pdf.scr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proof Of Payment.pdf.scrdescription pid process target process PID 1484 set thread context of 1652 1484 Proof Of Payment.pdf.scr Proof Of Payment.pdf.scr -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/1652-1-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/1652-3-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/1652-4-0x0000000000400000-0x000000000047F000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proof Of Payment.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Proof Of Payment.pdf.scr" /S1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\Proof Of Payment.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Proof Of Payment.pdf.scr" /S2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1600-0-0x0000000000000000-mapping.dmp
-
memory/1652-2-0x000000000047D4B0-mapping.dmp
-
memory/1652-1-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1652-3-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1652-4-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1652-5-0x0000000002100000-0x0000000002138000-memory.dmpFilesize
224KB
-
memory/1652-6-0x00000000021C2000-0x00000000021C3000-memory.dmpFilesize
4KB