Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:57
Static task
static1
Behavioral task
behavioral1
Sample
Receipt-Dhl june 2020 frieght.exe
Resource
win7-20220414-en
General
-
Target
Receipt-Dhl june 2020 frieght.exe
-
Size
322KB
-
MD5
9a976316c0f9d94fc5e82d5a0d010206
-
SHA1
0179fe95468daa9c4eb24a6704d8faeea5acc4ae
-
SHA256
86622b1479706d348299e938ab1889c02f9c33aa1c572902e43367edfbbe526c
-
SHA512
193c38232025185098fe68dac06fdee2edeb1ec1664e9b7432b7cfb0a1139de05d5f6ebc1d94a59adeb1e8446639d2a24b991a3c44ab102bbbb962ea520209cf
Malware Config
Extracted
nanocore
1.2.2.0
forwork61420.ddns.net:3118
forwork61420.duckdns.org:3118
713ef177-b6be-471f-adec-854b1cda1062
-
activate_away_mode
true
-
backup_connection_host
forwork61420.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-28T15:15:12.586904536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
3118
-
default_group
TT
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
713ef177-b6be-471f-adec-854b1cda1062
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
forwork61420.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
Receipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\xpbud = "C:\\Users\\Admin\\AppData\\Roaming\\pxbud.exe" Receipt-Dhl june 2020 frieght.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\xpbud = "C:\\Users\\Admin\\AppData\\Roaming\\pxbud.exe" Receipt-Dhl june 2020 frieght.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\xpbud = "C:\\Users\\Admin\\AppData\\Roaming\\pxbud.exe" Receipt-Dhl june 2020 frieght.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\xpbud = "C:\\Users\\Admin\\AppData\\Roaming\\pxbud.exe" Receipt-Dhl june 2020 frieght.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\xpbud = "C:\\Users\\Admin\\AppData\\Roaming\\pxbud.exe" Receipt-Dhl june 2020 frieght.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Receipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exedescription pid process target process PID 1100 set thread context of 1744 1100 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 set thread context of 764 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1508 set thread context of 1928 1508 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1488 set thread context of 856 1488 Receipt-Dhl june 2020 frieght.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Receipt-Dhl june 2020 frieght.exepid process 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe 1100 Receipt-Dhl june 2020 frieght.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1744 RegAsm.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Receipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exepid process 1100 Receipt-Dhl june 2020 frieght.exe 1176 Receipt-Dhl june 2020 frieght.exe 1176 Receipt-Dhl june 2020 frieght.exe 1508 Receipt-Dhl june 2020 frieght.exe 1488 Receipt-Dhl june 2020 frieght.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Receipt-Dhl june 2020 frieght.exeRegAsm.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exedescription pid process Token: SeDebugPrivilege 1100 Receipt-Dhl june 2020 frieght.exe Token: SeDebugPrivilege 1744 RegAsm.exe Token: SeDebugPrivilege 1176 Receipt-Dhl june 2020 frieght.exe Token: SeDebugPrivilege 1508 Receipt-Dhl june 2020 frieght.exe Token: SeDebugPrivilege 1488 Receipt-Dhl june 2020 frieght.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
Receipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exeReceipt-Dhl june 2020 frieght.exedescription pid process target process PID 1100 wrote to memory of 1744 1100 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1100 wrote to memory of 1744 1100 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1100 wrote to memory of 1744 1100 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1100 wrote to memory of 1744 1100 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1100 wrote to memory of 1744 1100 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1100 wrote to memory of 1744 1100 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1100 wrote to memory of 1744 1100 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1100 wrote to memory of 1744 1100 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1100 wrote to memory of 1176 1100 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1100 wrote to memory of 1176 1100 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1100 wrote to memory of 1176 1100 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1100 wrote to memory of 1176 1100 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1176 wrote to memory of 616 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 616 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 616 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 616 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 616 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 616 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 616 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 764 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 764 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 764 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 764 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 764 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 764 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 764 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 764 1176 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1176 wrote to memory of 1508 1176 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1176 wrote to memory of 1508 1176 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1176 wrote to memory of 1508 1176 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1176 wrote to memory of 1508 1176 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1508 wrote to memory of 1928 1508 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1508 wrote to memory of 1928 1508 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1508 wrote to memory of 1928 1508 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1508 wrote to memory of 1928 1508 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1508 wrote to memory of 1928 1508 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1508 wrote to memory of 1928 1508 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1508 wrote to memory of 1928 1508 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1508 wrote to memory of 1928 1508 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1508 wrote to memory of 1488 1508 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1508 wrote to memory of 1488 1508 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1508 wrote to memory of 1488 1508 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1508 wrote to memory of 1488 1508 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1488 wrote to memory of 856 1488 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1488 wrote to memory of 856 1488 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1488 wrote to memory of 856 1488 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1488 wrote to memory of 856 1488 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1488 wrote to memory of 856 1488 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1488 wrote to memory of 856 1488 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1488 wrote to memory of 856 1488 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1488 wrote to memory of 856 1488 Receipt-Dhl june 2020 frieght.exe RegAsm.exe PID 1488 wrote to memory of 456 1488 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1488 wrote to memory of 456 1488 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1488 wrote to memory of 456 1488 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe PID 1488 wrote to memory of 456 1488 Receipt-Dhl june 2020 frieght.exe Receipt-Dhl june 2020 frieght.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"4⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"C:\Users\Admin\AppData\Local\Temp\Receipt-Dhl june 2020 frieght.exe"5⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/456-78-0x0000000000500000-0x0000000000542000-memory.dmpFilesize
264KB
-
memory/456-77-0x0000000000000000-mapping.dmp
-
memory/764-67-0x000000000041E792-mapping.dmp
-
memory/856-75-0x000000000041E792-mapping.dmp
-
memory/1100-55-0x00000000003A0000-0x00000000003E2000-memory.dmpFilesize
264KB
-
memory/1100-56-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/1100-54-0x0000000000D00000-0x0000000000D58000-memory.dmpFilesize
352KB
-
memory/1100-65-0x0000000000280000-0x0000000000283000-memory.dmpFilesize
12KB
-
memory/1176-63-0x0000000000000000-mapping.dmp
-
memory/1488-73-0x0000000000000000-mapping.dmp
-
memory/1508-69-0x0000000000000000-mapping.dmp
-
memory/1744-66-0x0000000004EE5000-0x0000000004EF6000-memory.dmpFilesize
68KB
-
memory/1744-62-0x00000000005B0000-0x00000000005BA000-memory.dmpFilesize
40KB
-
memory/1744-61-0x0000000000590000-0x00000000005AE000-memory.dmpFilesize
120KB
-
memory/1744-60-0x0000000000580000-0x000000000058A000-memory.dmpFilesize
40KB
-
memory/1744-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1744-57-0x000000000041E792-mapping.dmp
-
memory/1928-71-0x000000000041E792-mapping.dmp