Analysis
-
max time kernel
149s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:58
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Reminder_UnPaid_PDF.exe
Resource
win7-20220414-en
General
-
Target
Payment_Reminder_UnPaid_PDF.exe
-
Size
833KB
-
MD5
e45fc1ce72759efbd73464ce89b535d1
-
SHA1
243c1961e393aa5f7ca0dd48a91f951e6cadbb30
-
SHA256
2a828598f4c66e85305d93ce56bad4c27b7bd6a446eb9b9cec27d961b2591b95
-
SHA512
28cd2ff5b814ecc88dbdf1025f733fdcdddb60888c5ca9fc997b547bdf6888704856b9ecef95a6366b439441f11a6c49653da1bab3457fb1bfcad4b1e6fc06f0
Malware Config
Extracted
nanocore
1.2.2.0
u870797.nvpn.to:3119
7ad391b4-5bbc-4b89-a511-e972f9ef766e
-
activate_away_mode
true
-
backup_connection_host
u870797.nvpn.to
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-25T17:16:54.733073636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3119
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
7ad391b4-5bbc-4b89-a511-e972f9ef766e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
u870797.nvpn.to
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Payment_Reminder_UnPaid_PDF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Payment_Reminder_UnPaid_PDF.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment_Reminder_UnPaid_PDF.exedescription pid process target process PID 3504 set thread context of 4868 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3484 schtasks.exe 3976 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Payment_Reminder_UnPaid_PDF.exeRegSvcs.exepid process 3504 Payment_Reminder_UnPaid_PDF.exe 3504 Payment_Reminder_UnPaid_PDF.exe 3504 Payment_Reminder_UnPaid_PDF.exe 4868 RegSvcs.exe 4868 RegSvcs.exe 4868 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 4868 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Payment_Reminder_UnPaid_PDF.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3504 Payment_Reminder_UnPaid_PDF.exe Token: SeDebugPrivilege 4868 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Payment_Reminder_UnPaid_PDF.exeRegSvcs.exedescription pid process target process PID 3504 wrote to memory of 3484 3504 Payment_Reminder_UnPaid_PDF.exe schtasks.exe PID 3504 wrote to memory of 3484 3504 Payment_Reminder_UnPaid_PDF.exe schtasks.exe PID 3504 wrote to memory of 3484 3504 Payment_Reminder_UnPaid_PDF.exe schtasks.exe PID 3504 wrote to memory of 224 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 224 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 224 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 4868 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 4868 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 4868 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 4868 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 4868 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 4868 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 4868 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 3504 wrote to memory of 4868 3504 Payment_Reminder_UnPaid_PDF.exe RegSvcs.exe PID 4868 wrote to memory of 3976 4868 RegSvcs.exe schtasks.exe PID 4868 wrote to memory of 3976 4868 RegSvcs.exe schtasks.exe PID 4868 wrote to memory of 3976 4868 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment_Reminder_UnPaid_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Reminder_UnPaid_PDF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\Hmazyl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50EA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6B86.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp50EA.tmpFilesize
1KB
MD5eb22a65cc64b648ebb31c4836db887f7
SHA150f0a38beceb42485ad2170ea931b7fc8628eac9
SHA256b1893ffc44988e74374f83f92d7264f22b8412242c18f1d3f5a5b73e1d15ffbd
SHA5126aa25b447e65deeb4ab9b3104aab76393e456bbf7b956e50b02b469d9ee682c4226a7e8e25ed75aa3ea3e4338acaebcf8784f5f04714350ca1bced9782fe587f
-
C:\Users\Admin\AppData\Local\Temp\tmp6B86.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
memory/224-133-0x0000000000000000-mapping.dmp
-
memory/3484-131-0x0000000000000000-mapping.dmp
-
memory/3504-130-0x0000000074B90000-0x0000000075141000-memory.dmpFilesize
5.7MB
-
memory/3976-136-0x0000000000000000-mapping.dmp
-
memory/4868-134-0x0000000000000000-mapping.dmp
-
memory/4868-135-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4868-138-0x0000000074B90000-0x0000000075141000-memory.dmpFilesize
5.7MB