Analysis
-
max time kernel
156s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
POEA-MANNING ADVISORY 2020-56.PDF.exe
Resource
win7-20220414-en
General
-
Target
POEA-MANNING ADVISORY 2020-56.PDF.exe
-
Size
1.1MB
-
MD5
dfd8bd78c724d661a354312437e303de
-
SHA1
1ab0afb0cafb35b2218aefa34de78abec2eea298
-
SHA256
62a7f441ba21aaa568fe700029fa32d6dd7eeb2ed0a7f7259a680f2aae65ee31
-
SHA512
e6cc3b297288cf0a361754d3a377ff89c8206382cedf044f7d2cc3bbc41b39e330a7acf2ede4fc2f353bf16cf2d23bceab17c1c385fec84876eb54b72a02ed37
Malware Config
Extracted
nanocore
1.2.2.0
alhabib4rec.freeddns.org:54985
alhabib4rec.ddns.net:54985
241aa85d-c14f-4ebb-875d-fb86e35e90ef
-
activate_away_mode
true
-
backup_connection_host
alhabib4rec.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-22T04:20:45.642519636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54985
-
default_group
AUGUST-LOGS
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
241aa85d-c14f-4ebb-875d-fb86e35e90ef
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
alhabib4rec.freeddns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
sfoioh.pifRegSvcs.exepid process 2044 sfoioh.pif 2036 RegSvcs.exe -
Loads dropped DLL 5 IoCs
Processes:
POEA-MANNING ADVISORY 2020-56.PDF.exesfoioh.pifpid process 1664 POEA-MANNING ADVISORY 2020-56.PDF.exe 1664 POEA-MANNING ADVISORY 2020-56.PDF.exe 1664 POEA-MANNING ADVISORY 2020-56.PDF.exe 1664 POEA-MANNING ADVISORY 2020-56.PDF.exe 2044 sfoioh.pif -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
sfoioh.pifdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run sfoioh.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\29636000\\sfoioh.pif C:\\Users\\Admin\\29636000\\eqhp.lxk" sfoioh.pif -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sfoioh.pifdescription pid process target process PID 2044 set thread context of 2036 2044 sfoioh.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RegSvcs.exesfoioh.pifpid process 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2044 sfoioh.pif 2044 sfoioh.pif 2036 RegSvcs.exe 2036 RegSvcs.exe 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif 2044 sfoioh.pif -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2036 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2036 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
POEA-MANNING ADVISORY 2020-56.PDF.exesfoioh.pifRegSvcs.exedescription pid process target process PID 1664 wrote to memory of 2044 1664 POEA-MANNING ADVISORY 2020-56.PDF.exe sfoioh.pif PID 1664 wrote to memory of 2044 1664 POEA-MANNING ADVISORY 2020-56.PDF.exe sfoioh.pif PID 1664 wrote to memory of 2044 1664 POEA-MANNING ADVISORY 2020-56.PDF.exe sfoioh.pif PID 1664 wrote to memory of 2044 1664 POEA-MANNING ADVISORY 2020-56.PDF.exe sfoioh.pif PID 2044 wrote to memory of 2036 2044 sfoioh.pif RegSvcs.exe PID 2044 wrote to memory of 2036 2044 sfoioh.pif RegSvcs.exe PID 2044 wrote to memory of 2036 2044 sfoioh.pif RegSvcs.exe PID 2044 wrote to memory of 2036 2044 sfoioh.pif RegSvcs.exe PID 2044 wrote to memory of 2036 2044 sfoioh.pif RegSvcs.exe PID 2044 wrote to memory of 2036 2044 sfoioh.pif RegSvcs.exe PID 2044 wrote to memory of 2036 2044 sfoioh.pif RegSvcs.exe PID 2044 wrote to memory of 2036 2044 sfoioh.pif RegSvcs.exe PID 2044 wrote to memory of 2036 2044 sfoioh.pif RegSvcs.exe PID 2036 wrote to memory of 1764 2036 RegSvcs.exe schtasks.exe PID 2036 wrote to memory of 1764 2036 RegSvcs.exe schtasks.exe PID 2036 wrote to memory of 1764 2036 RegSvcs.exe schtasks.exe PID 2036 wrote to memory of 1764 2036 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\POEA-MANNING ADVISORY 2020-56.PDF.exe"C:\Users\Admin\AppData\Local\Temp\POEA-MANNING ADVISORY 2020-56.PDF.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\29636000\sfoioh.pif"C:\Users\Admin\29636000\sfoioh.pif" eqhp.lxk2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6B42.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\29636000\eqhp.lxkFilesize
163.8MB
MD5dd9d3c284f145310191e54f38e77c612
SHA1a37372bc5fe3658da6b7aae1130b9704a1baa132
SHA25632f2e39dc6ecfb1ec709ee20b3941718129eeb91379e25cc1555eed76fcb2124
SHA512670dc9edf4b5ad1190461919e52ad0f87d28c6192f44b92275f4af550e35a737b23fc2932d6aa212f07a753877b0a9adb5edb2a3bd0698420285c5040fb110df
-
C:\Users\Admin\29636000\gklhdwdnin.icoFilesize
461KB
MD55d4efddc3fce2129f51b0c55ca44e3d7
SHA162df8b558d1ecdc40066c25bddadcef363151fda
SHA256989aa53994b85502af0a163113363d90b28a800e9e1c26d52029ec3f581c6415
SHA512708860e32eb396c775c8eb95e04b67c0c736da4d0c3644c9d2d2de4b94b31eec45df7aec077786ed52a5966f174883e32bf675d4ddce8b5167a27f4b9f83244f
-
C:\Users\Admin\29636000\sfoioh.pifFilesize
712KB
MD50ccbaaf7aec34840fcd7c27a8539c8a1
SHA130f905338f43c12abc44226e1a6211e16f3491d2
SHA256da606b2ce7c6d525844f1fdc751719c42ec59d662a8794104ca12eb5de280438
SHA51204583d42685b0a904c08bcc7c4b360577ceff8e72f74133d856175df8c005e49a8ac2ae4d75bb764b4a9e0a8c7d7adfb12cf45caf70beaf52f273d1e39e7a0a9
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp6B42.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
\Users\Admin\29636000\sfoioh.pifFilesize
712KB
MD50ccbaaf7aec34840fcd7c27a8539c8a1
SHA130f905338f43c12abc44226e1a6211e16f3491d2
SHA256da606b2ce7c6d525844f1fdc751719c42ec59d662a8794104ca12eb5de280438
SHA51204583d42685b0a904c08bcc7c4b360577ceff8e72f74133d856175df8c005e49a8ac2ae4d75bb764b4a9e0a8c7d7adfb12cf45caf70beaf52f273d1e39e7a0a9
-
\Users\Admin\29636000\sfoioh.pifFilesize
712KB
MD50ccbaaf7aec34840fcd7c27a8539c8a1
SHA130f905338f43c12abc44226e1a6211e16f3491d2
SHA256da606b2ce7c6d525844f1fdc751719c42ec59d662a8794104ca12eb5de280438
SHA51204583d42685b0a904c08bcc7c4b360577ceff8e72f74133d856175df8c005e49a8ac2ae4d75bb764b4a9e0a8c7d7adfb12cf45caf70beaf52f273d1e39e7a0a9
-
\Users\Admin\29636000\sfoioh.pifFilesize
712KB
MD50ccbaaf7aec34840fcd7c27a8539c8a1
SHA130f905338f43c12abc44226e1a6211e16f3491d2
SHA256da606b2ce7c6d525844f1fdc751719c42ec59d662a8794104ca12eb5de280438
SHA51204583d42685b0a904c08bcc7c4b360577ceff8e72f74133d856175df8c005e49a8ac2ae4d75bb764b4a9e0a8c7d7adfb12cf45caf70beaf52f273d1e39e7a0a9
-
\Users\Admin\29636000\sfoioh.pifFilesize
712KB
MD50ccbaaf7aec34840fcd7c27a8539c8a1
SHA130f905338f43c12abc44226e1a6211e16f3491d2
SHA256da606b2ce7c6d525844f1fdc751719c42ec59d662a8794104ca12eb5de280438
SHA51204583d42685b0a904c08bcc7c4b360577ceff8e72f74133d856175df8c005e49a8ac2ae4d75bb764b4a9e0a8c7d7adfb12cf45caf70beaf52f273d1e39e7a0a9
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/1664-54-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/1764-77-0x0000000000000000-mapping.dmp
-
memory/2036-73-0x00000000003C0000-0x00000000009D3000-memory.dmpFilesize
6.1MB
-
memory/2036-71-0x00000000003C0000-0x00000000009D3000-memory.dmpFilesize
6.1MB
-
memory/2036-68-0x00000000003DE792-mapping.dmp
-
memory/2036-67-0x00000000003C0000-0x00000000009D3000-memory.dmpFilesize
6.1MB
-
memory/2036-75-0x00000000003C0000-0x00000000003F8000-memory.dmpFilesize
224KB
-
memory/2036-65-0x00000000003C0000-0x00000000009D3000-memory.dmpFilesize
6.1MB
-
memory/2036-79-0x0000000000C00000-0x0000000000C0A000-memory.dmpFilesize
40KB
-
memory/2036-80-0x0000000001020000-0x000000000103E000-memory.dmpFilesize
120KB
-
memory/2036-81-0x0000000000C10000-0x0000000000C1A000-memory.dmpFilesize
40KB
-
memory/2044-59-0x0000000000000000-mapping.dmp