Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 17:35
Static task
static1
Behavioral task
behavioral1
Sample
Maersk Bill of ladding final docs.exe
Resource
win7-20220414-en
General
-
Target
Maersk Bill of ladding final docs.exe
-
Size
886KB
-
MD5
9b8bf5cb432ba0b3e6a64c2d2fdf843b
-
SHA1
8a9706887e232a1d62afcf73a8db3aff63cad6bd
-
SHA256
592374e47050456f6402537fe300de6bd224a3a7b9ad1b4f9214ab298e075ce9
-
SHA512
68b6fa1f6f54940802b6b9b5a4903d0cd9d47c5f39b373805f65b55d6f1fee8e66647f5cbbf7ddc088c60c2c53ccd711dad6bd30189129f2fbcc1e9c24ca3e53
Malware Config
Extracted
nanocore
1.2.2.0
averyserkis.hopto.org:6565
629574a7-b3af-49d0-8d44-36487618bba9
-
activate_away_mode
true
-
backup_connection_host
averyserkis.hopto.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-05-17T00:11:08.560168036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6565
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
629574a7-b3af-49d0-8d44-36487618bba9
-
mutex_timeout
5000
-
prevent_system_sleep
false
- primary_connection_host
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1808-55-0x00000000003A0000-0x0000000000586000-memory.dmp upx behavioral1/memory/1808-71-0x00000000003A0000-0x0000000000586000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
Maersk Bill of ladding final docs.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\verclsid.url Maersk Bill of ladding final docs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Service = "C:\\Program Files (x86)\\ARP Service\\arpsvc.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1808-55-0x00000000003A0000-0x0000000000586000-memory.dmp autoit_exe behavioral1/memory/1808-71-0x00000000003A0000-0x0000000000586000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Maersk Bill of ladding final docs.exedescription pid process target process PID 1808 set thread context of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\ARP Service\arpsvc.exe RegAsm.exe File opened for modification C:\Program Files (x86)\ARP Service\arpsvc.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1772 schtasks.exe 1288 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Maersk Bill of ladding final docs.exepid process 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1760 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1760 RegAsm.exe Token: SeDebugPrivilege 1760 RegAsm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Maersk Bill of ladding final docs.exepid process 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Maersk Bill of ladding final docs.exepid process 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe 1808 Maersk Bill of ladding final docs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Maersk Bill of ladding final docs.exeRegAsm.exedescription pid process target process PID 1808 wrote to memory of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe PID 1808 wrote to memory of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe PID 1808 wrote to memory of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe PID 1808 wrote to memory of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe PID 1808 wrote to memory of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe PID 1808 wrote to memory of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe PID 1808 wrote to memory of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe PID 1808 wrote to memory of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe PID 1808 wrote to memory of 1760 1808 Maersk Bill of ladding final docs.exe RegAsm.exe PID 1760 wrote to memory of 1772 1760 RegAsm.exe schtasks.exe PID 1760 wrote to memory of 1772 1760 RegAsm.exe schtasks.exe PID 1760 wrote to memory of 1772 1760 RegAsm.exe schtasks.exe PID 1760 wrote to memory of 1772 1760 RegAsm.exe schtasks.exe PID 1760 wrote to memory of 1288 1760 RegAsm.exe schtasks.exe PID 1760 wrote to memory of 1288 1760 RegAsm.exe schtasks.exe PID 1760 wrote to memory of 1288 1760 RegAsm.exe schtasks.exe PID 1760 wrote to memory of 1288 1760 RegAsm.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Maersk Bill of ladding final docs.exe"C:\Users\Admin\AppData\Local\Temp\Maersk Bill of ladding final docs.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5726.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA70B.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5726.tmpFilesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
C:\Users\Admin\AppData\Local\Temp\tmpA70B.tmpFilesize
1KB
MD51badb6e2b29a1c4bfff3c179d53ab96b
SHA14b2ad3e5f3826d252d1c8bf1c8f0702f39129fa1
SHA2566259ac4e6859a1b528d77ccea12b378f7dfa1eff359d9b8899414b4b1c484699
SHA51236338e2a74fd85c5f2c84be009981a7260692c1bcb121a42018209031082da69bf65640702d53e28b54871f9d44e65fdbebaf4771c530699c3e93981b58129b4
-
memory/1288-73-0x0000000000000000-mapping.dmp
-
memory/1760-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1760-63-0x000000000041E792-mapping.dmp
-
memory/1760-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1760-68-0x0000000074360000-0x000000007490B000-memory.dmpFilesize
5.7MB
-
memory/1760-58-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1760-72-0x0000000074360000-0x000000007490B000-memory.dmpFilesize
5.7MB
-
memory/1760-56-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1772-69-0x0000000000000000-mapping.dmp
-
memory/1808-54-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/1808-67-0x0000000002940000-0x0000000002973000-memory.dmpFilesize
204KB
-
memory/1808-71-0x00000000003A0000-0x0000000000586000-memory.dmpFilesize
1.9MB
-
memory/1808-55-0x00000000003A0000-0x0000000000586000-memory.dmpFilesize
1.9MB