Analysis
-
max time kernel
190s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 17:35
Static task
static1
Behavioral task
behavioral1
Sample
Maersk Bill of ladding final docs.exe
Resource
win7-20220414-en
General
-
Target
Maersk Bill of ladding final docs.exe
-
Size
886KB
-
MD5
9b8bf5cb432ba0b3e6a64c2d2fdf843b
-
SHA1
8a9706887e232a1d62afcf73a8db3aff63cad6bd
-
SHA256
592374e47050456f6402537fe300de6bd224a3a7b9ad1b4f9214ab298e075ce9
-
SHA512
68b6fa1f6f54940802b6b9b5a4903d0cd9d47c5f39b373805f65b55d6f1fee8e66647f5cbbf7ddc088c60c2c53ccd711dad6bd30189129f2fbcc1e9c24ca3e53
Malware Config
Extracted
nanocore
1.2.2.0
averyserkis.hopto.org:6565
629574a7-b3af-49d0-8d44-36487618bba9
-
activate_away_mode
true
-
backup_connection_host
averyserkis.hopto.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-05-17T00:11:08.560168036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6565
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
629574a7-b3af-49d0-8d44-36487618bba9
-
mutex_timeout
5000
-
prevent_system_sleep
false
- primary_connection_host
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3160-130-0x0000000000580000-0x0000000000766000-memory.dmp upx behavioral2/memory/3160-131-0x0000000000580000-0x0000000000766000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
Maersk Bill of ladding final docs.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\verclsid.url Maersk Bill of ladding final docs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3160-131-0x0000000000580000-0x0000000000766000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Maersk Bill of ladding final docs.exedescription pid process target process PID 3160 set thread context of 2868 3160 Maersk Bill of ladding final docs.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\SCSI Subsystem\scsiss.exe RegAsm.exe File opened for modification C:\Program Files (x86)\SCSI Subsystem\scsiss.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Maersk Bill of ladding final docs.exepid process 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 2868 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2868 RegAsm.exe Token: SeDebugPrivilege 2868 RegAsm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Maersk Bill of ladding final docs.exepid process 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Maersk Bill of ladding final docs.exepid process 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe 3160 Maersk Bill of ladding final docs.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Maersk Bill of ladding final docs.exeRegAsm.exedescription pid process target process PID 3160 wrote to memory of 2868 3160 Maersk Bill of ladding final docs.exe RegAsm.exe PID 3160 wrote to memory of 2868 3160 Maersk Bill of ladding final docs.exe RegAsm.exe PID 3160 wrote to memory of 2868 3160 Maersk Bill of ladding final docs.exe RegAsm.exe PID 3160 wrote to memory of 2868 3160 Maersk Bill of ladding final docs.exe RegAsm.exe PID 3160 wrote to memory of 2868 3160 Maersk Bill of ladding final docs.exe RegAsm.exe PID 2868 wrote to memory of 4628 2868 RegAsm.exe schtasks.exe PID 2868 wrote to memory of 4628 2868 RegAsm.exe schtasks.exe PID 2868 wrote to memory of 4628 2868 RegAsm.exe schtasks.exe PID 2868 wrote to memory of 740 2868 RegAsm.exe schtasks.exe PID 2868 wrote to memory of 740 2868 RegAsm.exe schtasks.exe PID 2868 wrote to memory of 740 2868 RegAsm.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Maersk Bill of ladding final docs.exe"C:\Users\Admin\AppData\Local\Temp\Maersk Bill of ladding final docs.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD0AE.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD310.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD0AE.tmpFilesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
C:\Users\Admin\AppData\Local\Temp\tmpD310.tmpFilesize
1KB
MD5bd110f9fc6c1a842f1d9b269010b0611
SHA1ef71c062902602faef9b66dcd1cfc9fe5baaf389
SHA2568135c4e4eeaa741f752c0ab8f4ee33e3bb8a0cac5923812234f2e5177d50eb5b
SHA512b8a7943a3126880b26407800bbdad5402c5b0e2aa106e7dbbb35d0cb145ca9de114401573a6aa66042a2e13674cfbcc2981d66b813f9b923fff5302210afba1f
-
memory/740-142-0x0000000000000000-mapping.dmp
-
memory/2868-133-0x0000000000000000-mapping.dmp
-
memory/2868-134-0x0000000000150000-0x0000000000188000-memory.dmpFilesize
224KB
-
memory/2868-139-0x0000000073B90000-0x0000000074141000-memory.dmpFilesize
5.7MB
-
memory/2868-144-0x0000000073B90000-0x0000000074141000-memory.dmpFilesize
5.7MB
-
memory/3160-130-0x0000000000580000-0x0000000000766000-memory.dmpFilesize
1.9MB
-
memory/3160-131-0x0000000000580000-0x0000000000766000-memory.dmpFilesize
1.9MB
-
memory/3160-132-0x0000000003950000-0x0000000003983000-memory.dmpFilesize
204KB
-
memory/4628-140-0x0000000000000000-mapping.dmp