Analysis
-
max time kernel
99s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-10-2022 15:56
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Payment Advice.exe
Resource
win10v2004-20220901-en
General
-
Target
Payment Advice.exe
-
Size
906KB
-
MD5
98207b03cb218b008c1fa9fa47867490
-
SHA1
3779274912bd5f967ef329b7c26aa2a22e0b5d87
-
SHA256
a509158e1105757bec0ff3f7dd621360d0acb1f17271841c19dab776004cd17e
-
SHA512
feca3df0b7c5c25167cc38a9aea2fff88961f1aed034a9102dfcdeea24891f2354587bae8b0e88093f83ee652592d11ec2d9c9f1b8987573f09d0cba40284590
-
SSDEEP
12288:YhTRA7rkUGV1PyVrB33l4epM3dX5xKeY3Zo7hypcXHADqjJ5nX:YAPGnPmWeEOeKo7sp+vjrX
Malware Config
Extracted
nanocore
1.2.2.0
brewsterchristophe.ddns.net:5899
194,147,5,75:5899
b8aebc29-8c64-444f-99e6-dc4122e9bbfc
-
activate_away_mode
true
-
backup_connection_host
194,147,5,75
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-04-29T03:26:40.572298236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5899
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b8aebc29-8c64-444f-99e6-dc4122e9bbfc
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
brewsterchristophe.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Payment Advice.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" Payment Advice.exe -
Processes:
Payment Advice.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Payment Advice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment Advice.exedescription pid process target process PID 780 set thread context of 1996 780 Payment Advice.exe Payment Advice.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Payment Advice.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisvc.exe Payment Advice.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe Payment Advice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2044 schtasks.exe 268 schtasks.exe 624 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Payment Advice.exepid process 1996 Payment Advice.exe 1996 Payment Advice.exe 1996 Payment Advice.exe 1996 Payment Advice.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Payment Advice.exepid process 1996 Payment Advice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payment Advice.exedescription pid process Token: SeDebugPrivilege 1996 Payment Advice.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Payment Advice.exePayment Advice.exedescription pid process target process PID 780 wrote to memory of 2044 780 Payment Advice.exe schtasks.exe PID 780 wrote to memory of 2044 780 Payment Advice.exe schtasks.exe PID 780 wrote to memory of 2044 780 Payment Advice.exe schtasks.exe PID 780 wrote to memory of 2044 780 Payment Advice.exe schtasks.exe PID 780 wrote to memory of 1996 780 Payment Advice.exe Payment Advice.exe PID 780 wrote to memory of 1996 780 Payment Advice.exe Payment Advice.exe PID 780 wrote to memory of 1996 780 Payment Advice.exe Payment Advice.exe PID 780 wrote to memory of 1996 780 Payment Advice.exe Payment Advice.exe PID 780 wrote to memory of 1996 780 Payment Advice.exe Payment Advice.exe PID 780 wrote to memory of 1996 780 Payment Advice.exe Payment Advice.exe PID 780 wrote to memory of 1996 780 Payment Advice.exe Payment Advice.exe PID 780 wrote to memory of 1996 780 Payment Advice.exe Payment Advice.exe PID 780 wrote to memory of 1996 780 Payment Advice.exe Payment Advice.exe PID 1996 wrote to memory of 268 1996 Payment Advice.exe schtasks.exe PID 1996 wrote to memory of 268 1996 Payment Advice.exe schtasks.exe PID 1996 wrote to memory of 268 1996 Payment Advice.exe schtasks.exe PID 1996 wrote to memory of 268 1996 Payment Advice.exe schtasks.exe PID 1996 wrote to memory of 624 1996 Payment Advice.exe schtasks.exe PID 1996 wrote to memory of 624 1996 Payment Advice.exe schtasks.exe PID 1996 wrote to memory of 624 1996 Payment Advice.exe schtasks.exe PID 1996 wrote to memory of 624 1996 Payment Advice.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wnbXfAlAOlj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC350.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC85F.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC959.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC350.tmpFilesize
1KB
MD57b648318ce9094842963b817d7b21749
SHA1e8dadff5976cc1f0fdb3f23e1b7dc5cd028afe56
SHA25670daca1447b97479ebe33ba9fc113bc9f1afebf36dbf3becf5adbe63239d7599
SHA5122ae53c4758ac4346b17307bdfafce20c5fc0acb741caee25894866145713e2a6c0d476ef16e76fb3314487c7af1ee1fc1afe2a63a7cce81b6e4519ee29557a41
-
C:\Users\Admin\AppData\Local\Temp\tmpC85F.tmpFilesize
1KB
MD5458bd9bd481646fa69a54d107e96c8f9
SHA18c13631b59db1efcb6d33a4e40ba38614226d42a
SHA256e196fc51e235fc106b72fe4258ce43c64b24b344c4781b6d2b0db6ab01f31c34
SHA512266e4a2752ff6a1c78fad600d9dc74ed0946a7bfc6802bd03783360b7f5ce8ada8be0fbf0f342e81d76f74af62879ffbf2b865160e4b8d0a27c6e15f98f92171
-
C:\Users\Admin\AppData\Local\Temp\tmpC959.tmpFilesize
1KB
MD54e71faa3a77029484cfaba423d96618f
SHA19c837d050bb43d69dc608af809c292e13bca4718
SHA256c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb
SHA5126d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0
-
memory/268-74-0x0000000000000000-mapping.dmp
-
memory/624-76-0x0000000000000000-mapping.dmp
-
memory/780-55-0x0000000076321000-0x0000000076323000-memory.dmpFilesize
8KB
-
memory/780-56-0x00000000004A0000-0x00000000004C0000-memory.dmpFilesize
128KB
-
memory/780-57-0x0000000005330000-0x00000000053BC000-memory.dmpFilesize
560KB
-
memory/780-58-0x0000000000BB0000-0x0000000000BEC000-memory.dmpFilesize
240KB
-
memory/780-54-0x0000000000BF0000-0x0000000000CD8000-memory.dmpFilesize
928KB
-
memory/1996-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1996-80-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/1996-68-0x000000000041E792-mapping.dmp
-
memory/1996-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1996-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1996-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1996-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1996-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1996-92-0x0000000004400000-0x0000000004414000-memory.dmpFilesize
80KB
-
memory/1996-78-0x0000000000450000-0x000000000045A000-memory.dmpFilesize
40KB
-
memory/1996-79-0x0000000000660000-0x000000000067E000-memory.dmpFilesize
120KB
-
memory/1996-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1996-81-0x00000000006D0000-0x00000000006E2000-memory.dmpFilesize
72KB
-
memory/1996-82-0x00000000006F0000-0x000000000070A000-memory.dmpFilesize
104KB
-
memory/1996-83-0x0000000000A80000-0x0000000000A8E000-memory.dmpFilesize
56KB
-
memory/1996-84-0x0000000000B20000-0x0000000000B32000-memory.dmpFilesize
72KB
-
memory/1996-85-0x0000000000BE0000-0x0000000000BEE000-memory.dmpFilesize
56KB
-
memory/1996-86-0x00000000020E0000-0x00000000020EC000-memory.dmpFilesize
48KB
-
memory/1996-87-0x0000000002270000-0x0000000002284000-memory.dmpFilesize
80KB
-
memory/1996-88-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/1996-89-0x0000000002290000-0x00000000022A4000-memory.dmpFilesize
80KB
-
memory/1996-90-0x00000000022E0000-0x00000000022EE000-memory.dmpFilesize
56KB
-
memory/1996-91-0x0000000004C20000-0x0000000004C4E000-memory.dmpFilesize
184KB
-
memory/2044-59-0x0000000000000000-mapping.dmp