Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-10-2022 16:13
Static task
static1
Behavioral task
behavioral1
Sample
Shipment receipt.exe
Resource
win7-20220812-en
General
-
Target
Shipment receipt.exe
-
Size
231KB
-
MD5
8af8789eac67de3b398fd91caad301c7
-
SHA1
46a834f5f2a07eefec376232b8785187c46bab5d
-
SHA256
0439c7d1f0b9dd75617a6cd78c086139feccd6a2eb91d43e3d09e6194f14bebd
-
SHA512
831f6d22a66a272cbe603d638a9e02685b587ce97ef7730f930c72a70f68a285afa005d090d950797bcb0c4fbb45d6a6f5401d29f7fd2037670086f656ffe7da
-
SSDEEP
3072:NW3q9x4CuQqhAp05FIGRnNadfS5AmqKnoeN:NmqvyhAp05FnNKmqKoe
Malware Config
Extracted
nanocore
1.2.2.0
ratagain.gleeze.com:5050
ratagainbk.gleeze.com:5050
facea582-6bb8-4111-bf8c-c4bbbdd42ea8
-
activate_away_mode
true
-
backup_connection_host
ratagainbk.gleeze.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-01-24T09:08:07.151828536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5050
-
default_group
April
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
facea582-6bb8-4111-bf8c-c4bbbdd42ea8
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
ratagain.gleeze.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Shipment receipt.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zxaxoqehw = "\"C:\\Users\\Admin\\AppData\\Roaming\\Nxbjycx\\Zxaxoqehw.exe\"" Shipment receipt.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipment receipt.exedescription pid process target process PID 1884 set thread context of 1028 1884 Shipment receipt.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1920 timeout.exe -
Processes:
Shipment receipt.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 Shipment receipt.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 Shipment receipt.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeShipment receipt.exeRegAsm.exepid process 1716 powershell.exe 1884 Shipment receipt.exe 1884 Shipment receipt.exe 1884 Shipment receipt.exe 1028 RegAsm.exe 1028 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1028 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Shipment receipt.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1884 Shipment receipt.exe Token: SeDebugPrivilege 1716 powershell.exe Token: SeDebugPrivilege 1028 RegAsm.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
Shipment receipt.execmd.exedescription pid process target process PID 1884 wrote to memory of 1972 1884 Shipment receipt.exe cmd.exe PID 1884 wrote to memory of 1972 1884 Shipment receipt.exe cmd.exe PID 1884 wrote to memory of 1972 1884 Shipment receipt.exe cmd.exe PID 1884 wrote to memory of 1972 1884 Shipment receipt.exe cmd.exe PID 1972 wrote to memory of 1920 1972 cmd.exe timeout.exe PID 1972 wrote to memory of 1920 1972 cmd.exe timeout.exe PID 1972 wrote to memory of 1920 1972 cmd.exe timeout.exe PID 1972 wrote to memory of 1920 1972 cmd.exe timeout.exe PID 1884 wrote to memory of 1716 1884 Shipment receipt.exe powershell.exe PID 1884 wrote to memory of 1716 1884 Shipment receipt.exe powershell.exe PID 1884 wrote to memory of 1716 1884 Shipment receipt.exe powershell.exe PID 1884 wrote to memory of 1716 1884 Shipment receipt.exe powershell.exe PID 1884 wrote to memory of 752 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 752 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 752 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 752 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 752 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 752 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 752 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe PID 1884 wrote to memory of 1028 1884 Shipment receipt.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment receipt.exe"C:\Users\Admin\AppData\Local\Temp\Shipment receipt.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABOAHgAYgBqAHkAYwB4AFwAWgB4AGEAeABvAHEAZQBoAHcALgBlAHgAZQAnAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1028-74-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1028-70-0x000000000043E07E-mapping.dmp
-
memory/1028-63-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1028-78-0x00000000005C0000-0x00000000005CA000-memory.dmpFilesize
40KB
-
memory/1028-64-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1028-76-0x0000000000510000-0x000000000051A000-memory.dmpFilesize
40KB
-
memory/1028-72-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1028-66-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1028-79-0x0000000004F45000-0x0000000004F56000-memory.dmpFilesize
68KB
-
memory/1028-77-0x0000000000670000-0x000000000068E000-memory.dmpFilesize
120KB
-
memory/1028-69-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1028-68-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1716-61-0x000000006EDD0000-0x000000006F37B000-memory.dmpFilesize
5.7MB
-
memory/1716-59-0x0000000000000000-mapping.dmp
-
memory/1884-62-0x0000000008100000-0x000000000815E000-memory.dmpFilesize
376KB
-
memory/1884-55-0x0000000075571000-0x0000000075573000-memory.dmpFilesize
8KB
-
memory/1884-54-0x0000000000130000-0x0000000000170000-memory.dmpFilesize
256KB
-
memory/1884-56-0x00000000089C0000-0x0000000008B46000-memory.dmpFilesize
1.5MB
-
memory/1920-58-0x0000000000000000-mapping.dmp
-
memory/1972-57-0x0000000000000000-mapping.dmp