Analysis
-
max time kernel
50s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 11:21
Static task
static1
Behavioral task
behavioral1
Sample
IM02409682420.pdf.scr
Resource
win7-20230220-en
General
-
Target
IM02409682420.pdf.scr
-
Size
1.1MB
-
MD5
950f1e4709c69aee0e9bf082fd91574d
-
SHA1
dd7a010f52069362d8ec13df361c489efbca675a
-
SHA256
c4fb6d7a5c23c1dcb5550d864503a125ff9615e6c8edf2e6396be5ba68fd704c
-
SHA512
c3d8d5baf233708637360761711913cf220d37397697235da37edfd2a2ad6f96c420b8b81e6147a45b7b05668a43aa9ce3b8a35ef9a519dcf3f6c55b0e1c55a4
-
SSDEEP
24576:9TbBv5rUeTHpvm6tcMbtjd5v21lcgNdNd0fuiI:XBvHpvnZhUcgX0GB
Malware Config
Extracted
nanocore
1.2.2.0
december2n.duckdns.org:40111
december2nd.ddns.net:40111
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
activate_away_mode
false
-
backup_connection_host
december2nd.ddns.net
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-11-26T05:13:34.059050336Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
40111
-
default_group
mama
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
december2n.duckdns.org
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
fvtum.pifRegSvcs.exepid process 880 fvtum.pif 1476 RegSvcs.exe -
Loads dropped DLL 2 IoCs
Processes:
wscript.exefvtum.pifpid process 1896 wscript.exe 880 fvtum.pif -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fvtum.pifRegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\twgb\\Update.vbs" fvtum.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisv.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run fvtum.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\twgb\\fvtum.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\twgb\\xebp.mp3" fvtum.pif -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fvtum.pifdescription pid process target process PID 880 set thread context of 1476 880 fvtum.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisv.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1004 schtasks.exe 2036 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegSvcs.exepid process 1476 RegSvcs.exe 1476 RegSvcs.exe 1476 RegSvcs.exe 1476 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1476 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1476 RegSvcs.exe Token: SeDebugPrivilege 1476 RegSvcs.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
IM02409682420.pdf.scrwscript.exefvtum.pifRegSvcs.exedescription pid process target process PID 2044 wrote to memory of 1896 2044 IM02409682420.pdf.scr wscript.exe PID 2044 wrote to memory of 1896 2044 IM02409682420.pdf.scr wscript.exe PID 2044 wrote to memory of 1896 2044 IM02409682420.pdf.scr wscript.exe PID 2044 wrote to memory of 1896 2044 IM02409682420.pdf.scr wscript.exe PID 1896 wrote to memory of 880 1896 wscript.exe fvtum.pif PID 1896 wrote to memory of 880 1896 wscript.exe fvtum.pif PID 1896 wrote to memory of 880 1896 wscript.exe fvtum.pif PID 1896 wrote to memory of 880 1896 wscript.exe fvtum.pif PID 1896 wrote to memory of 880 1896 wscript.exe fvtum.pif PID 1896 wrote to memory of 880 1896 wscript.exe fvtum.pif PID 1896 wrote to memory of 880 1896 wscript.exe fvtum.pif PID 880 wrote to memory of 1476 880 fvtum.pif RegSvcs.exe PID 880 wrote to memory of 1476 880 fvtum.pif RegSvcs.exe PID 880 wrote to memory of 1476 880 fvtum.pif RegSvcs.exe PID 880 wrote to memory of 1476 880 fvtum.pif RegSvcs.exe PID 880 wrote to memory of 1476 880 fvtum.pif RegSvcs.exe PID 880 wrote to memory of 1476 880 fvtum.pif RegSvcs.exe PID 880 wrote to memory of 1476 880 fvtum.pif RegSvcs.exe PID 880 wrote to memory of 1476 880 fvtum.pif RegSvcs.exe PID 880 wrote to memory of 1476 880 fvtum.pif RegSvcs.exe PID 1476 wrote to memory of 1004 1476 RegSvcs.exe schtasks.exe PID 1476 wrote to memory of 1004 1476 RegSvcs.exe schtasks.exe PID 1476 wrote to memory of 1004 1476 RegSvcs.exe schtasks.exe PID 1476 wrote to memory of 1004 1476 RegSvcs.exe schtasks.exe PID 1476 wrote to memory of 2036 1476 RegSvcs.exe schtasks.exe PID 1476 wrote to memory of 2036 1476 RegSvcs.exe schtasks.exe PID 1476 wrote to memory of 2036 1476 RegSvcs.exe schtasks.exe PID 1476 wrote to memory of 2036 1476 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IM02409682420.pdf.scr"C:\Users\Admin\AppData\Local\Temp\IM02409682420.pdf.scr" /S1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" Update-do.i.vbe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\twgb\fvtum.pif"C:\Users\Admin\AppData\Local\Temp\twgb\fvtum.pif" xebp.mp33⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3F33.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp427E.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp3F33.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp427E.tmpFilesize
1KB
MD59df610a4811c98cb7fe4ef5e929f4498
SHA1014a42541c7f78cc715b7b4ebf52957334370842
SHA2563e70b8c0039e499fdb46c4630d8178cbb82b49bf09358ebedfeb5a9ccdade175
SHA5125180a43b8f88d33baf0c1634e59b56db5ca46396556d6c7fb11f05ac391a082d766a5693bdaf29d9deaf39733fe4445cc738d77f1df07eea51ec0b8b0084e4cd
-
C:\Users\Admin\AppData\Local\Temp\twgb\alimhh.dllFilesize
31KB
MD57a9c7f57757ad97e2117eef574e2358e
SHA14e4d93bd64b94f08ab507a462291c4dd91fbdd23
SHA2565491d9cf3673842e5fc06747e6e55ecaf93688210f52fd521611194e493d911b
SHA512bfae9e262d1d2df402fac4671b6ca5b5940cf16bc6c217c15f3b038b738f1645da9c163b452ebf89505fd36f2f5af44bad5fcefa3f8ed272c736be4ebf239d7d
-
C:\Users\Admin\AppData\Local\Temp\twgb\fvtum.pifFilesize
1.2MB
MD5044b14a71e0453cd74c513920fb61839
SHA17c693ddc0df7d100b2d7554365c5c4024851068b
SHA2566c6e082b6c56c06767d76288ad97a744f19ffd7d64d4cf03181ce6f76bdf4f8a
SHA5123807f6e044b2dcc980dae350a43390f04a18b3b71161213ab5d6ec94caef9f47d73a95a0f9063fe033a49147b836cc6af9f95f580aa67d40ee1cddcdf453850d
-
C:\Users\Admin\AppData\Local\Temp\twgb\fvtum.pifFilesize
1.2MB
MD5044b14a71e0453cd74c513920fb61839
SHA17c693ddc0df7d100b2d7554365c5c4024851068b
SHA2566c6e082b6c56c06767d76288ad97a744f19ffd7d64d4cf03181ce6f76bdf4f8a
SHA5123807f6e044b2dcc980dae350a43390f04a18b3b71161213ab5d6ec94caef9f47d73a95a0f9063fe033a49147b836cc6af9f95f580aa67d40ee1cddcdf453850d
-
C:\Users\Admin\AppData\Local\Temp\twgb\iunolw.tbhFilesize
397KB
MD547a3760694424f080062061971c9e2ae
SHA1107b8682b9322ee4886ade154c88c3cfebd24ae9
SHA2562a454fbe70bedf8e9df6bb9172fd14b941b675a3465a80bc9b0fe20b499ef4ad
SHA51231d92fc367c857fa71598fbb3346f292da574855d013a7cab0b5715eac80a7e2b37d863c92dcdb3b1ef34fc6e3529630460c9b23ba22e3d41e4553c5f3a3e655
-
C:\Users\Admin\AppData\Local\Temp\twgb\xebp.mp3Filesize
119.3MB
MD51f94df78514bad96140f41e156e5a138
SHA12fcb482db2b958f61046f334bec68af2d2a467dc
SHA2561b585a6ae27886db9014777c45bea8a072056db0a215bbd12e8ba5e5ce3f478f
SHA512ffca6190d92eb8abab51d4299d0ae37475b6749f404e04f50325e7d44c850a7f1015d3be5d6a90838be184434dbf7bde804fa2e8a786238db38378bdd99925be
-
C:\Users\Admin\AppData\Local\temp\twgb\Update-do.i.vbeFilesize
80KB
MD5681b715e18750d3be54efc53d100de5a
SHA192e6d8b2512a4d86dac46c0926709973d3b19457
SHA2561fc98f0579ecaec74db49efd3f3a199419588828676b811053d4d088e0483030
SHA512384f59a6bdaf7964b795cbfeb1cc04711e6e59753104e70a3b9c3805b5ed22565f448bfb119f619b0653caaf785f96495e14c36c557b02279ee69fbafa162f1e
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\twgb\fvtum.pifFilesize
1.2MB
MD5044b14a71e0453cd74c513920fb61839
SHA17c693ddc0df7d100b2d7554365c5c4024851068b
SHA2566c6e082b6c56c06767d76288ad97a744f19ffd7d64d4cf03181ce6f76bdf4f8a
SHA5123807f6e044b2dcc980dae350a43390f04a18b3b71161213ab5d6ec94caef9f47d73a95a0f9063fe033a49147b836cc6af9f95f580aa67d40ee1cddcdf453850d
-
memory/1476-145-0x0000000005270000-0x00000000052B0000-memory.dmpFilesize
256KB
-
memory/1476-152-0x0000000002360000-0x0000000002372000-memory.dmpFilesize
72KB
-
memory/1476-133-0x0000000000450000-0x00000000009F9000-memory.dmpFilesize
5.7MB
-
memory/1476-137-0x0000000000450000-0x000000000048A000-memory.dmpFilesize
232KB
-
memory/1476-130-0x0000000000450000-0x00000000009F9000-memory.dmpFilesize
5.7MB
-
memory/1476-129-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1476-128-0x0000000000450000-0x00000000009F9000-memory.dmpFilesize
5.7MB
-
memory/1476-146-0x0000000000340000-0x000000000034A000-memory.dmpFilesize
40KB
-
memory/1476-147-0x0000000002220000-0x000000000222C000-memory.dmpFilesize
48KB
-
memory/1476-148-0x0000000002230000-0x000000000224E000-memory.dmpFilesize
120KB
-
memory/1476-149-0x0000000002340000-0x000000000234A000-memory.dmpFilesize
40KB
-
memory/1476-135-0x0000000000450000-0x00000000009F9000-memory.dmpFilesize
5.7MB
-
memory/1476-153-0x0000000002440000-0x000000000245A000-memory.dmpFilesize
104KB
-
memory/1476-154-0x0000000002460000-0x000000000246E000-memory.dmpFilesize
56KB
-
memory/1476-155-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/1476-156-0x00000000024D0000-0x00000000024DE000-memory.dmpFilesize
56KB
-
memory/1476-157-0x00000000025E0000-0x00000000025EC000-memory.dmpFilesize
48KB
-
memory/1476-158-0x00000000025F0000-0x0000000002604000-memory.dmpFilesize
80KB
-
memory/1476-159-0x0000000002600000-0x0000000002610000-memory.dmpFilesize
64KB
-
memory/1476-160-0x0000000002610000-0x0000000002624000-memory.dmpFilesize
80KB
-
memory/1476-161-0x0000000004670000-0x000000000467E000-memory.dmpFilesize
56KB
-
memory/1476-162-0x00000000046E0000-0x000000000470E000-memory.dmpFilesize
184KB
-
memory/1476-163-0x0000000004690000-0x00000000046A4000-memory.dmpFilesize
80KB
-
memory/1476-165-0x0000000005270000-0x00000000052B0000-memory.dmpFilesize
256KB