Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-03-2023 13:15
Static task
static1
Behavioral task
behavioral1
Sample
IMG_005904564000.pdf.scr
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
IMG_005904564000.pdf.scr
Resource
win7-20230220-en
General
-
Target
IMG_005904564000.pdf.scr
-
Size
1.1MB
-
MD5
a93ffd1a1e580fd21f01cd6751fa484e
-
SHA1
fe21d5e2acef0a23441370b8aafa0efe236a44d1
-
SHA256
1d0b1b40c071c1e9faade95ef7bcf471b6c98a25f262894aaebe63a5e43ec71a
-
SHA512
aa13d56ce06107dde34760c55e1b55909f0e1bb6528b6ae5cade1e9a572aa3b05285885ecbccdbaafcc193f691ca1ed8de97255d6a9e044dfc2ef91bb43b7915
-
SSDEEP
24576:lTbBv5rUaUUUUUJUUUUUUJD3pvm6tPw4coiuxF8WZQ6k+5zUMeJf:PBLUUUUUJUUUUUUF3pvFcoiydqwFUMYf
Malware Config
Extracted
nanocore
1.2.2.0
december2n.duckdns.org:40111
december2nd.ddns.net:40111
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
activate_away_mode
false
-
backup_connection_host
december2nd.ddns.net
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-11-26T05:13:34.059050336Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
40111
-
default_group
mama
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
december2n.duckdns.org
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
lmtecwqo.pifRegSvcs.exepid process 636 lmtecwqo.pif 1716 RegSvcs.exe -
Loads dropped DLL 2 IoCs
Processes:
wscript.exelmtecwqo.pifpid process 612 wscript.exe 636 lmtecwqo.pif -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
lmtecwqo.pifRegSvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run lmtecwqo.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hgmk\\lmtecwqo.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\hgmk\\wictuh.icm" lmtecwqo.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hgmk\\Update.vbs" lmtecwqo.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisv.exe" RegSvcs.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lmtecwqo.pifdescription pid process target process PID 636 set thread context of 1716 636 lmtecwqo.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisv.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1296 schtasks.exe 1756 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 1716 RegSvcs.exe 1716 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1716 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1716 RegSvcs.exe Token: SeDebugPrivilege 1716 RegSvcs.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
IMG_005904564000.pdf.scrwscript.exelmtecwqo.pifRegSvcs.exedescription pid process target process PID 1324 wrote to memory of 612 1324 IMG_005904564000.pdf.scr wscript.exe PID 1324 wrote to memory of 612 1324 IMG_005904564000.pdf.scr wscript.exe PID 1324 wrote to memory of 612 1324 IMG_005904564000.pdf.scr wscript.exe PID 1324 wrote to memory of 612 1324 IMG_005904564000.pdf.scr wscript.exe PID 612 wrote to memory of 636 612 wscript.exe lmtecwqo.pif PID 612 wrote to memory of 636 612 wscript.exe lmtecwqo.pif PID 612 wrote to memory of 636 612 wscript.exe lmtecwqo.pif PID 612 wrote to memory of 636 612 wscript.exe lmtecwqo.pif PID 612 wrote to memory of 636 612 wscript.exe lmtecwqo.pif PID 612 wrote to memory of 636 612 wscript.exe lmtecwqo.pif PID 612 wrote to memory of 636 612 wscript.exe lmtecwqo.pif PID 636 wrote to memory of 1716 636 lmtecwqo.pif RegSvcs.exe PID 636 wrote to memory of 1716 636 lmtecwqo.pif RegSvcs.exe PID 636 wrote to memory of 1716 636 lmtecwqo.pif RegSvcs.exe PID 636 wrote to memory of 1716 636 lmtecwqo.pif RegSvcs.exe PID 636 wrote to memory of 1716 636 lmtecwqo.pif RegSvcs.exe PID 636 wrote to memory of 1716 636 lmtecwqo.pif RegSvcs.exe PID 636 wrote to memory of 1716 636 lmtecwqo.pif RegSvcs.exe PID 636 wrote to memory of 1716 636 lmtecwqo.pif RegSvcs.exe PID 636 wrote to memory of 1716 636 lmtecwqo.pif RegSvcs.exe PID 1716 wrote to memory of 1296 1716 RegSvcs.exe schtasks.exe PID 1716 wrote to memory of 1296 1716 RegSvcs.exe schtasks.exe PID 1716 wrote to memory of 1296 1716 RegSvcs.exe schtasks.exe PID 1716 wrote to memory of 1296 1716 RegSvcs.exe schtasks.exe PID 1716 wrote to memory of 1756 1716 RegSvcs.exe schtasks.exe PID 1716 wrote to memory of 1756 1716 RegSvcs.exe schtasks.exe PID 1716 wrote to memory of 1756 1716 RegSvcs.exe schtasks.exe PID 1716 wrote to memory of 1756 1716 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_005904564000.pdf.scr"C:\Users\Admin\AppData\Local\Temp\IMG_005904564000.pdf.scr" /S1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" Update-tb.t.vbe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hgmk\lmtecwqo.pif"C:\Users\Admin\AppData\Local\Temp\hgmk\lmtecwqo.pif" wictuh.icm3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4220.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp450E.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\hgmk\javkwma.binFilesize
36KB
MD5fba9fa136eb3ee633010d6e1a0876c19
SHA113e5595208ea1a90b33106571cb3ba5635bf1f14
SHA25663e89643afeba15b641600bbb1d0b709d49d2f8c0a3e188b2b45de987faea023
SHA51262a0d0ce5b3482ab72be9f1518ab05d8511557fb98ea8ee00a550522aa9ff9387ee8754b60178c857b19137a47fef468150c52ea56b146823cbae513ea53752e
-
C:\Users\Admin\AppData\Local\Temp\hgmk\lmoi.mxfFilesize
397KB
MD547a3760694424f080062061971c9e2ae
SHA1107b8682b9322ee4886ade154c88c3cfebd24ae9
SHA2562a454fbe70bedf8e9df6bb9172fd14b941b675a3465a80bc9b0fe20b499ef4ad
SHA51231d92fc367c857fa71598fbb3346f292da574855d013a7cab0b5715eac80a7e2b37d863c92dcdb3b1ef34fc6e3529630460c9b23ba22e3d41e4553c5f3a3e655
-
C:\Users\Admin\AppData\Local\Temp\hgmk\lmtecwqo.pifFilesize
1.1MB
MD54157c8447c088672662e6dc50079e7d8
SHA1d7e97005f9ebf2d9244c71eec90dae5db1a06e69
SHA256bd5b031272dea004a334994d75ebb257c68cf40243e797c3e847e7fe87393b81
SHA512f67e17a1ddfaf35e0deaee25ed6f127fe3eb140ee0f327780655784835bc18dfc82b148e6dcdd740668e621e0cf917cef27b052fcd95df97f68f0560ba559527
-
C:\Users\Admin\AppData\Local\Temp\hgmk\lmtecwqo.pifFilesize
1.1MB
MD54157c8447c088672662e6dc50079e7d8
SHA1d7e97005f9ebf2d9244c71eec90dae5db1a06e69
SHA256bd5b031272dea004a334994d75ebb257c68cf40243e797c3e847e7fe87393b81
SHA512f67e17a1ddfaf35e0deaee25ed6f127fe3eb140ee0f327780655784835bc18dfc82b148e6dcdd740668e621e0cf917cef27b052fcd95df97f68f0560ba559527
-
C:\Users\Admin\AppData\Local\Temp\hgmk\wictuh.icmFilesize
89.7MB
MD5656d183d6a5089e7a979925e163188ae
SHA139d38be4f45bf8be0a24f291cce941caf397a2c7
SHA2565c785d181a89e05f559208ab971845517f33234dfd0f27d3584fd1bc2b505739
SHA512896baf6ca3a3018dba20b5c0e98e10a1c3bc797fcc9d0bae20bd8698fdc7a702c187081076ef9ca9e71358f4324b214d00273b665ac6d7ee5ba1ac2e364f0795
-
C:\Users\Admin\AppData\Local\Temp\tmp4220.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp450E.tmpFilesize
1KB
MD59df610a4811c98cb7fe4ef5e929f4498
SHA1014a42541c7f78cc715b7b4ebf52957334370842
SHA2563e70b8c0039e499fdb46c4630d8178cbb82b49bf09358ebedfeb5a9ccdade175
SHA5125180a43b8f88d33baf0c1634e59b56db5ca46396556d6c7fb11f05ac391a082d766a5693bdaf29d9deaf39733fe4445cc738d77f1df07eea51ec0b8b0084e4cd
-
C:\Users\Admin\AppData\Local\temp\hgmk\Update-tb.t.vbeFilesize
53KB
MD55b00fcce82d9a11427f01283a1bda93d
SHA1a048992545305eaee3b9edcc74fd973494b061a9
SHA2560b5bd27fb7eef72a52c340477447140cd43357605dd39db1d7d01914b2ae1a82
SHA5128dd0b00f79b6aff359c531b785c59cdeec25f3390f2ea352c09e0b7a197497a6af00910922bfc7fde3028659cb99e7fdede9ad318be7f72b657b6f857bdbcd39
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\hgmk\lmtecwqo.pifFilesize
1.1MB
MD54157c8447c088672662e6dc50079e7d8
SHA1d7e97005f9ebf2d9244c71eec90dae5db1a06e69
SHA256bd5b031272dea004a334994d75ebb257c68cf40243e797c3e847e7fe87393b81
SHA512f67e17a1ddfaf35e0deaee25ed6f127fe3eb140ee0f327780655784835bc18dfc82b148e6dcdd740668e621e0cf917cef27b052fcd95df97f68f0560ba559527
-
memory/1716-139-0x0000000000440000-0x00000000009FC000-memory.dmpFilesize
5.7MB
-
memory/1716-141-0x0000000000440000-0x00000000009FC000-memory.dmpFilesize
5.7MB
-
memory/1716-135-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1716-143-0x0000000000440000-0x000000000047A000-memory.dmpFilesize
232KB
-
memory/1716-144-0x0000000004D60000-0x0000000004DA0000-memory.dmpFilesize
256KB
-
memory/1716-134-0x0000000000440000-0x00000000009FC000-memory.dmpFilesize
5.7MB
-
memory/1716-136-0x0000000000440000-0x00000000009FC000-memory.dmpFilesize
5.7MB
-
memory/1716-152-0x0000000000C10000-0x0000000000C1A000-memory.dmpFilesize
40KB
-
memory/1716-153-0x0000000000C20000-0x0000000000C2C000-memory.dmpFilesize
48KB
-
memory/1716-154-0x0000000000C70000-0x0000000000C8E000-memory.dmpFilesize
120KB
-
memory/1716-155-0x0000000000CE0000-0x0000000000CEA000-memory.dmpFilesize
40KB
-
memory/1716-156-0x0000000004D60000-0x0000000004DA0000-memory.dmpFilesize
256KB