Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 16:22
Static task
static1
Behavioral task
behavioral1
Sample
Proforma invoice no.SWR-2021PI011-thailand.scr
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Proforma invoice no.SWR-2021PI011-thailand.scr
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Thailand-20211210-0837378-FGT-29.pdf
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Thailand-20211210-0837378-FGT-29.pdf
Resource
win10v2004-20240226-en
General
-
Target
Proforma invoice no.SWR-2021PI011-thailand.scr
-
Size
641KB
-
MD5
ddb4202e9c820a4abf3d8429410e299d
-
SHA1
be01ad74c6b2c4e70c69c8e1a02c0ea3098c690c
-
SHA256
2fe6ae2a3d5969fbaf2134c6f48c019bb4daff1d1f3c63a5c30fa1e380b6664f
-
SHA512
d450f5ff463da4e2bfac14e58c6749fd1b9632b9bc071df994594b26a9af13e030b33ef83002a20b8b6c667799ddefb31f7029220199f1d857f940504d5d1295
-
SSDEEP
12288:PfR8MkASBIXTfC+DVyrgMoZepxNCsHIeaDgwGnCSVfU+dYprLK:x8MaBroExNCsHIBDgRCSVfU+dYpr
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.75:97
75237636-ccfc-402a-827d-5ad01371659e
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-24T01:53:34.394429836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
97
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
75237636-ccfc-402a-827d-5ad01371659e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.140.53.75
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proforma invoice no.SWR-2021PI011-thailand.scrdescription pid process target process PID 2184 set thread context of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\TCP Service\tcpsv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\TCP Service\tcpsv.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2928 schtasks.exe 2852 schtasks.exe 2764 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Proforma invoice no.SWR-2021PI011-thailand.scrpowershell.exeRegSvcs.exepid process 2184 Proforma invoice no.SWR-2021PI011-thailand.scr 2184 Proforma invoice no.SWR-2021PI011-thailand.scr 2932 powershell.exe 2784 RegSvcs.exe 2784 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2784 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Proforma invoice no.SWR-2021PI011-thailand.scrpowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2184 Proforma invoice no.SWR-2021PI011-thailand.scr Token: SeDebugPrivilege 2932 powershell.exe Token: SeDebugPrivilege 2784 RegSvcs.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Proforma invoice no.SWR-2021PI011-thailand.scrRegSvcs.exedescription pid process target process PID 2184 wrote to memory of 2932 2184 Proforma invoice no.SWR-2021PI011-thailand.scr powershell.exe PID 2184 wrote to memory of 2932 2184 Proforma invoice no.SWR-2021PI011-thailand.scr powershell.exe PID 2184 wrote to memory of 2932 2184 Proforma invoice no.SWR-2021PI011-thailand.scr powershell.exe PID 2184 wrote to memory of 2932 2184 Proforma invoice no.SWR-2021PI011-thailand.scr powershell.exe PID 2184 wrote to memory of 2928 2184 Proforma invoice no.SWR-2021PI011-thailand.scr schtasks.exe PID 2184 wrote to memory of 2928 2184 Proforma invoice no.SWR-2021PI011-thailand.scr schtasks.exe PID 2184 wrote to memory of 2928 2184 Proforma invoice no.SWR-2021PI011-thailand.scr schtasks.exe PID 2184 wrote to memory of 2928 2184 Proforma invoice no.SWR-2021PI011-thailand.scr schtasks.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2184 wrote to memory of 2784 2184 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2784 wrote to memory of 2852 2784 RegSvcs.exe schtasks.exe PID 2784 wrote to memory of 2852 2784 RegSvcs.exe schtasks.exe PID 2784 wrote to memory of 2852 2784 RegSvcs.exe schtasks.exe PID 2784 wrote to memory of 2852 2784 RegSvcs.exe schtasks.exe PID 2784 wrote to memory of 2764 2784 RegSvcs.exe schtasks.exe PID 2784 wrote to memory of 2764 2784 RegSvcs.exe schtasks.exe PID 2784 wrote to memory of 2764 2784 RegSvcs.exe schtasks.exe PID 2784 wrote to memory of 2764 2784 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proforma invoice no.SWR-2021PI011-thailand.scr"C:\Users\Admin\AppData\Local\Temp\Proforma invoice no.SWR-2021PI011-thailand.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Proforma invoice no.SWR-2021PI011-thailand.scr"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YpERQbIAzbRggg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA554.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA63E.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA6AC.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA63E.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmpA6AC.tmpFilesize
1KB
MD593fc3117767507c9889abd12dc667d22
SHA11096e4cfa0c35756e3c3fb866c1e4c1e59115df9
SHA256684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a
SHA512e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc
-
memory/2184-30-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB
-
memory/2184-2-0x00000000022E0000-0x0000000002320000-memory.dmpFilesize
256KB
-
memory/2184-1-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB
-
memory/2184-3-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB
-
memory/2184-4-0x00000000022E0000-0x0000000002320000-memory.dmpFilesize
256KB
-
memory/2184-5-0x00000000022E0000-0x0000000002320000-memory.dmpFilesize
256KB
-
memory/2184-0-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB
-
memory/2784-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2784-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2784-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2784-23-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2784-25-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2784-26-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB
-
memory/2784-27-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB
-
memory/2784-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2784-31-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB
-
memory/2784-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2784-45-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB
-
memory/2784-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2784-44-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB
-
memory/2784-43-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB
-
memory/2932-42-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB
-
memory/2932-41-0x00000000001F0000-0x0000000000230000-memory.dmpFilesize
256KB
-
memory/2932-40-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB
-
memory/2932-36-0x0000000074C80000-0x000000007522B000-memory.dmpFilesize
5.7MB