Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 16:22
Static task
static1
Behavioral task
behavioral1
Sample
Proforma invoice no.SWR-2021PI011-thailand.scr
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Proforma invoice no.SWR-2021PI011-thailand.scr
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Thailand-20211210-0837378-FGT-29.pdf
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Thailand-20211210-0837378-FGT-29.pdf
Resource
win10v2004-20240226-en
General
-
Target
Proforma invoice no.SWR-2021PI011-thailand.scr
-
Size
641KB
-
MD5
ddb4202e9c820a4abf3d8429410e299d
-
SHA1
be01ad74c6b2c4e70c69c8e1a02c0ea3098c690c
-
SHA256
2fe6ae2a3d5969fbaf2134c6f48c019bb4daff1d1f3c63a5c30fa1e380b6664f
-
SHA512
d450f5ff463da4e2bfac14e58c6749fd1b9632b9bc071df994594b26a9af13e030b33ef83002a20b8b6c667799ddefb31f7029220199f1d857f940504d5d1295
-
SSDEEP
12288:PfR8MkASBIXTfC+DVyrgMoZepxNCsHIeaDgwGnCSVfU+dYprLK:x8MaBroExNCsHIBDgRCSVfU+dYpr
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.75:97
75237636-ccfc-402a-827d-5ad01371659e
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-24T01:53:34.394429836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
97
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
75237636-ccfc-402a-827d-5ad01371659e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.140.53.75
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Proforma invoice no.SWR-2021PI011-thailand.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Proforma invoice no.SWR-2021PI011-thailand.scr -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Subsystem = "C:\\Program Files (x86)\\SMTP Subsystem\\smtpss.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proforma invoice no.SWR-2021PI011-thailand.scrdescription pid process target process PID 2212 set thread context of 1968 2212 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SMTP Subsystem\smtpss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SMTP Subsystem\smtpss.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1452 schtasks.exe 3376 schtasks.exe 2128 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Proforma invoice no.SWR-2021PI011-thailand.scrRegSvcs.exepowershell.exepid process 2212 Proforma invoice no.SWR-2021PI011-thailand.scr 2212 Proforma invoice no.SWR-2021PI011-thailand.scr 2212 Proforma invoice no.SWR-2021PI011-thailand.scr 2212 Proforma invoice no.SWR-2021PI011-thailand.scr 1968 RegSvcs.exe 1968 RegSvcs.exe 1968 RegSvcs.exe 1968 RegSvcs.exe 3716 powershell.exe 3716 powershell.exe 3716 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1968 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Proforma invoice no.SWR-2021PI011-thailand.scrRegSvcs.exepowershell.exedescription pid process Token: SeDebugPrivilege 2212 Proforma invoice no.SWR-2021PI011-thailand.scr Token: SeDebugPrivilege 1968 RegSvcs.exe Token: SeDebugPrivilege 3716 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Proforma invoice no.SWR-2021PI011-thailand.scrRegSvcs.exedescription pid process target process PID 2212 wrote to memory of 3716 2212 Proforma invoice no.SWR-2021PI011-thailand.scr powershell.exe PID 2212 wrote to memory of 3716 2212 Proforma invoice no.SWR-2021PI011-thailand.scr powershell.exe PID 2212 wrote to memory of 3716 2212 Proforma invoice no.SWR-2021PI011-thailand.scr powershell.exe PID 2212 wrote to memory of 3376 2212 Proforma invoice no.SWR-2021PI011-thailand.scr schtasks.exe PID 2212 wrote to memory of 3376 2212 Proforma invoice no.SWR-2021PI011-thailand.scr schtasks.exe PID 2212 wrote to memory of 3376 2212 Proforma invoice no.SWR-2021PI011-thailand.scr schtasks.exe PID 2212 wrote to memory of 1968 2212 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2212 wrote to memory of 1968 2212 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2212 wrote to memory of 1968 2212 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2212 wrote to memory of 1968 2212 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2212 wrote to memory of 1968 2212 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2212 wrote to memory of 1968 2212 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2212 wrote to memory of 1968 2212 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 2212 wrote to memory of 1968 2212 Proforma invoice no.SWR-2021PI011-thailand.scr RegSvcs.exe PID 1968 wrote to memory of 2128 1968 RegSvcs.exe schtasks.exe PID 1968 wrote to memory of 2128 1968 RegSvcs.exe schtasks.exe PID 1968 wrote to memory of 2128 1968 RegSvcs.exe schtasks.exe PID 1968 wrote to memory of 1452 1968 RegSvcs.exe schtasks.exe PID 1968 wrote to memory of 1452 1968 RegSvcs.exe schtasks.exe PID 1968 wrote to memory of 1452 1968 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proforma invoice no.SWR-2021PI011-thailand.scr"C:\Users\Admin\AppData\Local\Temp\Proforma invoice no.SWR-2021PI011-thailand.scr" /S1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Proforma invoice no.SWR-2021PI011-thailand.scr"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YpERQbIAzbRggg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB418.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBA71.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBB7C.tmp"3⤵
- Creates scheduled task(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dey4ojti.g4m.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpBA71.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmpBB7C.tmpFilesize
1KB
MD50339b45ef206f4becc88be0d65e24b9e
SHA16503a1851f4ccd8c80a31f96bd7ae40d962c9fad
SHA2563d568a47a8944a47f4aed6982755ac7ff7dda469cc1c81c213ecaa5d89de1f83
SHA512c98f4513db34d50510dd986e0d812545c442bd5bef26932032b165759627fab4e00c95fe907ab3416a8a1042bfa77aa516c479f1ff7d1ec2f21ae66df8f72551
-
memory/1968-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1968-11-0x00000000746D0000-0x0000000074C81000-memory.dmpFilesize
5.7MB
-
memory/1968-12-0x0000000000AB0000-0x0000000000AC0000-memory.dmpFilesize
64KB
-
memory/1968-13-0x00000000746D0000-0x0000000074C81000-memory.dmpFilesize
5.7MB
-
memory/1968-70-0x0000000000AB0000-0x0000000000AC0000-memory.dmpFilesize
64KB
-
memory/1968-62-0x0000000000AB0000-0x0000000000AC0000-memory.dmpFilesize
64KB
-
memory/1968-61-0x00000000746D0000-0x0000000074C81000-memory.dmpFilesize
5.7MB
-
memory/1968-26-0x0000000000AB0000-0x0000000000AC0000-memory.dmpFilesize
64KB
-
memory/2212-3-0x00000000746D0000-0x0000000074C81000-memory.dmpFilesize
5.7MB
-
memory/2212-14-0x00000000746D0000-0x0000000074C81000-memory.dmpFilesize
5.7MB
-
memory/2212-2-0x0000000001440000-0x0000000001450000-memory.dmpFilesize
64KB
-
memory/2212-0-0x00000000746D0000-0x0000000074C81000-memory.dmpFilesize
5.7MB
-
memory/2212-1-0x00000000746D0000-0x0000000074C81000-memory.dmpFilesize
5.7MB
-
memory/3716-39-0x0000000006410000-0x0000000006764000-memory.dmpFilesize
3.3MB
-
memory/3716-57-0x0000000007D10000-0x0000000007D2A000-memory.dmpFilesize
104KB
-
memory/3716-29-0x00000000063A0000-0x0000000006406000-memory.dmpFilesize
408KB
-
memory/3716-27-0x0000000005A20000-0x0000000005A42000-memory.dmpFilesize
136KB
-
memory/3716-22-0x0000000005D00000-0x0000000006328000-memory.dmpFilesize
6.2MB
-
memory/3716-40-0x0000000006A00000-0x0000000006A1E000-memory.dmpFilesize
120KB
-
memory/3716-41-0x0000000006E00000-0x0000000006E4C000-memory.dmpFilesize
304KB
-
memory/3716-42-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/3716-43-0x00000000079D0000-0x0000000007A02000-memory.dmpFilesize
200KB
-
memory/3716-44-0x0000000071B80000-0x0000000071BCC000-memory.dmpFilesize
304KB
-
memory/3716-54-0x0000000006FB0000-0x0000000006FCE000-memory.dmpFilesize
120KB
-
memory/3716-55-0x0000000007A10000-0x0000000007AB3000-memory.dmpFilesize
652KB
-
memory/3716-56-0x0000000008350000-0x00000000089CA000-memory.dmpFilesize
6.5MB
-
memory/3716-28-0x0000000006330000-0x0000000006396000-memory.dmpFilesize
408KB
-
memory/3716-58-0x0000000007D80000-0x0000000007D8A000-memory.dmpFilesize
40KB
-
memory/3716-59-0x0000000007FB0000-0x0000000008046000-memory.dmpFilesize
600KB
-
memory/3716-60-0x0000000007F30000-0x0000000007F41000-memory.dmpFilesize
68KB
-
memory/3716-17-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/3716-16-0x00000000030A0000-0x00000000030D6000-memory.dmpFilesize
216KB
-
memory/3716-63-0x0000000007F60000-0x0000000007F6E000-memory.dmpFilesize
56KB
-
memory/3716-64-0x0000000007F70000-0x0000000007F84000-memory.dmpFilesize
80KB
-
memory/3716-65-0x0000000008070000-0x000000000808A000-memory.dmpFilesize
104KB
-
memory/3716-66-0x0000000008050000-0x0000000008058000-memory.dmpFilesize
32KB
-
memory/3716-69-0x0000000071350000-0x0000000071B00000-memory.dmpFilesize
7.7MB
-
memory/3716-15-0x0000000071350000-0x0000000071B00000-memory.dmpFilesize
7.7MB