Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 12:10
Static task
static1
Behavioral task
behavioral1
Sample
DOCS-2366556-90767485-8755-PDF.exe
Resource
win7-20240220-en
General
-
Target
DOCS-2366556-90767485-8755-PDF.exe
-
Size
1.3MB
-
MD5
caf38730bc9ad3676f2c9dd88c104cf2
-
SHA1
6bef0e1e7b1f1072c95515a0b8c5266c790b665f
-
SHA256
7550a5bbf3edfe86c75adf06bc63de13e9219ef1f09cb86cb70c52c225852e50
-
SHA512
d0bdd2a3faa72f5b519e14e9d18f64140451827be23ff02ef9e9ba391f8a6b1df78fa98d1e276f789a336fe350a936b82199002bd0097c54b6568b12026fd107
-
SSDEEP
24576:tAHnh+eWsN3skA4RV1Hom2KXMmHarbwdtCdVHnRXUFh+Ypz5:Mh+ZkldoPK8YaM0zx2hv
Malware Config
Extracted
nanocore
1.2.2.0
yes.dnsabr.com:54985
c4a921fe-b6d3-4dc2-bcc3-394abf944589
-
activate_away_mode
true
-
backup_connection_host
yes.dnsabr.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-03-04T07:57:52.666055236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
54985
-
default_group
YABIAWA
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c4a921fe-b6d3-4dc2-bcc3-394abf944589
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
yes.dnsabr.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Drops startup file 1 IoCs
Processes:
DOCS-2366556-90767485-8755-PDF.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RecoveryDrive.url DOCS-2366556-90767485-8755-PDF.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Subsystem = "C:\\Program Files (x86)\\DPI Subsystem\\dpiss.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DOCS-2366556-90767485-8755-PDF.exedescription pid process target process PID 3572 set thread context of 3264 3572 DOCS-2366556-90767485-8755-PDF.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\DPI Subsystem\dpiss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DPI Subsystem\dpiss.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegSvcs.exepid process 3264 RegSvcs.exe 3264 RegSvcs.exe 3264 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 3264 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3264 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
DOCS-2366556-90767485-8755-PDF.exepid process 3572 DOCS-2366556-90767485-8755-PDF.exe 3572 DOCS-2366556-90767485-8755-PDF.exe 3572 DOCS-2366556-90767485-8755-PDF.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
DOCS-2366556-90767485-8755-PDF.exepid process 3572 DOCS-2366556-90767485-8755-PDF.exe 3572 DOCS-2366556-90767485-8755-PDF.exe 3572 DOCS-2366556-90767485-8755-PDF.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
DOCS-2366556-90767485-8755-PDF.exedescription pid process target process PID 3572 wrote to memory of 3264 3572 DOCS-2366556-90767485-8755-PDF.exe RegSvcs.exe PID 3572 wrote to memory of 3264 3572 DOCS-2366556-90767485-8755-PDF.exe RegSvcs.exe PID 3572 wrote to memory of 3264 3572 DOCS-2366556-90767485-8755-PDF.exe RegSvcs.exe PID 3572 wrote to memory of 3264 3572 DOCS-2366556-90767485-8755-PDF.exe RegSvcs.exe PID 3572 wrote to memory of 3264 3572 DOCS-2366556-90767485-8755-PDF.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOCS-2366556-90767485-8755-PDF.exe"C:\Users\Admin\AppData\Local\Temp\DOCS-2366556-90767485-8755-PDF.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3264-6-0x0000000000340000-0x0000000000378000-memory.dmpFilesize
224KB
-
memory/3264-11-0x0000000073F72000-0x0000000073F73000-memory.dmpFilesize
4KB
-
memory/3264-12-0x0000000073F70000-0x0000000074521000-memory.dmpFilesize
5.7MB
-
memory/3264-13-0x0000000073F70000-0x0000000074521000-memory.dmpFilesize
5.7MB
-
memory/3264-16-0x0000000073F70000-0x0000000074521000-memory.dmpFilesize
5.7MB
-
memory/3264-17-0x0000000073F72000-0x0000000073F73000-memory.dmpFilesize
4KB
-
memory/3264-18-0x0000000073F70000-0x0000000074521000-memory.dmpFilesize
5.7MB
-
memory/3264-19-0x0000000073F70000-0x0000000074521000-memory.dmpFilesize
5.7MB
-
memory/3572-5-0x0000000001040000-0x0000000001041000-memory.dmpFilesize
4KB