Analysis
-
max time kernel
119s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 06:51
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_PO_091232.rtf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
RFQ_PO_091232.rtf
Resource
win10v2004-20241007-en
General
-
Target
RFQ_PO_091232.rtf
-
Size
825KB
-
MD5
666036634de5de5ff28819cec19299f3
-
SHA1
4cb3fb08d6a173e1526f48d1d4237c29f9a49f5f
-
SHA256
ff221c26a6ad233a179ede24b8156649e2e4338af867571943a2f114650bffa2
-
SHA512
6f8ede92bcc457c2bc07f3ad15a33799d288b4eb6d56f1b8b44517c36373d35a4fe1e4804e90f5069ccfa400731cd172997ac23a154cbf3640fe5da355fb8eac
-
SSDEEP
6144:HcwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAjjFkYwsQ+jGnThT:2
Malware Config
Extracted
nanocore
1.2.2.0
66.63.187.113:1664
a376f716-2f77-4943-a431-3a3bcb53b7c0
-
activate_away_mode
true
-
backup_connection_host
66.63.187.113
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-08-05T03:49:33.827385136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1664
-
default_group
CAT
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
a376f716-2f77-4943-a431-3a3bcb53b7c0
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
66.63.187.113
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2872 EQNEDT32.EXE -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2192 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 2648 jequduhalcat.exe 1932 jequduhalcat.exe -
Loads dropped DLL 1 IoCs
pid Process 2872 EQNEDT32.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PCI Manager = "C:\\Program Files (x86)\\PCI Manager\\pcimgr.exe" jequduhalcat.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jequduhalcat.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2648 set thread context of 1932 2648 jequduhalcat.exe 36 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\PCI Manager\pcimgr.exe jequduhalcat.exe File opened for modification C:\Program Files (x86)\PCI Manager\pcimgr.exe jequduhalcat.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQNEDT32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jequduhalcat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jequduhalcat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 2872 EQNEDT32.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2424 schtasks.exe 1700 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2380 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1932 jequduhalcat.exe 1932 jequduhalcat.exe 1932 jequduhalcat.exe 2192 powershell.exe 1932 jequduhalcat.exe 1932 jequduhalcat.exe 1932 jequduhalcat.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1932 jequduhalcat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1932 jequduhalcat.exe Token: SeDebugPrivilege 2192 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2380 WINWORD.EXE 2380 WINWORD.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2648 2872 EQNEDT32.EXE 31 PID 2872 wrote to memory of 2648 2872 EQNEDT32.EXE 31 PID 2872 wrote to memory of 2648 2872 EQNEDT32.EXE 31 PID 2872 wrote to memory of 2648 2872 EQNEDT32.EXE 31 PID 2380 wrote to memory of 1260 2380 WINWORD.EXE 33 PID 2380 wrote to memory of 1260 2380 WINWORD.EXE 33 PID 2380 wrote to memory of 1260 2380 WINWORD.EXE 33 PID 2380 wrote to memory of 1260 2380 WINWORD.EXE 33 PID 2648 wrote to memory of 2192 2648 jequduhalcat.exe 34 PID 2648 wrote to memory of 2192 2648 jequduhalcat.exe 34 PID 2648 wrote to memory of 2192 2648 jequduhalcat.exe 34 PID 2648 wrote to memory of 2192 2648 jequduhalcat.exe 34 PID 2648 wrote to memory of 1932 2648 jequduhalcat.exe 36 PID 2648 wrote to memory of 1932 2648 jequduhalcat.exe 36 PID 2648 wrote to memory of 1932 2648 jequduhalcat.exe 36 PID 2648 wrote to memory of 1932 2648 jequduhalcat.exe 36 PID 2648 wrote to memory of 1932 2648 jequduhalcat.exe 36 PID 2648 wrote to memory of 1932 2648 jequduhalcat.exe 36 PID 2648 wrote to memory of 1932 2648 jequduhalcat.exe 36 PID 2648 wrote to memory of 1932 2648 jequduhalcat.exe 36 PID 2648 wrote to memory of 1932 2648 jequduhalcat.exe 36 PID 1932 wrote to memory of 2424 1932 jequduhalcat.exe 37 PID 1932 wrote to memory of 2424 1932 jequduhalcat.exe 37 PID 1932 wrote to memory of 2424 1932 jequduhalcat.exe 37 PID 1932 wrote to memory of 2424 1932 jequduhalcat.exe 37 PID 1932 wrote to memory of 1700 1932 jequduhalcat.exe 39 PID 1932 wrote to memory of 1700 1932 jequduhalcat.exe 39 PID 1932 wrote to memory of 1700 1932 jequduhalcat.exe 39 PID 1932 wrote to memory of 1700 1932 jequduhalcat.exe 39
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RFQ_PO_091232.rtf"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1260
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Roaming\jequduhalcat.exe"C:\Users\Admin\AppData\Roaming\jequduhalcat.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jequduhalcat.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
C:\Users\Admin\AppData\Roaming\jequduhalcat.exe"C:\Users\Admin\AppData\Roaming\jequduhalcat.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp787A.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2424
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7927.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1700
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Exploitation for Client Execution
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bd591eebe11d193e29c078323f5b9b8b
SHA16a093fab046422f4b4501a6db734ec6f9dabf299
SHA2560ac67ad4c63b9736d0c07363874a11a1aa6038dbfc757b373e992c48b82ff7c7
SHA51249045eacf3f2f676bd76c9db9ace132a35c093dad1fb4bdb1d7f04a87220fe1197472244b8b1bce705d2acf5de4f35a9c80bbe8b000f7cb5c5c74de536e70b51
-
Filesize
1KB
MD5da7aec92f4b1e721f6eeccec52db4901
SHA1e1bc32c2277c42aec2356f6242ee427af53c2a52
SHA2567bcfd205f07bffa61c788644c1d6639d03126c46fdbd6550f7e21795dc78b3c0
SHA512340e234cdfb1b327369378131629f0ff5538c6a1c578c59bfc1b66442ff3f5793f119db13b8d3f158969071eb0fc0c7fbe5c79094572fac0cea528489bf11720
-
Filesize
767KB
MD51ee4aca2ed3fbc7d17f8a86c751c1cc2
SHA179fdfd56292f04c800afaa837b445e780355f3fb
SHA256a920dfb486d57b7d60d6bad4643d4f425802ce9ac8c520f9771d6689b65ffe80
SHA5122aa63b5a446b06d0e1149935ab3ea4803d797355ae4ac092abd5c3e7395bc9bb1dcd56f4489b144bffea42c916f9b22be250a09fd22634ba8de04a054cb7a910