Analysis
-
max time kernel
83s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12-12-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe
Resource
win7-20240729-en
General
-
Target
COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe
-
Size
1.0MB
-
MD5
b3d29fb2f6ee5fa0ce6e777eed56d420
-
SHA1
6ebd26c9ae4a12e76699682a99b7e47c591481ff
-
SHA256
a9b8879292fbf7bd63b7880cf9e1084040aa1c9adaf0b0f2d05e721696aae161
-
SHA512
3780cf7a0f339f673735ab847a36abc91aa5b3e1d63c7ab18a29507a0384018f2d0dcd62ebea4beb559d73173f763897517a567a27595743532129e26b8b8956
-
SSDEEP
24576:ou6J33O0c+JY5UZ+XC0kGso6FauUAGhCtti4n0WY:Cu0c++OCvkGs9FauNBttLXY
Malware Config
Extracted
nanocore
1.2.2.0
192.177.111.65:7090
3ddebdae-a1f4-41b3-9606-ade5cb2cec4c
-
activate_away_mode
true
-
backup_connection_host
192.177.111.65
-
backup_dns_server
192.177.111.65
-
buffer_size
65535
-
build_time
2024-09-21T08:21:20.013878636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7090
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
3ddebdae-a1f4-41b3-9606-ade5cb2cec4c
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
192.177.111.65
-
primary_dns_server
192.177.111.65
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PCI Service = "C:\\Program Files (x86)\\PCI Service\\pcisv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2116 set thread context of 2072 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 29 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\PCI Service\pcisv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\PCI Service\pcisv.exe RegSvcs.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2852 schtasks.exe 2064 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2072 RegSvcs.exe 2072 RegSvcs.exe 2072 RegSvcs.exe 2072 RegSvcs.exe 2072 RegSvcs.exe 2072 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2072 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2072 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2072 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 29 PID 2116 wrote to memory of 2072 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 29 PID 2116 wrote to memory of 2072 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 29 PID 2116 wrote to memory of 2072 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 29 PID 2116 wrote to memory of 2072 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 29 PID 2116 wrote to memory of 2072 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 29 PID 2116 wrote to memory of 2072 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 29 PID 2116 wrote to memory of 2072 2116 COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe 29 PID 2072 wrote to memory of 2852 2072 RegSvcs.exe 30 PID 2072 wrote to memory of 2852 2072 RegSvcs.exe 30 PID 2072 wrote to memory of 2852 2072 RegSvcs.exe 30 PID 2072 wrote to memory of 2852 2072 RegSvcs.exe 30 PID 2072 wrote to memory of 2064 2072 RegSvcs.exe 32 PID 2072 wrote to memory of 2064 2072 RegSvcs.exe 32 PID 2072 wrote to memory of 2064 2072 RegSvcs.exe 32 PID 2072 wrote to memory of 2064 2072 RegSvcs.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe"C:\Users\Admin\AppData\Local\Temp\COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\COMMERCIAL INVOICE AND DHL WEB TRACKING DETAI.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEA1.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2852
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF3E.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2064
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
203KB
MD5c7ffd1e38d28f553bea2faf8df2dadfe
SHA1689336226ca2a224d58df97cad0150eef09d7296
SHA256710cc40bf10d7a602e604243b9d22b00e443bac3ff2e6f767ef56258f92fed30
SHA5122a47ebb8927b84c94075ccacb8afed7b27d37a3e4d737c014a3a3cce502e0b549c44950b13605ccccaf6e50c35df608bdaf3fa336945a7bd0f40bc8cb0564a03
-
Filesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
Filesize
1KB
MD5bbb0d424bb7cb3b0e6aeb68cf82b8f5f
SHA17e95dcd21a27ee53e5c23ed5a163df56a43d572a
SHA25608d6bee474edf0151a0d8ff942ba9e6a1efe069585c63477abd1c7bd8046e130
SHA5120dc790a415f9717f6e7633c1d5f2749a2eca5582c5bbe114119c3ddba6d4e4d0df48029622e2fe07f94d8ae97c334b88691b7721da50ada261449769ae31d466