b4fc5b365d6ccb4dc726a82c8b3f1c39ce16bf848c779706569c938d1a6855a8

Analysis

max time kernel
134s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2025, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malware-sample-library-master/APT28 FancyBear/APT28,NATOPAPER,SOFACY2004.exe
Size

108KB
MD5

7f564a6a8910b513a851b2616af8d7ee
SHA1

aade2da992de07c233f4d2711cb4f046984a3783
SHA256

1de6d9db409bef73e3585fc08f98b30e2757ec87830e6f84ba85c39210aa962b
SHA512

9870a3ac7cd47458aa9f0a6afd9767d19460d93c9c2f20aa5fb2fe6a2ef0e2b7361e2a83d20cd91c105af34184fe3d582b5ce4200f0bea1e780481fe7928e252
SSDEEP

1536:DAo8qqfNrkdOoXL60J8s8FGBOO80+yldyVZR/HmD8TK0VGaxkGbANv:DAo8zuFjyFG8x0+ylc7RftTVGOkv

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysConnect = "{63f86307-2e08-4d70-919f-a10c0bbba97c}"	APT28,NATOPAPER,SOFACY2004.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	APT28,NATOPAPER,SOFACY2004.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winmgmt.dll	APT28,NATOPAPER,SOFACY2004.exe
File created	C:\Windows\SysWOW64\sysconnect.dll	APT28,NATOPAPER,SOFACY2004.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	APT28,NATOPAPER,SOFACY2004.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{63f86307-2e08-4d70-919f-a10c0bbba97c}\InProcServer32	APT28,NATOPAPER,SOFACY2004.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	APT28,NATOPAPER,SOFACY2004.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	APT28,NATOPAPER,SOFACY2004.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63f86307-2e08-4d70-919f-a10c0bbba97c}	APT28,NATOPAPER,SOFACY2004.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63f86307-2e08-4d70-919f-a10c0bbba97c}\InProcServer32	APT28,NATOPAPER,SOFACY2004.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63f86307-2e08-4d70-919f-a10c0bbba97c}\InProcServer32\ = "C:\\Windows\\SysWow64\\sysconnect.dll"	APT28,NATOPAPER,SOFACY2004.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63f86307-2e08-4d70-919f-a10c0bbba97c}\InProcServer32\ThreadingModel = "Apartment"	APT28,NATOPAPER,SOFACY2004.exe
Key created	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000_Classes\Local Settings	APT28,NATOPAPER,SOFACY2004.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1580	WINWORD.EXE
1580	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1580	WINWORD.EXE
1580	WINWORD.EXE
1580	WINWORD.EXE
1580	WINWORD.EXE
1580	WINWORD.EXE
1580	WINWORD.EXE
1580	WINWORD.EXE
1580	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1580	4604	APT28,NATOPAPER,SOFACY2004.exe	81
PID 4604 wrote to memory of 1580	4604	APT28,NATOPAPER,SOFACY2004.exe	81

C:\Users\Admin\AppData\Local\Temp\malware-sample-library-master\APT28 FancyBear\APT28,NATOPAPER,SOFACY2004.exe
"C:\Users\Admin\AppData\Local\Temp\malware-sample-library-master\APT28 FancyBear\APT28,NATOPAPER,SOFACY2004.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\NATO.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NATO.doc

Filesize
54KB

MD5
fd34f554ee16947045ef7aecc6d8a6ae

SHA1
8b424ff7bfdb326c73bc0231c9329e4eccc5cb1b

SHA256
e14998cd3efa380d8e042f33e08ca42934e8e04c6f346a2b560830e4ed26ebf2

SHA512
0ddb0594a5412564a6901241aa27dfd3f97e96f3b2154a5daa1874155e9877fc25dd91c18da09d0667b927481b2090278da04b334214749b6b59eb231ff27d50

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
5f997f32d2073f6d7b4542343bce1362

SHA1
689de34c262eb890db642aabac2dfcd5e83ac200

SHA256
82946a3d8f21a8950c07d59065b37a63ab67929087afde6a13524836aeaa3afa

SHA512
1885ab63220ccea72234ffbc432072a632033a54e4e582aef2dcff25cd5fd9a8a95faa8b22e8e887b79fbcda079ae1a5add7cd90c327a258bc4ecde71c7f0f2e

Download Submit
memory/1580-28-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-32-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-14-0x00007FFCAFA30000-0x00007FFCAFA40000-memory.dmp

Filesize
64KB

Download
memory/1580-15-0x00007FFCAFA30000-0x00007FFCAFA40000-memory.dmp

Filesize
64KB

Download
memory/1580-16-0x00007FFCAD370000-0x00007FFCAD380000-memory.dmp

Filesize
64KB

Download
memory/1580-17-0x00007FFCAD370000-0x00007FFCAD380000-memory.dmp

Filesize
64KB

Download
memory/1580-20-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-21-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-24-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-26-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-29-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-12-0x00007FFCAFA30000-0x00007FFCAFA40000-memory.dmp

Filesize
64KB

Download
memory/1580-30-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-13-0x00007FFCAFA30000-0x00007FFCAFA40000-memory.dmp

Filesize
64KB

Download
memory/1580-31-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-25-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-23-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-22-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-19-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-18-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-11-0x00007FFCEFA4D000-0x00007FFCEFA4E000-memory.dmp

Filesize
4KB

Download
memory/1580-46-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-47-0x00007FFCEFA4D000-0x00007FFCEFA4E000-memory.dmp

Filesize
4KB

Download
memory/1580-48-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1580-10-0x00007FFCAFA30000-0x00007FFCAFA40000-memory.dmp

Filesize
64KB

Download
memory/1580-54-0x00007FFCEF9B0000-0x00007FFCEFBA5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads