Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows7_x64 -
resource
win7 -
submitted
24-06-2020 14:56
Static task
static1
Behavioral task
behavioral1
Sample
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe
Resource
win7
General
-
Target
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe
-
Size
1.3MB
-
MD5
27ff2f504a80e168edda11336c3f306a
-
SHA1
e28e2c1941d19c85726f5110e0078b6dcae783a0
-
SHA256
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d
-
SHA512
ee6b6ed0a37a05fa9cc92448f5bab047c849673479332bf6a2471004a6c450b4b5260ee9e0da2ca5c9d610ce944f2060fbad5e3a964a3c377c4c14a43d552b8c
Malware Config
Extracted
nanocore
1.2.2.0
79.134.225.22:7290
47d159c4-5098-4adc-b828-b6f8e655b5c4
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-01T13:23:42.048018236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7290
-
default_group
newkeys
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
47d159c4-5098-4adc-b828-b6f8e655b5c4
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
79.134.225.22
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1140 MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
MSBuild.exeb1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exepid process 1140 MSBuild.exe 1140 MSBuild.exe 1140 MSBuild.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe -
Drops file in Program Files directory 2 IoCs
Processes:
MSBuild.exedescription ioc process File created C:\Program Files (x86)\WAN Subsystem\wanss.exe MSBuild.exe File opened for modification C:\Program Files (x86)\WAN Subsystem\wanss.exe MSBuild.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1340 schtasks.exe 1552 schtasks.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exeMSBuild.exedescription pid process target process PID 1104 wrote to memory of 1140 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1104 wrote to memory of 1140 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1104 wrote to memory of 1140 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1104 wrote to memory of 1140 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1104 wrote to memory of 1140 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1104 wrote to memory of 1140 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1140 wrote to memory of 1340 1140 MSBuild.exe schtasks.exe PID 1140 wrote to memory of 1340 1140 MSBuild.exe schtasks.exe PID 1140 wrote to memory of 1340 1140 MSBuild.exe schtasks.exe PID 1140 wrote to memory of 1340 1140 MSBuild.exe schtasks.exe PID 1140 wrote to memory of 1552 1140 MSBuild.exe schtasks.exe PID 1140 wrote to memory of 1552 1140 MSBuild.exe schtasks.exe PID 1140 wrote to memory of 1552 1140 MSBuild.exe schtasks.exe PID 1140 wrote to memory of 1552 1140 MSBuild.exe schtasks.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exepid process 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exedescription pid process target process PID 1104 set thread context of 1140 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 1140 MSBuild.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Subsystem = "C:\\Program Files (x86)\\WAN Subsystem\\wanss.exe" MSBuild.exe -
Drops startup file 1 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bootsect.url b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe -
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exepid process 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1104 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe"C:\Users\Admin\AppData\Local\Temp\b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of SetThreadContext
- Drops startup file
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
- Adds Run entry to start application
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFF25.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp20.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp20.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmpFF25.tmp
-
memory/1140-0-0x0000000000080000-0x00000000000B8000-memory.dmpFilesize
224KB
-
memory/1140-1-0x000000000009E792-mapping.dmp
-
memory/1140-2-0x0000000000080000-0x00000000000B8000-memory.dmpFilesize
224KB
-
memory/1340-3-0x0000000000000000-mapping.dmp
-
memory/1552-5-0x0000000000000000-mapping.dmp