Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
24-06-2020 14:56
Static task
static1
Behavioral task
behavioral1
Sample
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe
Resource
win7
General
-
Target
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe
-
Size
1.3MB
-
MD5
27ff2f504a80e168edda11336c3f306a
-
SHA1
e28e2c1941d19c85726f5110e0078b6dcae783a0
-
SHA256
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d
-
SHA512
ee6b6ed0a37a05fa9cc92448f5bab047c849673479332bf6a2471004a6c450b4b5260ee9e0da2ca5c9d610ce944f2060fbad5e3a964a3c377c4c14a43d552b8c
Malware Config
Extracted
nanocore
1.2.2.0
79.134.225.22:7290
47d159c4-5098-4adc-b828-b6f8e655b5c4
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-01T13:23:42.048018236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7290
-
default_group
newkeys
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
47d159c4-5098-4adc-b828-b6f8e655b5c4
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
79.134.225.22
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Manager = "C:\\Program Files (x86)\\SCSI Manager\\scsimgr.exe" MSBuild.exe -
Drops startup file 1 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bootsect.url b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exeMSBuild.exepid process 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 3792 MSBuild.exe 3792 MSBuild.exe 3792 MSBuild.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 3792 MSBuild.exe -
Drops file in Program Files directory 2 IoCs
Processes:
MSBuild.exedescription ioc process File created C:\Program Files (x86)\SCSI Manager\scsimgr.exe MSBuild.exe File opened for modification C:\Program Files (x86)\SCSI Manager\scsimgr.exe MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 3792 MSBuild.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2460 schtasks.exe 2796 schtasks.exe -
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exepid process 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exepid process 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exeMSBuild.exedescription pid process target process PID 1732 wrote to memory of 3792 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1732 wrote to memory of 3792 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1732 wrote to memory of 3792 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1732 wrote to memory of 3792 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 1732 wrote to memory of 3792 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe PID 3792 wrote to memory of 2460 3792 MSBuild.exe schtasks.exe PID 3792 wrote to memory of 2460 3792 MSBuild.exe schtasks.exe PID 3792 wrote to memory of 2460 3792 MSBuild.exe schtasks.exe PID 3792 wrote to memory of 2796 3792 MSBuild.exe schtasks.exe PID 3792 wrote to memory of 2796 3792 MSBuild.exe schtasks.exe PID 3792 wrote to memory of 2796 3792 MSBuild.exe schtasks.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exedescription pid process target process PID 1732 set thread context of 3792 1732 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe"C:\Users\Admin\AppData\Local\Temp\b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp10EE.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp161F.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp10EE.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmp161F.tmp
-
memory/2460-2-0x0000000000000000-mapping.dmp
-
memory/2796-4-0x0000000000000000-mapping.dmp
-
memory/3792-0-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3792-1-0x000000000041E792-mapping.dmp