Analysis
-
max time kernel
115s -
max time network
154s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 15:06
Static task
static1
Behavioral task
behavioral1
Sample
SCAN_DOCUMENT.exe
Resource
win7
General
-
Target
SCAN_DOCUMENT.exe
-
Size
830KB
-
MD5
ea9139664e5a3182dbafcdc476785de1
-
SHA1
99c7d0ad63c2bca8bb61dbc4fa65c01dfad9cce4
-
SHA256
2fd9f9784c8b9678b08dcb94886985fa7835d0135ea12689082e0bf604c19bbb
-
SHA512
c919c173ed1ce5c7acb9e9873b0b70e481934533a9dbd9414dafacb9acd977809536ec993bc7a31792a2df861b6e1d1d190a832d8926f0cc2096fe4257187fb8
Malware Config
Extracted
nanocore
1.2.2.0
frank3000.ddns.net:4983
53dd63cb-dcb6-4eb8-bea2-1c572110bc62
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-10T23:12:52.316007036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
4983
-
default_group
Frank
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
53dd63cb-dcb6-4eb8-bea2-1c572110bc62
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
frank3000.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
SCAN_DOCUMENT.exeMSBuild.exepid process 1080 SCAN_DOCUMENT.exe 1080 SCAN_DOCUMENT.exe 1620 MSBuild.exe 1620 MSBuild.exe 1620 MSBuild.exe 1620 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SCAN_DOCUMENT.exedescription pid process target process PID 1080 set thread context of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 1620 MSBuild.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1432 schtasks.exe 1120 schtasks.exe -
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSBuild.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
SCAN_DOCUMENT.exeMSBuild.exedescription pid process target process PID 1080 wrote to memory of 1432 1080 SCAN_DOCUMENT.exe schtasks.exe PID 1080 wrote to memory of 1432 1080 SCAN_DOCUMENT.exe schtasks.exe PID 1080 wrote to memory of 1432 1080 SCAN_DOCUMENT.exe schtasks.exe PID 1080 wrote to memory of 1432 1080 SCAN_DOCUMENT.exe schtasks.exe PID 1080 wrote to memory of 296 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 296 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 296 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 296 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1080 wrote to memory of 1620 1080 SCAN_DOCUMENT.exe MSBuild.exe PID 1620 wrote to memory of 1120 1620 MSBuild.exe schtasks.exe PID 1620 wrote to memory of 1120 1620 MSBuild.exe schtasks.exe PID 1620 wrote to memory of 1120 1620 MSBuild.exe schtasks.exe PID 1620 wrote to memory of 1120 1620 MSBuild.exe schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SCAN_DOCUMENT.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1080 SCAN_DOCUMENT.exe Token: SeDebugPrivilege 1620 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SCAN_DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SCAN_DOCUMENT.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1080 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rEYWzsvqW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp98E4.tmp"2⤵
- Creates scheduled task(s)
PID:1432 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵PID:296
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9D76.tmp"3⤵
- Creates scheduled task(s)
PID:1120