Analysis
-
max time kernel
132s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-01-2021 14:17
Static task
static1
Behavioral task
behavioral1
Sample
Scan_00059010189_ ref. 004118379411_ pdf.exe
Resource
win7v20201028
General
-
Target
Scan_00059010189_ ref. 004118379411_ pdf.exe
-
Size
344KB
-
MD5
106117a9928b774aa6bbb657f275de53
-
SHA1
208d61ecd30789fba2325a0e0f46bb63bdba5bd9
-
SHA256
a5affcfc364530db52dd4fcf252187cc09968a7bb1f1149bb919fd339634468a
-
SHA512
821b25876ccdf80a77714618766a0578898f6671755a1e399d1d5ab7302ceaa9d67b6ed37964dad27088996823c5bd2db312eb0fd5dc00123d294800797c24f1
Malware Config
Extracted
nanocore
1.2.2.0
185.244.38.210:7008
127.0.0.1:7008
003adc3a-22f1-4bc1-a79f-fc8c7d09606c
-
activate_away_mode
false
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-10-20T22:48:03.749409436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
2000
-
connection_port
7008
-
default_group
Mjx_users
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
50000
-
keyboard_logging
false
-
lan_timeout
3500
-
max_packet_size
1.048576e+07
-
mutex
003adc3a-22f1-4bc1-a79f-fc8c7d09606c
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.244.38.210
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
3000
-
run_delay
1000
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
4000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Host = "C:\\Program Files (x86)\\WPA Host\\wpahost.exe" RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Scan_00059010189_ ref. 004118379411_ pdf.exedescription pid process target process PID 1732 set thread context of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\WPA Host\wpahost.exe RegAsm.exe File opened for modification C:\Program Files (x86)\WPA Host\wpahost.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1168 schtasks.exe 1692 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegAsm.exepid process 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1516 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1516 RegAsm.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Scan_00059010189_ ref. 004118379411_ pdf.exeRegAsm.exedescription pid process target process PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1732 wrote to memory of 1516 1732 Scan_00059010189_ ref. 004118379411_ pdf.exe RegAsm.exe PID 1516 wrote to memory of 1168 1516 RegAsm.exe schtasks.exe PID 1516 wrote to memory of 1168 1516 RegAsm.exe schtasks.exe PID 1516 wrote to memory of 1168 1516 RegAsm.exe schtasks.exe PID 1516 wrote to memory of 1168 1516 RegAsm.exe schtasks.exe PID 1516 wrote to memory of 1692 1516 RegAsm.exe schtasks.exe PID 1516 wrote to memory of 1692 1516 RegAsm.exe schtasks.exe PID 1516 wrote to memory of 1692 1516 RegAsm.exe schtasks.exe PID 1516 wrote to memory of 1692 1516 RegAsm.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan_00059010189_ ref. 004118379411_ pdf.exe"C:\Users\Admin\AppData\Local\Temp\Scan_00059010189_ ref. 004118379411_ pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2980.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2B36.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2980.tmpMD5
48ef7fa9033389ad7929d7a6b9d10298
SHA19db6cb7325c8bdf66a15f7b5f34703709a45aeb6
SHA2560c1b5f67eeb276d1d4205b138ce32bc6149924e02281a2db8e4623a700e88f15
SHA512ac8bd104ecbacc9bccce9e087f67e5b18072d59367ccd31d4e66132b6baaea520cba5b9b59464483d86abf74826b382c402f12e9a586c99bda8c78a0de33944e
-
C:\Users\Admin\AppData\Local\Temp\tmp2B36.tmpMD5
819bdbdac3be050783d203020e6c4c30
SHA1a373521fceb21cac8b93e55ee48578e40a6e740b
SHA2560e5dedca6d0d3c50ebcedb5bbf51ef3d434eb6b43da46764205de7636131f053
SHA512cece1c4d8b4db79fc6e3cd225efaccdf9d2493f28991b1d48439944af38aaa61a215bd00a0beedcbdecc4f1ec5be0843774375a483f3d4a573a3980c54798cbd
-
memory/1168-13-0x0000000000000000-mapping.dmp
-
memory/1516-6-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1516-7-0x000000000041E792-mapping.dmp
-
memory/1516-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1516-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1516-10-0x00000000734A0000-0x0000000073B8E000-memory.dmpFilesize
6.9MB
-
memory/1516-17-0x00000000007D0000-0x00000000007D5000-memory.dmpFilesize
20KB
-
memory/1516-18-0x00000000007E0000-0x00000000007F9000-memory.dmpFilesize
100KB
-
memory/1516-19-0x0000000000840000-0x0000000000843000-memory.dmpFilesize
12KB
-
memory/1692-15-0x0000000000000000-mapping.dmp
-
memory/1732-2-0x0000000074120000-0x000000007480E000-memory.dmpFilesize
6.9MB
-
memory/1732-5-0x0000000000230000-0x0000000000242000-memory.dmpFilesize
72KB
-
memory/1732-3-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB