Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 08:16
Static task
static1
Behavioral task
behavioral1
Sample
FedEx's AWB#5305323204643.exe
Resource
win7v20201028
General
-
Target
FedEx's AWB#5305323204643.exe
-
Size
20KB
-
MD5
b3e24269e8f4d613dab013ba26e08f8a
-
SHA1
81adf63b98379e81b82925ccc64c7a219b81a7fd
-
SHA256
3dfc4c40e95c69c2f87baf8ce364a350823404e78bb4ed97807330f398753f76
-
SHA512
477d9eefcd769cceb181df5d11038b8d9ca6b8a42d027b15cdb0c7eb0999e228041b0a86fa746ed26b1adf1e2bc73a83acff9751fba9816570945ca0d23176ea
Malware Config
Extracted
nanocore
1.2.2.0
185.157.160.233:2212
annapro.linkpc.net:2212
5c958888-f81c-42a4-939d-31983a2cd9ba
-
activate_away_mode
true
-
backup_connection_host
annapro.linkpc.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-10-24T06:39:59.095270636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2212
-
default_group
wuzzy122
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5c958888-f81c-42a4-939d-31983a2cd9ba
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.160.233
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Nirsoft 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 3408 AdvancedRun.exe 1404 AdvancedRun.exe -
Processes:
FedEx's AWB#5305323204643.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe = "0" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" FedEx's AWB#5305323204643.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
FedEx's AWB#5305323204643.exepid process 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FedEx's AWB#5305323204643.exedescription pid process target process PID 1192 set thread context of 788 1192 FedEx's AWB#5305323204643.exe installutil.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1748 1192 WerFault.exe FedEx's AWB#5305323204643.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2872 timeout.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeFedEx's AWB#5305323204643.exepowershell.exeWerFault.exeinstallutil.exepid process 3408 AdvancedRun.exe 3408 AdvancedRun.exe 3408 AdvancedRun.exe 3408 AdvancedRun.exe 1404 AdvancedRun.exe 1404 AdvancedRun.exe 1404 AdvancedRun.exe 1404 AdvancedRun.exe 1192 FedEx's AWB#5305323204643.exe 3900 powershell.exe 1192 FedEx's AWB#5305323204643.exe 1192 FedEx's AWB#5305323204643.exe 3900 powershell.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 1748 WerFault.exe 788 installutil.exe 788 installutil.exe 788 installutil.exe 788 installutil.exe 788 installutil.exe 788 installutil.exe 3900 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
installutil.exepid process 788 installutil.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.exeAdvancedRun.exepowershell.exeWerFault.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 1192 FedEx's AWB#5305323204643.exe Token: SeDebugPrivilege 3408 AdvancedRun.exe Token: SeImpersonatePrivilege 3408 AdvancedRun.exe Token: SeDebugPrivilege 1404 AdvancedRun.exe Token: SeImpersonatePrivilege 1404 AdvancedRun.exe Token: SeDebugPrivilege 3900 powershell.exe Token: SeRestorePrivilege 1748 WerFault.exe Token: SeBackupPrivilege 1748 WerFault.exe Token: SeBackupPrivilege 1748 WerFault.exe Token: SeDebugPrivilege 1748 WerFault.exe Token: SeDebugPrivilege 788 installutil.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.execmd.exedescription pid process target process PID 1192 wrote to memory of 3408 1192 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1192 wrote to memory of 3408 1192 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1192 wrote to memory of 3408 1192 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 3408 wrote to memory of 1404 3408 AdvancedRun.exe AdvancedRun.exe PID 3408 wrote to memory of 1404 3408 AdvancedRun.exe AdvancedRun.exe PID 3408 wrote to memory of 1404 3408 AdvancedRun.exe AdvancedRun.exe PID 1192 wrote to memory of 3900 1192 FedEx's AWB#5305323204643.exe powershell.exe PID 1192 wrote to memory of 3900 1192 FedEx's AWB#5305323204643.exe powershell.exe PID 1192 wrote to memory of 3900 1192 FedEx's AWB#5305323204643.exe powershell.exe PID 1192 wrote to memory of 3792 1192 FedEx's AWB#5305323204643.exe cmd.exe PID 1192 wrote to memory of 3792 1192 FedEx's AWB#5305323204643.exe cmd.exe PID 1192 wrote to memory of 3792 1192 FedEx's AWB#5305323204643.exe cmd.exe PID 3792 wrote to memory of 2872 3792 cmd.exe timeout.exe PID 3792 wrote to memory of 2872 3792 cmd.exe timeout.exe PID 3792 wrote to memory of 2872 3792 cmd.exe timeout.exe PID 1192 wrote to memory of 788 1192 FedEx's AWB#5305323204643.exe installutil.exe PID 1192 wrote to memory of 788 1192 FedEx's AWB#5305323204643.exe installutil.exe PID 1192 wrote to memory of 788 1192 FedEx's AWB#5305323204643.exe installutil.exe PID 1192 wrote to memory of 788 1192 FedEx's AWB#5305323204643.exe installutil.exe PID 1192 wrote to memory of 788 1192 FedEx's AWB#5305323204643.exe installutil.exe PID 1192 wrote to memory of 788 1192 FedEx's AWB#5305323204643.exe installutil.exe PID 1192 wrote to memory of 788 1192 FedEx's AWB#5305323204643.exe installutil.exe PID 1192 wrote to memory of 788 1192 FedEx's AWB#5305323204643.exe installutil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exe" /SpecialRun 4101d8 34083⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 20682⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\cab3efbb-b883-42bb-9de0-3c97cf460f05\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/788-31-0x0000000073A80000-0x000000007416E000-memory.dmpFilesize
6.9MB
-
memory/788-47-0x0000000004FF3000-0x0000000004FF5000-memory.dmpFilesize
8KB
-
memory/788-45-0x0000000005360000-0x0000000005363000-memory.dmpFilesize
12KB
-
memory/788-44-0x0000000004FD0000-0x0000000004FE9000-memory.dmpFilesize
100KB
-
memory/788-42-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/788-43-0x0000000004E50000-0x0000000004E55000-memory.dmpFilesize
20KB
-
memory/788-29-0x000000000041E792-mapping.dmp
-
memory/788-28-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1192-11-0x0000000008A30000-0x0000000008A31000-memory.dmpFilesize
4KB
-
memory/1192-3-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/1192-10-0x0000000008E50000-0x0000000008E51000-memory.dmpFilesize
4KB
-
memory/1192-12-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/1192-2-0x0000000073A80000-0x000000007416E000-memory.dmpFilesize
6.9MB
-
memory/1192-9-0x0000000005630000-0x00000000056D9000-memory.dmpFilesize
676KB
-
memory/1192-5-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/1192-6-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/1404-16-0x0000000000000000-mapping.dmp
-
memory/1748-39-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/2872-21-0x0000000000000000-mapping.dmp
-
memory/3408-13-0x0000000000000000-mapping.dmp
-
memory/3792-19-0x0000000000000000-mapping.dmp
-
memory/3900-27-0x00000000075D0000-0x00000000075D1000-memory.dmpFilesize
4KB
-
memory/3900-26-0x0000000007530000-0x0000000007531000-memory.dmpFilesize
4KB
-
memory/3900-32-0x0000000007F70000-0x0000000007F71000-memory.dmpFilesize
4KB
-
memory/3900-23-0x0000000007680000-0x0000000007681000-memory.dmpFilesize
4KB
-
memory/3900-22-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/3900-40-0x0000000007D70000-0x0000000007D71000-memory.dmpFilesize
4KB
-
memory/3900-41-0x0000000008300000-0x0000000008301000-memory.dmpFilesize
4KB
-
memory/3900-30-0x0000000007F00000-0x0000000007F01000-memory.dmpFilesize
4KB
-
memory/3900-20-0x0000000073A80000-0x000000007416E000-memory.dmpFilesize
6.9MB
-
memory/3900-25-0x0000000004C12000-0x0000000004C13000-memory.dmpFilesize
4KB
-
memory/3900-18-0x0000000000000000-mapping.dmp
-
memory/3900-46-0x0000000008600000-0x0000000008601000-memory.dmpFilesize
4KB
-
memory/3900-24-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/3900-48-0x0000000004C13000-0x0000000004C14000-memory.dmpFilesize
4KB