Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 06:55
Static task
static1
Behavioral task
behavioral1
Sample
FedEx's AWB#5305323204643.exe
Resource
win7v20201028
General
-
Target
FedEx's AWB#5305323204643.exe
-
Size
20KB
-
MD5
b3e24269e8f4d613dab013ba26e08f8a
-
SHA1
81adf63b98379e81b82925ccc64c7a219b81a7fd
-
SHA256
3dfc4c40e95c69c2f87baf8ce364a350823404e78bb4ed97807330f398753f76
-
SHA512
477d9eefcd769cceb181df5d11038b8d9ca6b8a42d027b15cdb0c7eb0999e228041b0a86fa746ed26b1adf1e2bc73a83acff9751fba9816570945ca0d23176ea
Malware Config
Extracted
nanocore
1.2.2.0
185.157.160.233:2212
annapro.linkpc.net:2212
5c958888-f81c-42a4-939d-31983a2cd9ba
-
activate_away_mode
true
-
backup_connection_host
annapro.linkpc.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-10-24T06:39:59.095270636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2212
-
default_group
wuzzy122
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5c958888-f81c-42a4-939d-31983a2cd9ba
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.160.233
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Nirsoft 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 1412 AdvancedRun.exe 420 AdvancedRun.exe -
Processes:
FedEx's AWB#5305323204643.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe = "0" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" FedEx's AWB#5305323204643.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
FedEx's AWB#5305323204643.exepid process 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FedEx's AWB#5305323204643.exedescription pid process target process PID 1144 set thread context of 2284 1144 FedEx's AWB#5305323204643.exe installutil.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3964 1144 WerFault.exe FedEx's AWB#5305323204643.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2792 timeout.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeFedEx's AWB#5305323204643.exepowershell.exeWerFault.exeinstallutil.exepid process 1412 AdvancedRun.exe 1412 AdvancedRun.exe 1412 AdvancedRun.exe 1412 AdvancedRun.exe 420 AdvancedRun.exe 420 AdvancedRun.exe 420 AdvancedRun.exe 420 AdvancedRun.exe 1144 FedEx's AWB#5305323204643.exe 2140 powershell.exe 1144 FedEx's AWB#5305323204643.exe 1144 FedEx's AWB#5305323204643.exe 2140 powershell.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 2284 installutil.exe 2284 installutil.exe 2284 installutil.exe 2140 powershell.exe 2284 installutil.exe 2284 installutil.exe 2284 installutil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
installutil.exepid process 2284 installutil.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.exeAdvancedRun.exepowershell.exeWerFault.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 1144 FedEx's AWB#5305323204643.exe Token: SeDebugPrivilege 1412 AdvancedRun.exe Token: SeImpersonatePrivilege 1412 AdvancedRun.exe Token: SeDebugPrivilege 420 AdvancedRun.exe Token: SeImpersonatePrivilege 420 AdvancedRun.exe Token: SeDebugPrivilege 2140 powershell.exe Token: SeRestorePrivilege 3964 WerFault.exe Token: SeBackupPrivilege 3964 WerFault.exe Token: SeBackupPrivilege 3964 WerFault.exe Token: SeDebugPrivilege 3964 WerFault.exe Token: SeDebugPrivilege 2284 installutil.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.execmd.exedescription pid process target process PID 1144 wrote to memory of 1412 1144 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1144 wrote to memory of 1412 1144 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1144 wrote to memory of 1412 1144 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1412 wrote to memory of 420 1412 AdvancedRun.exe AdvancedRun.exe PID 1412 wrote to memory of 420 1412 AdvancedRun.exe AdvancedRun.exe PID 1412 wrote to memory of 420 1412 AdvancedRun.exe AdvancedRun.exe PID 1144 wrote to memory of 2140 1144 FedEx's AWB#5305323204643.exe powershell.exe PID 1144 wrote to memory of 2140 1144 FedEx's AWB#5305323204643.exe powershell.exe PID 1144 wrote to memory of 2140 1144 FedEx's AWB#5305323204643.exe powershell.exe PID 1144 wrote to memory of 3780 1144 FedEx's AWB#5305323204643.exe cmd.exe PID 1144 wrote to memory of 3780 1144 FedEx's AWB#5305323204643.exe cmd.exe PID 1144 wrote to memory of 3780 1144 FedEx's AWB#5305323204643.exe cmd.exe PID 3780 wrote to memory of 2792 3780 cmd.exe timeout.exe PID 3780 wrote to memory of 2792 3780 cmd.exe timeout.exe PID 3780 wrote to memory of 2792 3780 cmd.exe timeout.exe PID 1144 wrote to memory of 2284 1144 FedEx's AWB#5305323204643.exe installutil.exe PID 1144 wrote to memory of 2284 1144 FedEx's AWB#5305323204643.exe installutil.exe PID 1144 wrote to memory of 2284 1144 FedEx's AWB#5305323204643.exe installutil.exe PID 1144 wrote to memory of 2284 1144 FedEx's AWB#5305323204643.exe installutil.exe PID 1144 wrote to memory of 2284 1144 FedEx's AWB#5305323204643.exe installutil.exe PID 1144 wrote to memory of 2284 1144 FedEx's AWB#5305323204643.exe installutil.exe PID 1144 wrote to memory of 2284 1144 FedEx's AWB#5305323204643.exe installutil.exe PID 1144 wrote to memory of 2284 1144 FedEx's AWB#5305323204643.exe installutil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exe" /SpecialRun 4101d8 14123⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 20642⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\e93c899c-041d-4829-b939-2e66c4b0323a\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/420-16-0x0000000000000000-mapping.dmp
-
memory/1144-6-0x0000000007830000-0x0000000007831000-memory.dmpFilesize
4KB
-
memory/1144-10-0x0000000008DD0000-0x0000000008DD1000-memory.dmpFilesize
4KB
-
memory/1144-11-0x00000000088D0000-0x00000000088D1000-memory.dmpFilesize
4KB
-
memory/1144-12-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/1144-9-0x0000000005340000-0x00000000053E9000-memory.dmpFilesize
676KB
-
memory/1144-2-0x0000000073450000-0x0000000073B3E000-memory.dmpFilesize
6.9MB
-
memory/1144-5-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/1144-3-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1412-13-0x0000000000000000-mapping.dmp
-
memory/2140-22-0x00000000075D0000-0x00000000075D1000-memory.dmpFilesize
4KB
-
memory/2140-32-0x0000000006F92000-0x0000000006F93000-memory.dmpFilesize
4KB
-
memory/2140-20-0x0000000073450000-0x0000000073B3E000-memory.dmpFilesize
6.9MB
-
memory/2140-21-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/2140-48-0x0000000006F93000-0x0000000006F94000-memory.dmpFilesize
4KB
-
memory/2140-18-0x0000000000000000-mapping.dmp
-
memory/2140-24-0x0000000007C00000-0x0000000007C01000-memory.dmpFilesize
4KB
-
memory/2140-25-0x0000000007CA0000-0x0000000007CA1000-memory.dmpFilesize
4KB
-
memory/2140-28-0x0000000007EF0000-0x0000000007EF1000-memory.dmpFilesize
4KB
-
memory/2140-45-0x00000000086C0000-0x00000000086C1000-memory.dmpFilesize
4KB
-
memory/2140-42-0x00000000085C0000-0x00000000085C1000-memory.dmpFilesize
4KB
-
memory/2140-40-0x0000000007D70000-0x0000000007D71000-memory.dmpFilesize
4KB
-
memory/2140-31-0x0000000006F90000-0x0000000006F91000-memory.dmpFilesize
4KB
-
memory/2140-30-0x0000000008080000-0x0000000008081000-memory.dmpFilesize
4KB
-
memory/2284-27-0x000000000041E792-mapping.dmp
-
memory/2284-41-0x0000000005680000-0x0000000005685000-memory.dmpFilesize
20KB
-
memory/2284-29-0x0000000073450000-0x0000000073B3E000-memory.dmpFilesize
6.9MB
-
memory/2284-43-0x00000000058F0000-0x0000000005909000-memory.dmpFilesize
100KB
-
memory/2284-44-0x0000000005B30000-0x0000000005B33000-memory.dmpFilesize
12KB
-
memory/2284-26-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2284-46-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/2284-47-0x0000000005513000-0x0000000005515000-memory.dmpFilesize
8KB
-
memory/2792-23-0x0000000000000000-mapping.dmp
-
memory/3780-19-0x0000000000000000-mapping.dmp
-
memory/3964-39-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB