Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 08:16
Static task
static1
Behavioral task
behavioral1
Sample
FedEx's AWB#5305323204643.exe
Resource
win7v20201028
General
-
Target
FedEx's AWB#5305323204643.exe
-
Size
20KB
-
MD5
b3e24269e8f4d613dab013ba26e08f8a
-
SHA1
81adf63b98379e81b82925ccc64c7a219b81a7fd
-
SHA256
3dfc4c40e95c69c2f87baf8ce364a350823404e78bb4ed97807330f398753f76
-
SHA512
477d9eefcd769cceb181df5d11038b8d9ca6b8a42d027b15cdb0c7eb0999e228041b0a86fa746ed26b1adf1e2bc73a83acff9751fba9816570945ca0d23176ea
Malware Config
Extracted
nanocore
1.2.2.0
185.157.160.233:2212
annapro.linkpc.net:2212
5c958888-f81c-42a4-939d-31983a2cd9ba
-
activate_away_mode
true
-
backup_connection_host
annapro.linkpc.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-10-24T06:39:59.095270636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2212
-
default_group
wuzzy122
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5c958888-f81c-42a4-939d-31983a2cd9ba
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.160.233
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Nirsoft 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 3644 AdvancedRun.exe 2844 AdvancedRun.exe -
Processes:
FedEx's AWB#5305323204643.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe = "0" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" FedEx's AWB#5305323204643.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
FedEx's AWB#5305323204643.exepid process 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FedEx's AWB#5305323204643.exedescription pid process target process PID 4020 set thread context of 2868 4020 FedEx's AWB#5305323204643.exe installutil.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4036 4020 WerFault.exe FedEx's AWB#5305323204643.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1292 timeout.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeFedEx's AWB#5305323204643.exeWerFault.exeinstallutil.exepid process 3644 AdvancedRun.exe 3644 AdvancedRun.exe 3644 AdvancedRun.exe 3644 AdvancedRun.exe 2844 AdvancedRun.exe 2844 AdvancedRun.exe 2844 AdvancedRun.exe 2844 AdvancedRun.exe 1308 powershell.exe 4020 FedEx's AWB#5305323204643.exe 1308 powershell.exe 4020 FedEx's AWB#5305323204643.exe 4020 FedEx's AWB#5305323204643.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 1308 powershell.exe 2868 installutil.exe 2868 installutil.exe 2868 installutil.exe 2868 installutil.exe 2868 installutil.exe 2868 installutil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
installutil.exepid process 2868 installutil.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.exeAdvancedRun.exepowershell.exeWerFault.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 4020 FedEx's AWB#5305323204643.exe Token: SeDebugPrivilege 3644 AdvancedRun.exe Token: SeImpersonatePrivilege 3644 AdvancedRun.exe Token: SeDebugPrivilege 2844 AdvancedRun.exe Token: SeImpersonatePrivilege 2844 AdvancedRun.exe Token: SeDebugPrivilege 1308 powershell.exe Token: SeRestorePrivilege 4036 WerFault.exe Token: SeBackupPrivilege 4036 WerFault.exe Token: SeBackupPrivilege 4036 WerFault.exe Token: SeDebugPrivilege 4036 WerFault.exe Token: SeDebugPrivilege 2868 installutil.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.execmd.exedescription pid process target process PID 4020 wrote to memory of 3644 4020 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 4020 wrote to memory of 3644 4020 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 4020 wrote to memory of 3644 4020 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 3644 wrote to memory of 2844 3644 AdvancedRun.exe AdvancedRun.exe PID 3644 wrote to memory of 2844 3644 AdvancedRun.exe AdvancedRun.exe PID 3644 wrote to memory of 2844 3644 AdvancedRun.exe AdvancedRun.exe PID 4020 wrote to memory of 1308 4020 FedEx's AWB#5305323204643.exe powershell.exe PID 4020 wrote to memory of 1308 4020 FedEx's AWB#5305323204643.exe powershell.exe PID 4020 wrote to memory of 1308 4020 FedEx's AWB#5305323204643.exe powershell.exe PID 4020 wrote to memory of 2948 4020 FedEx's AWB#5305323204643.exe cmd.exe PID 4020 wrote to memory of 2948 4020 FedEx's AWB#5305323204643.exe cmd.exe PID 4020 wrote to memory of 2948 4020 FedEx's AWB#5305323204643.exe cmd.exe PID 2948 wrote to memory of 1292 2948 cmd.exe timeout.exe PID 2948 wrote to memory of 1292 2948 cmd.exe timeout.exe PID 2948 wrote to memory of 1292 2948 cmd.exe timeout.exe PID 4020 wrote to memory of 2868 4020 FedEx's AWB#5305323204643.exe installutil.exe PID 4020 wrote to memory of 2868 4020 FedEx's AWB#5305323204643.exe installutil.exe PID 4020 wrote to memory of 2868 4020 FedEx's AWB#5305323204643.exe installutil.exe PID 4020 wrote to memory of 2868 4020 FedEx's AWB#5305323204643.exe installutil.exe PID 4020 wrote to memory of 2868 4020 FedEx's AWB#5305323204643.exe installutil.exe PID 4020 wrote to memory of 2868 4020 FedEx's AWB#5305323204643.exe installutil.exe PID 4020 wrote to memory of 2868 4020 FedEx's AWB#5305323204643.exe installutil.exe PID 4020 wrote to memory of 2868 4020 FedEx's AWB#5305323204643.exe installutil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exe" /SpecialRun 4101d8 36443⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 20722⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\f4c06bb1-11cb-454f-ba4d-2543aa49c69f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/1292-21-0x0000000000000000-mapping.dmp
-
memory/1308-33-0x0000000007DE0000-0x0000000007DE1000-memory.dmpFilesize
4KB
-
memory/1308-26-0x0000000007460000-0x0000000007461000-memory.dmpFilesize
4KB
-
memory/1308-48-0x0000000006F83000-0x0000000006F84000-memory.dmpFilesize
4KB
-
memory/1308-40-0x0000000008580000-0x0000000008581000-memory.dmpFilesize
4KB
-
memory/1308-34-0x00000000086D0000-0x00000000086D1000-memory.dmpFilesize
4KB
-
memory/1308-29-0x0000000007F00000-0x0000000007F01000-memory.dmpFilesize
4KB
-
memory/1308-28-0x0000000007BF0000-0x0000000007BF1000-memory.dmpFilesize
4KB
-
memory/1308-27-0x0000000007C60000-0x0000000007C61000-memory.dmpFilesize
4KB
-
memory/1308-25-0x0000000006F82000-0x0000000006F83000-memory.dmpFilesize
4KB
-
memory/1308-18-0x0000000000000000-mapping.dmp
-
memory/1308-24-0x0000000006F80000-0x0000000006F81000-memory.dmpFilesize
4KB
-
memory/1308-20-0x0000000073CA0000-0x000000007438E000-memory.dmpFilesize
6.9MB
-
memory/1308-22-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/1308-23-0x00000000075C0000-0x00000000075C1000-memory.dmpFilesize
4KB
-
memory/2844-16-0x0000000000000000-mapping.dmp
-
memory/2868-44-0x0000000005A30000-0x0000000005A49000-memory.dmpFilesize
100KB
-
memory/2868-43-0x00000000051C0000-0x00000000051C5000-memory.dmpFilesize
20KB
-
memory/2868-32-0x0000000073CA0000-0x000000007438E000-memory.dmpFilesize
6.9MB
-
memory/2868-47-0x0000000004F03000-0x0000000004F05000-memory.dmpFilesize
8KB
-
memory/2868-46-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/2868-31-0x000000000041E792-mapping.dmp
-
memory/2868-30-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2868-45-0x0000000005C60000-0x0000000005C63000-memory.dmpFilesize
12KB
-
memory/2948-19-0x0000000000000000-mapping.dmp
-
memory/3644-13-0x0000000000000000-mapping.dmp
-
memory/4020-12-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/4020-9-0x0000000005D80000-0x0000000005E29000-memory.dmpFilesize
676KB
-
memory/4020-11-0x0000000009180000-0x0000000009181000-memory.dmpFilesize
4KB
-
memory/4020-3-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/4020-10-0x00000000095A0000-0x00000000095A1000-memory.dmpFilesize
4KB
-
memory/4020-5-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/4020-6-0x0000000005CE0000-0x0000000005CE1000-memory.dmpFilesize
4KB
-
memory/4020-2-0x0000000073CA0000-0x000000007438E000-memory.dmpFilesize
6.9MB
-
memory/4036-42-0x00000000043D0000-0x00000000043D1000-memory.dmpFilesize
4KB