Analysis
-
max time kernel
110s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
27-09-2021 18:18
Static task
static1
Behavioral task
behavioral1
Sample
b462382cb954466386f9334247e0a34c.exe
Resource
win7-en-20210920
General
-
Target
b462382cb954466386f9334247e0a34c.exe
-
Size
30KB
-
MD5
b462382cb954466386f9334247e0a34c
-
SHA1
0ac9e261eafc36f2d8a7bda5755b44c9d8c883e9
-
SHA256
6a19a144807268d406c6da55513ae24493b2d411ba8e2a2e15567d66e55d976b
-
SHA512
edf4ec1938ff467207c75e38b2bbea2445fec6accdcd325101a4e4b60e17c9041b3c9795cf100d194549372c60b07e143464181c63458fc8e753f384b2369f4a
Malware Config
Extracted
nanocore
1.2.2.0
friomo.duckdns.org:6746
5fb3fc63-476b-43ac-865e-d84d77cfacac
-
activate_away_mode
true
-
backup_connection_host
friomo.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-05T20:20:00.814294736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6746
-
default_group
FRI OMO
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5fb3fc63-476b-43ac-865e-d84d77cfacac
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
friomo.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Processes:
b462382cb954466386f9334247e0a34c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths b462382cb954466386f9334247e0a34c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions b462382cb954466386f9334247e0a34c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\敖敁敇敦整斊斅敃敶整救敿敔敞敄\svchost.exe = "0" b462382cb954466386f9334247e0a34c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\b462382cb954466386f9334247e0a34c.exe = "0" b462382cb954466386f9334247e0a34c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b462382cb954466386f9334247e0a34c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ꛉꛛ꛰ꛈꛑ꜅ꛡ꜌ꛍꛥꛭ = "C:\\Users\\Public\\Documents\\敖敁敇敦整斊斅敃敶整救敿敔敞敄\\svchost.exe" b462382cb954466386f9334247e0a34c.exe -
Processes:
b462382cb954466386f9334247e0a34c.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA b462382cb954466386f9334247e0a34c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
b462382cb954466386f9334247e0a34c.exepid process 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b462382cb954466386f9334247e0a34c.exedescription pid process target process PID 612 set thread context of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1372 612 WerFault.exe b462382cb954466386f9334247e0a34c.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
b462382cb954466386f9334247e0a34c.exepowershell.exepowershell.exepowershell.exeWerFault.exeb462382cb954466386f9334247e0a34c.exepid process 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 612 b462382cb954466386f9334247e0a34c.exe 1028 powershell.exe 1800 powershell.exe 1604 powershell.exe 1372 WerFault.exe 1372 WerFault.exe 1372 WerFault.exe 1372 WerFault.exe 1372 WerFault.exe 976 b462382cb954466386f9334247e0a34c.exe 976 b462382cb954466386f9334247e0a34c.exe 976 b462382cb954466386f9334247e0a34c.exe 976 b462382cb954466386f9334247e0a34c.exe 976 b462382cb954466386f9334247e0a34c.exe 976 b462382cb954466386f9334247e0a34c.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
b462382cb954466386f9334247e0a34c.exeWerFault.exepid process 976 b462382cb954466386f9334247e0a34c.exe 1372 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
b462382cb954466386f9334247e0a34c.exepowershell.exepowershell.exepowershell.exeWerFault.exeb462382cb954466386f9334247e0a34c.exedescription pid process Token: SeDebugPrivilege 612 b462382cb954466386f9334247e0a34c.exe Token: SeDebugPrivilege 1028 powershell.exe Token: SeDebugPrivilege 1800 powershell.exe Token: SeDebugPrivilege 1604 powershell.exe Token: SeDebugPrivilege 1372 WerFault.exe Token: SeDebugPrivilege 976 b462382cb954466386f9334247e0a34c.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
b462382cb954466386f9334247e0a34c.exedescription pid process target process PID 612 wrote to memory of 1800 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1800 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1800 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1800 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1028 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1028 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1028 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1028 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1604 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1604 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1604 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 1604 612 b462382cb954466386f9334247e0a34c.exe powershell.exe PID 612 wrote to memory of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe PID 612 wrote to memory of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe PID 612 wrote to memory of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe PID 612 wrote to memory of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe PID 612 wrote to memory of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe PID 612 wrote to memory of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe PID 612 wrote to memory of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe PID 612 wrote to memory of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe PID 612 wrote to memory of 976 612 b462382cb954466386f9334247e0a34c.exe b462382cb954466386f9334247e0a34c.exe PID 612 wrote to memory of 1372 612 b462382cb954466386f9334247e0a34c.exe WerFault.exe PID 612 wrote to memory of 1372 612 b462382cb954466386f9334247e0a34c.exe WerFault.exe PID 612 wrote to memory of 1372 612 b462382cb954466386f9334247e0a34c.exe WerFault.exe PID 612 wrote to memory of 1372 612 b462382cb954466386f9334247e0a34c.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b462382cb954466386f9334247e0a34c.exe"C:\Users\Admin\AppData\Local\Temp\b462382cb954466386f9334247e0a34c.exe"1⤵
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\敖敁敇敦整斊斅敃敶整救敿敔敞敄\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b462382cb954466386f9334247e0a34c.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\敖敁敇敦整斊斅敃敶整救敿敔敞敄\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\b462382cb954466386f9334247e0a34c.exe"C:\Users\Admin\AppData\Local\Temp\b462382cb954466386f9334247e0a34c.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 15842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
837cc044c4cf08dd24b0dcfa846f9425
SHA1e2d7d30e2fbea1029518aefb28b24d98a0c87270
SHA2564b39b820f3cc896ca9dd722c792b8c6ec05762e3fa2ab0c3d83f9ef4da2dea0f
SHA512c2999adbbb5b4d5608323fcda934fe1075229861d2992e5e8c8d463a9e37011e12a1a910a93d0685a27e84ebc3714f4186f16b3e7cab7397351edd2bf728f9fc
-
memory/612-55-0x0000000075651000-0x0000000075653000-memory.dmpFilesize
8KB
-
memory/612-56-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/612-57-0x0000000005500000-0x000000000558C000-memory.dmpFilesize
560KB
-
memory/612-53-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/976-82-0x0000000001EA0000-0x0000000001EA6000-memory.dmpFilesize
24KB
-
memory/976-85-0x0000000004260000-0x0000000004267000-memory.dmpFilesize
28KB
-
memory/976-91-0x0000000004780000-0x000000000478F000-memory.dmpFilesize
60KB
-
memory/976-65-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/976-66-0x000000000041E792-mapping.dmp
-
memory/976-67-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/976-90-0x0000000004750000-0x0000000004779000-memory.dmpFilesize
164KB
-
memory/976-89-0x0000000004360000-0x000000000436A000-memory.dmpFilesize
40KB
-
memory/976-88-0x00000000042D0000-0x00000000042DF000-memory.dmpFilesize
60KB
-
memory/976-87-0x0000000004280000-0x0000000004289000-memory.dmpFilesize
36KB
-
memory/976-86-0x0000000004270000-0x000000000427D000-memory.dmpFilesize
52KB
-
memory/976-84-0x00000000020D0000-0x00000000020D6000-memory.dmpFilesize
24KB
-
memory/976-75-0x00000000005A0000-0x00000000005A5000-memory.dmpFilesize
20KB
-
memory/976-76-0x00000000005B0000-0x00000000005C9000-memory.dmpFilesize
100KB
-
memory/976-83-0x00000000020C0000-0x00000000020CC000-memory.dmpFilesize
48KB
-
memory/976-77-0x0000000004290000-0x0000000004291000-memory.dmpFilesize
4KB
-
memory/976-79-0x00000000005D0000-0x00000000005D3000-memory.dmpFilesize
12KB
-
memory/976-80-0x00000000006F0000-0x00000000006FD000-memory.dmpFilesize
52KB
-
memory/976-81-0x0000000001E70000-0x0000000001E85000-memory.dmpFilesize
84KB
-
memory/1028-74-0x0000000002472000-0x0000000002474000-memory.dmpFilesize
8KB
-
memory/1028-72-0x0000000002471000-0x0000000002472000-memory.dmpFilesize
4KB
-
memory/1028-70-0x0000000002470000-0x0000000002471000-memory.dmpFilesize
4KB
-
memory/1028-59-0x0000000000000000-mapping.dmp
-
memory/1372-78-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/1372-69-0x0000000000000000-mapping.dmp
-
memory/1604-60-0x0000000000000000-mapping.dmp
-
memory/1800-58-0x0000000000000000-mapping.dmp
-
memory/1800-73-0x0000000002530000-0x000000000317A000-memory.dmpFilesize
12.3MB
-
memory/1800-71-0x0000000002530000-0x000000000317A000-memory.dmpFilesize
12.3MB