Analysis
-
max time kernel
140s -
max time network
173s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
14-10-2021 15:21
Static task
static1
Behavioral task
behavioral1
Sample
bd8f7a95d63891f57462cfa5b2179888.exe
Resource
win7-en-20210920
General
-
Target
bd8f7a95d63891f57462cfa5b2179888.exe
-
Size
973KB
-
MD5
bd8f7a95d63891f57462cfa5b2179888
-
SHA1
66839ede4459f5df3c228221ef563f6fdfef5db3
-
SHA256
7d099dcd6d912e29120d1eca72f100724fa776e8a1f80b22fbb52e6de905d324
-
SHA512
9bc81d9fe1c39b9ce8301d68eebac20ff78a4c6886f01a9c8541561333e29b3e6f721101c490ff4262abe295f8f940aefad5f54cf62ef3d93448132e2b1606b5
Malware Config
Extracted
nanocore
1.2.2.0
strongodss.ddns.net:48562
185.19.85.175:48562
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
activate_away_mode
false
-
backup_connection_host
185.19.85.175
- backup_dns_server
-
buffer_size
65538
-
build_time
2021-04-20T00:12:13.961451136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
48562
-
default_group
HOBBIT
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
strongodss.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
woag.pifRegSvcs.exepid process 852 woag.pif 1648 RegSvcs.exe -
Loads dropped DLL 5 IoCs
Processes:
bd8f7a95d63891f57462cfa5b2179888.exewoag.pifpid process 1368 bd8f7a95d63891f57462cfa5b2179888.exe 1368 bd8f7a95d63891f57462cfa5b2179888.exe 1368 bd8f7a95d63891f57462cfa5b2179888.exe 1368 bd8f7a95d63891f57462cfa5b2179888.exe 852 woag.pif -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
woag.pifRegSvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run woag.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "c:\\69392457\\woag.pif c:\\69392457\\tidhtdr.iun" woag.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "c:\\69392457\\Update.vbs" woag.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe" RegSvcs.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
woag.pifdescription pid process target process PID 852 set thread context of 1648 852 woag.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Program Files (x86)\UDP Subsystem\udpss.exe RegSvcs.exe File created C:\Program Files (x86)\UDP Subsystem\udpss.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1792 schtasks.exe 1812 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
RegSvcs.exepid process 1648 RegSvcs.exe 1648 RegSvcs.exe 1648 RegSvcs.exe 1648 RegSvcs.exe 1648 RegSvcs.exe 1648 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1648 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1648 RegSvcs.exe Token: SeDebugPrivilege 1648 RegSvcs.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
bd8f7a95d63891f57462cfa5b2179888.exewoag.pifRegSvcs.exedescription pid process target process PID 1368 wrote to memory of 852 1368 bd8f7a95d63891f57462cfa5b2179888.exe woag.pif PID 1368 wrote to memory of 852 1368 bd8f7a95d63891f57462cfa5b2179888.exe woag.pif PID 1368 wrote to memory of 852 1368 bd8f7a95d63891f57462cfa5b2179888.exe woag.pif PID 1368 wrote to memory of 852 1368 bd8f7a95d63891f57462cfa5b2179888.exe woag.pif PID 852 wrote to memory of 1648 852 woag.pif RegSvcs.exe PID 852 wrote to memory of 1648 852 woag.pif RegSvcs.exe PID 852 wrote to memory of 1648 852 woag.pif RegSvcs.exe PID 852 wrote to memory of 1648 852 woag.pif RegSvcs.exe PID 852 wrote to memory of 1648 852 woag.pif RegSvcs.exe PID 852 wrote to memory of 1648 852 woag.pif RegSvcs.exe PID 852 wrote to memory of 1648 852 woag.pif RegSvcs.exe PID 852 wrote to memory of 1648 852 woag.pif RegSvcs.exe PID 852 wrote to memory of 1648 852 woag.pif RegSvcs.exe PID 1648 wrote to memory of 1792 1648 RegSvcs.exe schtasks.exe PID 1648 wrote to memory of 1792 1648 RegSvcs.exe schtasks.exe PID 1648 wrote to memory of 1792 1648 RegSvcs.exe schtasks.exe PID 1648 wrote to memory of 1792 1648 RegSvcs.exe schtasks.exe PID 1648 wrote to memory of 1812 1648 RegSvcs.exe schtasks.exe PID 1648 wrote to memory of 1812 1648 RegSvcs.exe schtasks.exe PID 1648 wrote to memory of 1812 1648 RegSvcs.exe schtasks.exe PID 1648 wrote to memory of 1812 1648 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd8f7a95d63891f57462cfa5b2179888.exe"C:\Users\Admin\AppData\Local\Temp\bd8f7a95d63891f57462cfa5b2179888.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\69392457\woag.pif"C:\69392457\woag.pif" tidhtdr.iun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp274F.tmp"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2CBC.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\69392457\dbfiopvsmo.hfkMD5
76545cc5c7f1654695f3a2a8c236c2c0
SHA1f9c4502666816b9f14ee3f6e6e45f9153aae666d
SHA256645c7a554e0d13084a36d160296a758bcbc2fd7ac41c6cda57f2f4765a2bff1b
SHA51216c478876f8c77432cc221fd8de937300833e1be587334c0843484a0d5b359c089f43f37d4d5e99b930634e19e6001235f7b22f96afc9805fde2329007e64088
-
C:\69392457\pmuecfub.jpgMD5
c051b0139c31144b7bb8e0c0e6e57114
SHA1b98ef6053a79828ae5f2e9721be30e3b0a6a66f7
SHA25644fddcef0c759223012ab7d91c0858fd785e96d2e9ef41a298fc4190069e13ec
SHA5129cb0bafab11de46016e448a734bf08007b9181ff7a26202ff9c2b42592caed86c6e894f60d0e798e0accdb13ffa51ffdaa2c02b255ebdcc14d48fb9ce4305607
-
C:\69392457\tidhtdr.iunMD5
5c4c60c21b8272dc02b0adc2c8882b39
SHA1f238d2469d715493a4dfa8e2901a2769cf647914
SHA25699744433ad0f06fb3f8eabf747d1b0763a6e7cf54f8a5f08d4e7caad61d0dafb
SHA51290fa6778273925400507ee294e5aa5c7d6f758967b3f395ad8643229a038eb8d40c640bdd104c2a94ffea097b27c1d0ad8eef1693125cb5af9c29e2bd426c777
-
C:\69392457\woag.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp274F.tmpMD5
95aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp2CBC.tmpMD5
c4aecdef99eba873119e79616df3f4b0
SHA1b1b3af52655fb633eed909dfed05b64fbbfac37c
SHA25624fd0d87bea36a024449a95f808aaa174e4ed9003cb8a427b67c02411b8a2e0b
SHA512e3f44b07267fccf4f5abd4efe80f2b037ddadc4cb898bdfca9d21ac5d79fcac828950065c2060d3ce125ee971fc3096183afee5287ba9951fbbda7257d8ed8d4
-
\69392457\woag.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\69392457\woag.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\69392457\woag.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\69392457\woag.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/852-58-0x0000000000000000-mapping.dmp
-
memory/1368-53-0x00000000768C1000-0x00000000768C3000-memory.dmpFilesize
8KB
-
memory/1648-66-0x0000000000390000-0x0000000000A45000-memory.dmpFilesize
6.7MB
-
memory/1648-70-0x0000000000390000-0x0000000000A45000-memory.dmpFilesize
6.7MB
-
memory/1648-72-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/1648-67-0x00000000003AE792-mapping.dmp
-
memory/1648-65-0x0000000000390000-0x0000000000A45000-memory.dmpFilesize
6.7MB
-
memory/1648-77-0x0000000000B80000-0x0000000000B85000-memory.dmpFilesize
20KB
-
memory/1648-78-0x0000000000B90000-0x0000000000B96000-memory.dmpFilesize
24KB
-
memory/1648-79-0x0000000000D60000-0x0000000000D79000-memory.dmpFilesize
100KB
-
memory/1648-80-0x0000000000D80000-0x0000000000D83000-memory.dmpFilesize
12KB
-
memory/1792-73-0x0000000000000000-mapping.dmp
-
memory/1812-75-0x0000000000000000-mapping.dmp