Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 15:21
Static task
static1
Behavioral task
behavioral1
Sample
bd8f7a95d63891f57462cfa5b2179888.exe
Resource
win7-en-20210920
General
-
Target
bd8f7a95d63891f57462cfa5b2179888.exe
-
Size
973KB
-
MD5
bd8f7a95d63891f57462cfa5b2179888
-
SHA1
66839ede4459f5df3c228221ef563f6fdfef5db3
-
SHA256
7d099dcd6d912e29120d1eca72f100724fa776e8a1f80b22fbb52e6de905d324
-
SHA512
9bc81d9fe1c39b9ce8301d68eebac20ff78a4c6886f01a9c8541561333e29b3e6f721101c490ff4262abe295f8f940aefad5f54cf62ef3d93448132e2b1606b5
Malware Config
Extracted
nanocore
1.2.2.0
strongodss.ddns.net:48562
185.19.85.175:48562
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
activate_away_mode
false
-
backup_connection_host
185.19.85.175
- backup_dns_server
-
buffer_size
65538
-
build_time
2021-04-20T00:12:13.961451136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
48562
-
default_group
HOBBIT
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
strongodss.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
woag.pifRegSvcs.exepid process 4080 woag.pif 1028 RegSvcs.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
woag.pifRegSvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run woag.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "c:\\69392457\\woag.pif c:\\69392457\\tidhtdr.iun" woag.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "c:\\69392457\\Update.vbs" woag.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" RegSvcs.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
woag.pifdescription pid process target process PID 4080 set thread context of 1028 4080 woag.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisvc.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
RegSvcs.exepid process 1028 RegSvcs.exe 1028 RegSvcs.exe 1028 RegSvcs.exe 1028 RegSvcs.exe 1028 RegSvcs.exe 1028 RegSvcs.exe 1028 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1028 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1028 RegSvcs.exe Token: SeDebugPrivilege 1028 RegSvcs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
bd8f7a95d63891f57462cfa5b2179888.exewoag.pifRegSvcs.exedescription pid process target process PID 1776 wrote to memory of 4080 1776 bd8f7a95d63891f57462cfa5b2179888.exe woag.pif PID 1776 wrote to memory of 4080 1776 bd8f7a95d63891f57462cfa5b2179888.exe woag.pif PID 1776 wrote to memory of 4080 1776 bd8f7a95d63891f57462cfa5b2179888.exe woag.pif PID 4080 wrote to memory of 1028 4080 woag.pif RegSvcs.exe PID 4080 wrote to memory of 1028 4080 woag.pif RegSvcs.exe PID 4080 wrote to memory of 1028 4080 woag.pif RegSvcs.exe PID 4080 wrote to memory of 1028 4080 woag.pif RegSvcs.exe PID 4080 wrote to memory of 1028 4080 woag.pif RegSvcs.exe PID 1028 wrote to memory of 980 1028 RegSvcs.exe schtasks.exe PID 1028 wrote to memory of 980 1028 RegSvcs.exe schtasks.exe PID 1028 wrote to memory of 980 1028 RegSvcs.exe schtasks.exe PID 1028 wrote to memory of 2644 1028 RegSvcs.exe schtasks.exe PID 1028 wrote to memory of 2644 1028 RegSvcs.exe schtasks.exe PID 1028 wrote to memory of 2644 1028 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd8f7a95d63891f57462cfa5b2179888.exe"C:\Users\Admin\AppData\Local\Temp\bd8f7a95d63891f57462cfa5b2179888.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\69392457\woag.pif"C:\69392457\woag.pif" tidhtdr.iun2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF86A.tmp"4⤵
- Creates scheduled task(s)
PID:980 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFA21.tmp"4⤵
- Creates scheduled task(s)
PID:2644
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\69392457\dbfiopvsmo.hfkMD5
76545cc5c7f1654695f3a2a8c236c2c0
SHA1f9c4502666816b9f14ee3f6e6e45f9153aae666d
SHA256645c7a554e0d13084a36d160296a758bcbc2fd7ac41c6cda57f2f4765a2bff1b
SHA51216c478876f8c77432cc221fd8de937300833e1be587334c0843484a0d5b359c089f43f37d4d5e99b930634e19e6001235f7b22f96afc9805fde2329007e64088
-
C:\69392457\pmuecfub.jpgMD5
c051b0139c31144b7bb8e0c0e6e57114
SHA1b98ef6053a79828ae5f2e9721be30e3b0a6a66f7
SHA25644fddcef0c759223012ab7d91c0858fd785e96d2e9ef41a298fc4190069e13ec
SHA5129cb0bafab11de46016e448a734bf08007b9181ff7a26202ff9c2b42592caed86c6e894f60d0e798e0accdb13ffa51ffdaa2c02b255ebdcc14d48fb9ce4305607
-
C:\69392457\tidhtdr.iunMD5
5c4c60c21b8272dc02b0adc2c8882b39
SHA1f238d2469d715493a4dfa8e2901a2769cf647914
SHA25699744433ad0f06fb3f8eabf747d1b0763a6e7cf54f8a5f08d4e7caad61d0dafb
SHA51290fa6778273925400507ee294e5aa5c7d6f758967b3f395ad8643229a038eb8d40c640bdd104c2a94ffea097b27c1d0ad8eef1693125cb5af9c29e2bd426c777
-
C:\69392457\woag.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
C:\69392457\woag.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmpF86A.tmpMD5
95aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmpFA21.tmpMD5
4e71faa3a77029484cfaba423d96618f
SHA19c837d050bb43d69dc608af809c292e13bca4718
SHA256c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb
SHA5126d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0
-
memory/980-132-0x0000000000000000-mapping.dmp
-
memory/1028-122-0x0000000000F1E792-mapping.dmp
-
memory/1028-128-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/1028-129-0x0000000005CA0000-0x0000000005CA1000-memory.dmpFilesize
4KB
-
memory/1028-130-0x0000000005AC0000-0x0000000005FBE000-memory.dmpFilesize
5.0MB
-
memory/1028-131-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/1028-127-0x0000000005FC0000-0x0000000005FC1000-memory.dmpFilesize
4KB
-
memory/1028-121-0x0000000000F00000-0x00000000014FC000-memory.dmpFilesize
6.0MB
-
memory/1028-136-0x0000000005C70000-0x0000000005C75000-memory.dmpFilesize
20KB
-
memory/1028-137-0x0000000005C80000-0x0000000005C86000-memory.dmpFilesize
24KB
-
memory/1028-138-0x0000000005E40000-0x0000000005E59000-memory.dmpFilesize
100KB
-
memory/1028-139-0x0000000006B80000-0x0000000006B83000-memory.dmpFilesize
12KB
-
memory/2644-134-0x0000000000000000-mapping.dmp
-
memory/4080-115-0x0000000000000000-mapping.dmp