Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 13:11
Static task
static1
Behavioral task
behavioral1
Sample
BT.2021.908646294.PNG.scr
Resource
win7-en-20210920
General
-
Target
BT.2021.908646294.PNG.scr
-
Size
1.0MB
-
MD5
2d91c6f7fa8f7dc0bc9f5bee0eb23480
-
SHA1
9746d8e51e505bc1921cf453e59a98d63a6cbaca
-
SHA256
1a670f0875ed669e317ea331c549fa93f13c9d077dabc86460f292053ec86d73
-
SHA512
66268e51aae5d738e048298faf7e08bd14b5928370b820e1da9dde3e58dc666f26084b3e4ef906e707c6256281a4ec358241fa7ebb154bdecd63083c347da80e
Malware Config
Extracted
nanocore
1.2.2.0
strongodss.ddns.net:48562
185.19.85.175:48562
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
activate_away_mode
false
-
backup_connection_host
185.19.85.175
- backup_dns_server
-
buffer_size
65538
-
build_time
2021-04-20T00:12:13.961451136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
48562
-
default_group
HOBBIT
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
strongodss.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
cajqqcgfh.pifRegSvcs.exepid process 4480 cajqqcgfh.pif 4512 RegSvcs.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
RegSvcs.execajqqcgfh.pifdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cajqqcgfh.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\58329676\\CAJQQC~1.PIF C:\\Users\\Admin\\AppData\\Local\\Temp\\58329676\\mkotxrww.tlj" cajqqcgfh.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\58329676\\Update.vbs" cajqqcgfh.pif -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cajqqcgfh.pifdescription pid process target process PID 4480 set thread context of 4512 4480 cajqqcgfh.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SMTP Manager\smtpmgr.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SMTP Manager\smtpmgr.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4700 schtasks.exe 4272 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
RegSvcs.exepid process 4512 RegSvcs.exe 4512 RegSvcs.exe 4512 RegSvcs.exe 4512 RegSvcs.exe 4512 RegSvcs.exe 4512 RegSvcs.exe 4512 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 4512 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4512 RegSvcs.exe Token: SeDebugPrivilege 4512 RegSvcs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
BT.2021.908646294.PNG.scrcajqqcgfh.pifRegSvcs.exedescription pid process target process PID 3504 wrote to memory of 4480 3504 BT.2021.908646294.PNG.scr cajqqcgfh.pif PID 3504 wrote to memory of 4480 3504 BT.2021.908646294.PNG.scr cajqqcgfh.pif PID 3504 wrote to memory of 4480 3504 BT.2021.908646294.PNG.scr cajqqcgfh.pif PID 4480 wrote to memory of 4512 4480 cajqqcgfh.pif RegSvcs.exe PID 4480 wrote to memory of 4512 4480 cajqqcgfh.pif RegSvcs.exe PID 4480 wrote to memory of 4512 4480 cajqqcgfh.pif RegSvcs.exe PID 4480 wrote to memory of 4512 4480 cajqqcgfh.pif RegSvcs.exe PID 4480 wrote to memory of 4512 4480 cajqqcgfh.pif RegSvcs.exe PID 4512 wrote to memory of 4700 4512 RegSvcs.exe schtasks.exe PID 4512 wrote to memory of 4700 4512 RegSvcs.exe schtasks.exe PID 4512 wrote to memory of 4700 4512 RegSvcs.exe schtasks.exe PID 4512 wrote to memory of 4272 4512 RegSvcs.exe schtasks.exe PID 4512 wrote to memory of 4272 4512 RegSvcs.exe schtasks.exe PID 4512 wrote to memory of 4272 4512 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BT.2021.908646294.PNG.scr"C:\Users\Admin\AppData\Local\Temp\BT.2021.908646294.PNG.scr" /S1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\58329676\cajqqcgfh.pif"C:\Users\Admin\AppData\Local\Temp\58329676\cajqqcgfh.pif" mkotxrww.tlj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE9C4.tmp"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEAEE.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\58329676\cajqqcgfh.pifMD5
1d7071dd5cda216508b235c0e2318b05
SHA10b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA51265965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118
-
C:\Users\Admin\AppData\Local\Temp\58329676\cajqqcgfh.pifMD5
1d7071dd5cda216508b235c0e2318b05
SHA10b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA51265965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118
-
C:\Users\Admin\AppData\Local\Temp\58329676\fklovqe.bjsMD5
4a997e42dddc473e1d755ac4052be623
SHA157549720b8b58363fdab9befb1299b72afa80451
SHA256af2d7edc3031d56a7b9db156c5fccfe4acc3fce684f61002a1ac856249fbbe5a
SHA5120541cc3749da7db3d59486e1092519af4a060c35caacacd2f52ea9aff170a73d80297bec692548cfd483494cc603dbb1ac434f368bab423d19e629d8c96296e4
-
C:\Users\Admin\AppData\Local\Temp\58329676\merrgwm.pptMD5
d05568b629c3562fbdb1b3acca450514
SHA1608a51c7e0426ad9373963d13123ef9bcae4d3b3
SHA256b509b5b39ca46f0775396ce54ab72678ba44ef9f0261cf2ea6e920279fff31a8
SHA51291516e6f52e85c47a4ef92fb23a32230e8e66bdb65343b5f600d8cc820e31d475adcab5adbc744acb3456440895eed87caafe40efe78d118e1bfd50e0d6d0073
-
C:\Users\Admin\AppData\Local\Temp\58329676\mkotxrww.tljMD5
4fe04aaa88768160144cd5d80d68c078
SHA163bca500ea8d75639d66c9ee6958f18b479ff2b4
SHA25613e4328fbab833df9f55d3f19ff51f282242b75a3a811e3ef1ecb8b99f657182
SHA512fc39466023162d42803013b20b26b23363788b27540135ad5c58de6d74f7d2d4feda52a4896f2aeb4fd5d1556fb28309818e09bbf9a777f96d8a129050f8de4f
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmpE9C4.tmpMD5
95aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmpEAEE.tmpMD5
b3b017f9df206021717a11f11d895402
SHA1e4ea12823af6550ee634536eec1eb14490580a3b
SHA256654dfce2c28024364e679e1b958f3fb81fc6d29685d534d905d1c83a84351024
SHA51295666cb81aa1fd1ade04a32f63381ce8bff274d7d300c0b59cbb10a294c4d1eebaa3000365a2000b38793de030044995cf23e623c5e3648d9b00501f97ff9343
-
memory/4272-134-0x0000000000000000-mapping.dmp
-
memory/4480-115-0x0000000000000000-mapping.dmp
-
memory/4512-127-0x0000000005EB0000-0x0000000005EB1000-memory.dmpFilesize
4KB
-
memory/4512-129-0x0000000005B90000-0x0000000005B91000-memory.dmpFilesize
4KB
-
memory/4512-130-0x0000000005A40000-0x0000000005A41000-memory.dmpFilesize
4KB
-
memory/4512-131-0x00000000059B0000-0x0000000005EAE000-memory.dmpFilesize
5.0MB
-
memory/4512-128-0x0000000005A50000-0x0000000005A51000-memory.dmpFilesize
4KB
-
memory/4512-121-0x0000000000D00000-0x0000000001418000-memory.dmpFilesize
7.1MB
-
memory/4512-122-0x0000000000D1E792-mapping.dmp
-
memory/4512-136-0x0000000005B60000-0x0000000005B65000-memory.dmpFilesize
20KB
-
memory/4512-137-0x0000000005B70000-0x0000000005B76000-memory.dmpFilesize
24KB
-
memory/4512-138-0x0000000005E90000-0x0000000005EA9000-memory.dmpFilesize
100KB
-
memory/4512-139-0x0000000005D30000-0x0000000005D33000-memory.dmpFilesize
12KB
-
memory/4700-132-0x0000000000000000-mapping.dmp