Analysis
-
max time kernel
146s -
max time network
161s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
23-10-2021 19:31
Static task
static1
Behavioral task
behavioral1
Sample
DRAFT BL-DOCS-20211510-VP-KMC022021.scr
Resource
win7-en-20211014
General
-
Target
DRAFT BL-DOCS-20211510-VP-KMC022021.scr
-
Size
382KB
-
MD5
bc87c171c5e5c075ebcb336ca4518452
-
SHA1
29854b8268bb99a6f26df87229107fcfbf815d87
-
SHA256
bb08e42bfb63552a1af7ab0e24bb040c9f2854f2521fda176e80c80dd17beec7
-
SHA512
85509f5e3eebbecd909da16102a9183484d1c88d269cf541bd20cca6dd6fd9ffddda27f84f441f2ec07dd91b3db600524dedd59886d8f4543d5ccb6f2f68dbae
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.75:97
75237636-ccfc-402a-827d-5ad01371659e
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-24T01:53:34.394429836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
97
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
75237636-ccfc-402a-827d-5ad01371659e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.140.53.75
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DRAFT BL-DOCS-20211510-VP-KMC022021.scrdescription pid process target process PID 708 set thread context of 2796 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisvc.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 920 schtasks.exe 1248 schtasks.exe 4576 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DRAFT BL-DOCS-20211510-VP-KMC022021.scrpowershell.exeRegSvcs.exepid process 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr 3960 powershell.exe 2796 RegSvcs.exe 2796 RegSvcs.exe 2796 RegSvcs.exe 3960 powershell.exe 3960 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2796 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DRAFT BL-DOCS-20211510-VP-KMC022021.scrpowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr Token: SeDebugPrivilege 3960 powershell.exe Token: SeDebugPrivilege 2796 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
DRAFT BL-DOCS-20211510-VP-KMC022021.scrRegSvcs.exedescription pid process target process PID 708 wrote to memory of 3960 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr powershell.exe PID 708 wrote to memory of 3960 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr powershell.exe PID 708 wrote to memory of 3960 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr powershell.exe PID 708 wrote to memory of 4576 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr schtasks.exe PID 708 wrote to memory of 4576 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr schtasks.exe PID 708 wrote to memory of 4576 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr schtasks.exe PID 708 wrote to memory of 2796 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr RegSvcs.exe PID 708 wrote to memory of 2796 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr RegSvcs.exe PID 708 wrote to memory of 2796 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr RegSvcs.exe PID 708 wrote to memory of 2796 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr RegSvcs.exe PID 708 wrote to memory of 2796 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr RegSvcs.exe PID 708 wrote to memory of 2796 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr RegSvcs.exe PID 708 wrote to memory of 2796 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr RegSvcs.exe PID 708 wrote to memory of 2796 708 DRAFT BL-DOCS-20211510-VP-KMC022021.scr RegSvcs.exe PID 2796 wrote to memory of 920 2796 RegSvcs.exe schtasks.exe PID 2796 wrote to memory of 920 2796 RegSvcs.exe schtasks.exe PID 2796 wrote to memory of 920 2796 RegSvcs.exe schtasks.exe PID 2796 wrote to memory of 1248 2796 RegSvcs.exe schtasks.exe PID 2796 wrote to memory of 1248 2796 RegSvcs.exe schtasks.exe PID 2796 wrote to memory of 1248 2796 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DRAFT BL-DOCS-20211510-VP-KMC022021.scr"C:\Users\Admin\AppData\Local\Temp\DRAFT BL-DOCS-20211510-VP-KMC022021.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DRAFT BL-DOCS-20211510-VP-KMC022021.scr"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlzcRkmDiOmdD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5D00.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5EC6.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5F63.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5EC6.tmpMD5
40b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmp5F63.tmpMD5
4e71faa3a77029484cfaba423d96618f
SHA19c837d050bb43d69dc608af809c292e13bca4718
SHA256c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb
SHA5126d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0
-
memory/708-115-0x0000000002A60000-0x0000000002A61000-memory.dmpFilesize
4KB
-
memory/920-125-0x0000000000000000-mapping.dmp
-
memory/1248-127-0x0000000000000000-mapping.dmp
-
memory/2796-135-0x0000000002811000-0x0000000002812000-memory.dmpFilesize
4KB
-
memory/2796-118-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2796-119-0x000000000041E792-mapping.dmp
-
memory/2796-122-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/3960-129-0x00000000071A0000-0x00000000071A1000-memory.dmpFilesize
4KB
-
memory/3960-116-0x0000000000000000-mapping.dmp
-
memory/3960-123-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/3960-120-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/3960-121-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/3960-229-0x0000000007093000-0x0000000007094000-memory.dmpFilesize
4KB
-
memory/3960-130-0x0000000007440000-0x0000000007441000-memory.dmpFilesize
4KB
-
memory/3960-131-0x00000000074B0000-0x00000000074B1000-memory.dmpFilesize
4KB
-
memory/3960-132-0x0000000007D40000-0x0000000007D41000-memory.dmpFilesize
4KB
-
memory/3960-133-0x0000000007090000-0x0000000007091000-memory.dmpFilesize
4KB
-
memory/3960-134-0x0000000007092000-0x0000000007093000-memory.dmpFilesize
4KB
-
memory/3960-124-0x00000000076D0000-0x00000000076D1000-memory.dmpFilesize
4KB
-
memory/3960-136-0x00000000076A0000-0x00000000076A1000-memory.dmpFilesize
4KB
-
memory/3960-137-0x0000000008580000-0x0000000008581000-memory.dmpFilesize
4KB
-
memory/3960-138-0x0000000008450000-0x0000000008451000-memory.dmpFilesize
4KB
-
memory/3960-139-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/3960-146-0x00000000091D0000-0x0000000009203000-memory.dmpFilesize
204KB
-
memory/3960-153-0x00000000091B0000-0x00000000091B1000-memory.dmpFilesize
4KB
-
memory/3960-158-0x0000000009320000-0x0000000009321000-memory.dmpFilesize
4KB
-
memory/3960-159-0x000000007F120000-0x000000007F121000-memory.dmpFilesize
4KB
-
memory/3960-160-0x0000000009700000-0x0000000009701000-memory.dmpFilesize
4KB
-
memory/4576-117-0x0000000000000000-mapping.dmp