Analysis
-
max time kernel
121s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-10-2021 16:45
Static task
static1
Behavioral task
behavioral1
Sample
0475ed517da8a71bc4a87f14a44cf8fe.exe
Resource
win7-en-20211014
General
-
Target
0475ed517da8a71bc4a87f14a44cf8fe.exe
-
Size
12KB
-
MD5
0475ed517da8a71bc4a87f14a44cf8fe
-
SHA1
311e146bcc1a342ab135240e0c8e31730f8ad879
-
SHA256
f475dda218513a22edc7ec2e734fb91ddf60dc7b38b87e7de487de6fe9307e47
-
SHA512
9087831b5e355f48d38df716982125865aefde794ad8c1ecdd68606a4a338182eff4a2b7bcf7dc29098178b9fd485a599eae2a011f01257536c3b0b0f9ac5f58
Malware Config
Extracted
nanocore
1.2.2.0
fridaycav.duckdns.org:6400
453aeca4-8168-43fd-806a-925b22b64441
-
activate_away_mode
true
-
backup_connection_host
fridaycav.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-20T17:51:18.465757636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6400
-
default_group
FRIDAY CAV
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
453aeca4-8168-43fd-806a-925b22b64441
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
fridaycav.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 0475ed517da8a71bc4a87f14a44cf8fe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 0475ed517da8a71bc4a87f14a44cf8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\䯶䰍䯷䯳䰒䯯䰤䯷䰥䰔䯸䰤䰄䯰䰀\svchost.exe = "0" 0475ed517da8a71bc4a87f14a44cf8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe = "0" 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exepid process 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exedescription pid process target process PID 3728 set thread context of 396 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 928 3728 WerFault.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
powershell.exe0475ed517da8a71bc4a87f14a44cf8fe.exepowershell.exepowershell.exe0475ed517da8a71bc4a87f14a44cf8fe.exeWerFault.exepid process 1136 powershell.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 68 powershell.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 1524 powershell.exe 68 powershell.exe 1524 powershell.exe 1136 powershell.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 68 powershell.exe 1524 powershell.exe 1136 powershell.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe 396 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exepid process 396 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exepowershell.exepowershell.exepowershell.exeWerFault.exe0475ed517da8a71bc4a87f14a44cf8fe.exedescription pid process Token: SeDebugPrivilege 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe Token: SeDebugPrivilege 1136 powershell.exe Token: SeDebugPrivilege 1524 powershell.exe Token: SeDebugPrivilege 68 powershell.exe Token: SeRestorePrivilege 928 WerFault.exe Token: SeBackupPrivilege 928 WerFault.exe Token: SeDebugPrivilege 396 0475ed517da8a71bc4a87f14a44cf8fe.exe Token: SeDebugPrivilege 928 WerFault.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exedescription pid process target process PID 3728 wrote to memory of 1136 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 3728 wrote to memory of 1136 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 3728 wrote to memory of 1136 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 3728 wrote to memory of 1524 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 3728 wrote to memory of 1524 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 3728 wrote to memory of 1524 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 3728 wrote to memory of 68 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 3728 wrote to memory of 68 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 3728 wrote to memory of 68 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 3728 wrote to memory of 396 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 3728 wrote to memory of 396 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 3728 wrote to memory of 396 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 3728 wrote to memory of 396 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 3728 wrote to memory of 396 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 3728 wrote to memory of 396 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 3728 wrote to memory of 396 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 3728 wrote to memory of 396 3728 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\䯶䰍䯷䯳䰒䯯䰤䯷䰥䰔䯸䰤䰄䯰䰀\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\䯶䰍䯷䯳䰒䯯䰤䯷䰥䰔䯸䰤䰄䯰䰀\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 21762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
7107d519fbc68e9d1017ba2ca52ba7b6
SHA16c4c1f41055ea40105364b5850ac1463fecabfc1
SHA25662048315d6807a02a8c0ca437c7e1ac6cd15b1d3ba3ce95c64b7db98fe478297
SHA512907049cad2ffeae2900e9b5ebf6f3f7e9155d24ea87cd4a9184faa38bdc20f5bfc706f710404d939e54d89118f0499e39761e5e880fc580b984701e0a7f79021
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
bdca0ab0865dc63f66f579be0cf44d68
SHA13148b0bd3ea9ffe99d0722ecb4f66f9949389cfe
SHA256b6159b51ac063ad39b3b9005b2e47c57afc28ad176e65ae606887a691ef4a795
SHA512671d6f717680e82c39de7cea1d12cf8818f3edddbc6dffc0fe34f3a300d1bd043be448e5fc6416d65733abbe91b1cf04fd91e8de2efdbfcc7aa83a2772db7621
-
memory/68-158-0x00000000066D2000-0x00000000066D3000-memory.dmpFilesize
4KB
-
memory/68-157-0x00000000066D0000-0x00000000066D1000-memory.dmpFilesize
4KB
-
memory/68-218-0x000000007F4C0000-0x000000007F4C1000-memory.dmpFilesize
4KB
-
memory/68-179-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/68-135-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/68-142-0x0000000006C80000-0x0000000006C81000-memory.dmpFilesize
4KB
-
memory/68-260-0x00000000066D3000-0x00000000066D4000-memory.dmpFilesize
4KB
-
memory/68-126-0x0000000000000000-mapping.dmp
-
memory/68-131-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/396-172-0x0000000005740000-0x0000000005C3E000-memory.dmpFilesize
5.0MB
-
memory/396-173-0x0000000005700000-0x0000000005705000-memory.dmpFilesize
20KB
-
memory/396-174-0x0000000005710000-0x0000000005729000-memory.dmpFilesize
100KB
-
memory/396-175-0x00000000057D0000-0x00000000057D3000-memory.dmpFilesize
12KB
-
memory/396-141-0x000000000041E792-mapping.dmp
-
memory/396-140-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1136-128-0x0000000002FA0000-0x0000000002FA1000-memory.dmpFilesize
4KB
-
memory/1136-160-0x0000000007D30000-0x0000000007D31000-memory.dmpFilesize
4KB
-
memory/1136-258-0x0000000006DE3000-0x0000000006DE4000-memory.dmpFilesize
4KB
-
memory/1136-132-0x0000000006D80000-0x0000000006D81000-memory.dmpFilesize
4KB
-
memory/1136-223-0x000000007F3A0000-0x000000007F3A1000-memory.dmpFilesize
4KB
-
memory/1136-144-0x0000000006DE0000-0x0000000006DE1000-memory.dmpFilesize
4KB
-
memory/1136-181-0x0000000002FA0000-0x0000000002FA1000-memory.dmpFilesize
4KB
-
memory/1136-153-0x0000000006DE2000-0x0000000006DE3000-memory.dmpFilesize
4KB
-
memory/1136-124-0x0000000000000000-mapping.dmp
-
memory/1136-127-0x0000000002FA0000-0x0000000002FA1000-memory.dmpFilesize
4KB
-
memory/1136-168-0x00000000085C0000-0x00000000085C1000-memory.dmpFilesize
4KB
-
memory/1524-148-0x0000000007050000-0x0000000007051000-memory.dmpFilesize
4KB
-
memory/1524-183-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/1524-163-0x00000000080B0000-0x00000000080B1000-memory.dmpFilesize
4KB
-
memory/1524-166-0x0000000007E90000-0x0000000007E91000-memory.dmpFilesize
4KB
-
memory/1524-257-0x0000000007053000-0x0000000007054000-memory.dmpFilesize
4KB
-
memory/1524-129-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/1524-125-0x0000000000000000-mapping.dmp
-
memory/1524-136-0x0000000007690000-0x0000000007691000-memory.dmpFilesize
4KB
-
memory/1524-130-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/1524-213-0x000000007EFF0000-0x000000007EFF1000-memory.dmpFilesize
4KB
-
memory/1524-149-0x0000000007E20000-0x0000000007E21000-memory.dmpFilesize
4KB
-
memory/1524-155-0x0000000007052000-0x0000000007053000-memory.dmpFilesize
4KB
-
memory/3728-122-0x00000000079B0000-0x00000000079B1000-memory.dmpFilesize
4KB
-
memory/3728-121-0x0000000003150000-0x00000000031DF000-memory.dmpFilesize
572KB
-
memory/3728-123-0x0000000008E70000-0x0000000008E71000-memory.dmpFilesize
4KB
-
memory/3728-115-0x0000000000F20000-0x0000000000F21000-memory.dmpFilesize
4KB
-
memory/3728-134-0x0000000008FE0000-0x0000000008FE1000-memory.dmpFilesize
4KB
-
memory/3728-120-0x00000000056B0000-0x0000000005BAE000-memory.dmpFilesize
5.0MB
-
memory/3728-119-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/3728-118-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/3728-117-0x0000000005BB0000-0x0000000005BB1000-memory.dmpFilesize
4KB