Analysis
-
max time kernel
122s -
max time network
162s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-10-2021 19:34
Static task
static1
Behavioral task
behavioral1
Sample
0475ed517da8a71bc4a87f14a44cf8fe.exe
Resource
win7-en-20211014
General
-
Target
0475ed517da8a71bc4a87f14a44cf8fe.exe
-
Size
12KB
-
MD5
0475ed517da8a71bc4a87f14a44cf8fe
-
SHA1
311e146bcc1a342ab135240e0c8e31730f8ad879
-
SHA256
f475dda218513a22edc7ec2e734fb91ddf60dc7b38b87e7de487de6fe9307e47
-
SHA512
9087831b5e355f48d38df716982125865aefde794ad8c1ecdd68606a4a338182eff4a2b7bcf7dc29098178b9fd485a599eae2a011f01257536c3b0b0f9ac5f58
Malware Config
Extracted
nanocore
1.2.2.0
fridaycav.duckdns.org:6400
453aeca4-8168-43fd-806a-925b22b64441
-
activate_away_mode
true
-
backup_connection_host
fridaycav.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-20T17:51:18.465757636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6400
-
default_group
FRIDAY CAV
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
453aeca4-8168-43fd-806a-925b22b64441
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
fridaycav.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 0475ed517da8a71bc4a87f14a44cf8fe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 0475ed517da8a71bc4a87f14a44cf8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\䯶䰍䯷䯳䰒䯯䰤䯷䰥䰔䯸䰤䰄䯰䰀\svchost.exe = "0" 0475ed517da8a71bc4a87f14a44cf8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe = "0" 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exepid process 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exedescription pid process target process PID 1908 set thread context of 688 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3996 1908 WerFault.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exepowershell.exepowershell.exepowershell.exe0475ed517da8a71bc4a87f14a44cf8fe.exeWerFault.exepid process 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 700 powershell.exe 2828 powershell.exe 3192 powershell.exe 2828 powershell.exe 3192 powershell.exe 700 powershell.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 2828 powershell.exe 700 powershell.exe 3192 powershell.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe 688 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exepid process 688 0475ed517da8a71bc4a87f14a44cf8fe.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exepowershell.exepowershell.exepowershell.exe0475ed517da8a71bc4a87f14a44cf8fe.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe Token: SeDebugPrivilege 700 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe Token: SeDebugPrivilege 3192 powershell.exe Token: SeDebugPrivilege 688 0475ed517da8a71bc4a87f14a44cf8fe.exe Token: SeRestorePrivilege 3996 WerFault.exe Token: SeBackupPrivilege 3996 WerFault.exe Token: SeDebugPrivilege 3996 WerFault.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
0475ed517da8a71bc4a87f14a44cf8fe.exedescription pid process target process PID 1908 wrote to memory of 700 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 1908 wrote to memory of 700 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 1908 wrote to memory of 700 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 1908 wrote to memory of 3192 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 1908 wrote to memory of 3192 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 1908 wrote to memory of 3192 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 1908 wrote to memory of 2828 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 1908 wrote to memory of 2828 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 1908 wrote to memory of 2828 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe powershell.exe PID 1908 wrote to memory of 432 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 432 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 432 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 688 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 688 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 688 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 688 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 688 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 688 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 688 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe PID 1908 wrote to memory of 688 1908 0475ed517da8a71bc4a87f14a44cf8fe.exe 0475ed517da8a71bc4a87f14a44cf8fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\䯶䰍䯷䯳䰒䯯䰤䯷䰥䰔䯸䰤䰄䯰䰀\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\䯶䰍䯷䯳䰒䯯䰤䯷䰥䰔䯸䰤䰄䯰䰀\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"C:\Users\Admin\AppData\Local\Temp\0475ed517da8a71bc4a87f14a44cf8fe.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 21842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
35437471db9726e5ae920b766940e3a7
SHA127d6864b7f5fdd07a9eb2cfcccc4f9b236d324ba
SHA25617249bc53d039ece2d1b5ca6fdcf7d6e3eab418592201e605adb2eaf0a965e02
SHA512c50b1c77206168a2f79c8e6b387761897b3b10cb6d4c9852143151d4235d16e160c38072dfbdc750c96092ac3ac41a39b07d7d3c95ad9b4eb75fe981d59422d1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
d3cef1e28d4de96a92381678e3887aa6
SHA1ad5b97a74a2e60a9d04df40a4115ce6f752425a2
SHA256150a9b812f488f19e37c29e216390bd9dc125b32ed56ed37f681a3a2bc23abc1
SHA51216e0af40d5afd2b1997bedc109694de11a8291e77f9d38daf5e2190b972d721aa30dec46d7e9a49dc874cff064a3b3ee86058fdea2a0aceb5f5ee4cc56c20085
-
memory/688-180-0x0000000006380000-0x0000000006395000-memory.dmpFilesize
84KB
-
memory/688-169-0x0000000005170000-0x0000000005173000-memory.dmpFilesize
12KB
-
memory/688-179-0x0000000006370000-0x000000000637D000-memory.dmpFilesize
52KB
-
memory/688-181-0x00000000063C0000-0x00000000063C6000-memory.dmpFilesize
24KB
-
memory/688-146-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/688-168-0x00000000052D0000-0x00000000052E9000-memory.dmpFilesize
100KB
-
memory/688-163-0x0000000004DF0000-0x00000000052EE000-memory.dmpFilesize
5.0MB
-
memory/688-189-0x0000000006410000-0x0000000006412000-memory.dmpFilesize
8KB
-
memory/688-147-0x000000000041E792-mapping.dmp
-
memory/688-167-0x0000000005150000-0x0000000005155000-memory.dmpFilesize
20KB
-
memory/688-182-0x00000000063D0000-0x00000000063DC000-memory.dmpFilesize
48KB
-
memory/688-183-0x00000000063E0000-0x00000000063E6000-memory.dmpFilesize
24KB
-
memory/688-184-0x00000000063F0000-0x00000000063F7000-memory.dmpFilesize
28KB
-
memory/688-185-0x0000000006400000-0x000000000640D000-memory.dmpFilesize
52KB
-
memory/700-124-0x0000000000000000-mapping.dmp
-
memory/700-130-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/700-227-0x000000007EFC0000-0x000000007EFC1000-memory.dmpFilesize
4KB
-
memory/700-186-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/700-140-0x0000000000EA2000-0x0000000000EA3000-memory.dmpFilesize
4KB
-
memory/700-136-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/700-257-0x0000000000EA3000-0x0000000000EA4000-memory.dmpFilesize
4KB
-
memory/700-128-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/1908-115-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/1908-145-0x0000000008550000-0x0000000008551000-memory.dmpFilesize
4KB
-
memory/1908-123-0x00000000083E0000-0x00000000083E1000-memory.dmpFilesize
4KB
-
memory/1908-122-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/1908-121-0x0000000002760000-0x00000000027EF000-memory.dmpFilesize
572KB
-
memory/1908-120-0x0000000004E50000-0x000000000534E000-memory.dmpFilesize
5.0MB
-
memory/1908-119-0x00000000029B0000-0x00000000029B1000-memory.dmpFilesize
4KB
-
memory/1908-118-0x0000000002A50000-0x0000000002A51000-memory.dmpFilesize
4KB
-
memory/1908-117-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/2828-131-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/2828-232-0x000000007E250000-0x000000007E251000-memory.dmpFilesize
4KB
-
memory/2828-170-0x0000000006CC0000-0x0000000006CC1000-memory.dmpFilesize
4KB
-
memory/2828-173-0x0000000007E20000-0x0000000007E21000-memory.dmpFilesize
4KB
-
memory/2828-126-0x0000000000000000-mapping.dmp
-
memory/2828-157-0x0000000007560000-0x0000000007561000-memory.dmpFilesize
4KB
-
memory/2828-256-0x0000000000D43000-0x0000000000D44000-memory.dmpFilesize
4KB
-
memory/2828-142-0x0000000006D60000-0x0000000006D61000-memory.dmpFilesize
4KB
-
memory/2828-132-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/2828-139-0x0000000000D42000-0x0000000000D43000-memory.dmpFilesize
4KB
-
memory/2828-190-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/2828-138-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/2828-134-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/3192-188-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/3192-137-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/3192-224-0x000000007F2D0000-0x000000007F2D1000-memory.dmpFilesize
4KB
-
memory/3192-164-0x00000000076A0000-0x00000000076A1000-memory.dmpFilesize
4KB
-
memory/3192-141-0x0000000000C92000-0x0000000000C93000-memory.dmpFilesize
4KB
-
memory/3192-255-0x0000000000C93000-0x0000000000C94000-memory.dmpFilesize
4KB
-
memory/3192-154-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB
-
memory/3192-127-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/3192-129-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/3192-160-0x00000000074C0000-0x00000000074C1000-memory.dmpFilesize
4KB
-
memory/3192-125-0x0000000000000000-mapping.dmp