Analysis
-
max time kernel
130s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-10-2021 19:35
Static task
static1
Behavioral task
behavioral1
Sample
n2m18_Payment_receipt.js
Resource
win7-en-20211014
General
-
Target
n2m18_Payment_receipt.js
-
Size
81KB
-
MD5
b52fe288ee67ceccaeee80dc4749c358
-
SHA1
38c1641f3aa617170306572bfd41e8a30b42d693
-
SHA256
0aeb9b8280cf3a77ec5e44ff5b3866aa17f011a1e0b47dd7b70133d8fd607b56
-
SHA512
dbf83aee7ad7a2691883226a5a960a3b7e7484fcc96a4023572f30e4e34e35647ecf52b918f5323f625a474183bf716e01ab580ab13329d56638677643418c43
Malware Config
Extracted
nanocore
1.2.2.0
kenimaf.duckdns.org:8090
543e7469-d950-4ec2-a110-de54f8d16167
-
activate_away_mode
true
-
backup_connection_host
kenimaf.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-08-01T06:39:50.225932136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8090
-
default_group
kenn
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
543e7469-d950-4ec2-a110-de54f8d16167
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
kenimaf.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
vjw0rm
http://6200js.duckdns.org:6200
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Blocklisted process makes network request 5 IoCs
Processes:
wscript.exeflow pid process 9 3728 wscript.exe 27 3728 wscript.exe 28 3728 wscript.exe 30 3728 wscript.exe 32 3728 wscript.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
hqbo6d7.exehqbo6d7.exepid process 1656 hqbo6d7.exe 1368 hqbo6d7.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n2m18_Payment_receipt.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n2m18_Payment_receipt.js wscript.exe -
Processes:
hqbo6d7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths hqbo6d7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions hqbo6d7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\\svchost.exe = "0" hqbo6d7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\hqbo6d7.exe = "0" hqbo6d7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\BB4HJP0E1C = "'C:\\Users\\Admin\\AppData\\Local\\Temp\\n2m18_Payment_receipt.js'" wscript.exe -
Processes:
hqbo6d7.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hqbo6d7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
hqbo6d7.exepid process 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hqbo6d7.exedescription pid process target process PID 1656 set thread context of 1368 1656 hqbo6d7.exe hqbo6d7.exe -
Drops file in Windows directory 2 IoCs
Processes:
hqbo6d7.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\\svchost.exe hqbo6d7.exe File opened for modification C:\Windows\Microsoft.NET\Framework\\svchost.exe hqbo6d7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 8 1656 WerFault.exe hqbo6d7.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
powershell.exehqbo6d7.exepowershell.exepowershell.exehqbo6d7.exeWerFault.exepid process 1856 powershell.exe 1656 hqbo6d7.exe 1516 powershell.exe 1656 hqbo6d7.exe 1656 hqbo6d7.exe 1520 powershell.exe 1520 powershell.exe 1856 powershell.exe 1516 powershell.exe 1368 hqbo6d7.exe 1368 hqbo6d7.exe 1368 hqbo6d7.exe 1856 powershell.exe 1516 powershell.exe 1520 powershell.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 1368 hqbo6d7.exe 1368 hqbo6d7.exe 1368 hqbo6d7.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
hqbo6d7.exepowershell.exepowershell.exepowershell.exeWerFault.exehqbo6d7.exedescription pid process Token: SeDebugPrivilege 1656 hqbo6d7.exe Token: SeDebugPrivilege 1856 powershell.exe Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 1516 powershell.exe Token: SeRestorePrivilege 8 WerFault.exe Token: SeBackupPrivilege 8 WerFault.exe Token: SeDebugPrivilege 1368 hqbo6d7.exe Token: SeDebugPrivilege 8 WerFault.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
wscript.exehqbo6d7.exedescription pid process target process PID 3728 wrote to memory of 816 3728 wscript.exe schtasks.exe PID 3728 wrote to memory of 816 3728 wscript.exe schtasks.exe PID 3728 wrote to memory of 1656 3728 wscript.exe hqbo6d7.exe PID 3728 wrote to memory of 1656 3728 wscript.exe hqbo6d7.exe PID 3728 wrote to memory of 1656 3728 wscript.exe hqbo6d7.exe PID 1656 wrote to memory of 1516 1656 hqbo6d7.exe powershell.exe PID 1656 wrote to memory of 1516 1656 hqbo6d7.exe powershell.exe PID 1656 wrote to memory of 1516 1656 hqbo6d7.exe powershell.exe PID 1656 wrote to memory of 1520 1656 hqbo6d7.exe powershell.exe PID 1656 wrote to memory of 1520 1656 hqbo6d7.exe powershell.exe PID 1656 wrote to memory of 1520 1656 hqbo6d7.exe powershell.exe PID 1656 wrote to memory of 1856 1656 hqbo6d7.exe powershell.exe PID 1656 wrote to memory of 1856 1656 hqbo6d7.exe powershell.exe PID 1656 wrote to memory of 1856 1656 hqbo6d7.exe powershell.exe PID 1656 wrote to memory of 1368 1656 hqbo6d7.exe hqbo6d7.exe PID 1656 wrote to memory of 1368 1656 hqbo6d7.exe hqbo6d7.exe PID 1656 wrote to memory of 1368 1656 hqbo6d7.exe hqbo6d7.exe PID 1656 wrote to memory of 1368 1656 hqbo6d7.exe hqbo6d7.exe PID 1656 wrote to memory of 1368 1656 hqbo6d7.exe hqbo6d7.exe PID 1656 wrote to memory of 1368 1656 hqbo6d7.exe hqbo6d7.exe PID 1656 wrote to memory of 1368 1656 hqbo6d7.exe hqbo6d7.exe PID 1656 wrote to memory of 1368 1656 hqbo6d7.exe hqbo6d7.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\n2m18_Payment_receipt.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\Admin\AppData\Local\Temp\n2m18_Payment_receipt.js2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\hqbo6d7.exe"C:\Users\Admin\AppData\Local\Temp\hqbo6d7.exe"2⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\\svchost.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\hqbo6d7.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\\svchost.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\hqbo6d7.exe"C:\Users\Admin\AppData\Local\Temp\hqbo6d7.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 22603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hqbo6d7.exeMD5
5429e76da1a8200f93eb9655d3b86a07
SHA149250d67b4427a41ac8ce27c62c09e1d1d6c15f0
SHA25656a84cc9c44d6db19720b5594362b74a683cc83d3f454a135fe6698269b364d3
SHA51295f6a6ea27f50c8c0b10bb1b6f8c6f0c75daecbb9f39f3a8bdc1b8bb4cebf4f6d1e12ad6b7890842e87aad7f07891db6624bbf23a40f4ebb4e1de839a0617ac1
-
C:\Users\Admin\AppData\Local\Temp\hqbo6d7.exeMD5
5429e76da1a8200f93eb9655d3b86a07
SHA149250d67b4427a41ac8ce27c62c09e1d1d6c15f0
SHA25656a84cc9c44d6db19720b5594362b74a683cc83d3f454a135fe6698269b364d3
SHA51295f6a6ea27f50c8c0b10bb1b6f8c6f0c75daecbb9f39f3a8bdc1b8bb4cebf4f6d1e12ad6b7890842e87aad7f07891db6624bbf23a40f4ebb4e1de839a0617ac1
-
C:\Users\Admin\AppData\Local\Temp\hqbo6d7.exeMD5
5429e76da1a8200f93eb9655d3b86a07
SHA149250d67b4427a41ac8ce27c62c09e1d1d6c15f0
SHA25656a84cc9c44d6db19720b5594362b74a683cc83d3f454a135fe6698269b364d3
SHA51295f6a6ea27f50c8c0b10bb1b6f8c6f0c75daecbb9f39f3a8bdc1b8bb4cebf4f6d1e12ad6b7890842e87aad7f07891db6624bbf23a40f4ebb4e1de839a0617ac1
-
memory/816-115-0x0000000000000000-mapping.dmp
-
memory/1368-179-0x0000000006220000-0x0000000006239000-memory.dmpFilesize
100KB
-
memory/1368-194-0x0000000006AF0000-0x0000000006AF6000-memory.dmpFilesize
24KB
-
memory/1368-193-0x0000000006AB0000-0x0000000006AC5000-memory.dmpFilesize
84KB
-
memory/1368-192-0x0000000006350000-0x000000000635D000-memory.dmpFilesize
52KB
-
memory/1368-153-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1368-155-0x000000000041E792-mapping.dmp
-
memory/1368-176-0x0000000005AD0000-0x0000000005AD5000-memory.dmpFilesize
20KB
-
memory/1368-182-0x00000000055F0000-0x0000000005AEE000-memory.dmpFilesize
5.0MB
-
memory/1368-181-0x0000000005AE0000-0x0000000005AE3000-memory.dmpFilesize
12KB
-
memory/1516-235-0x000000007ECA0000-0x000000007ECA1000-memory.dmpFilesize
4KB
-
memory/1516-135-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/1516-145-0x0000000001330000-0x0000000001331000-memory.dmpFilesize
4KB
-
memory/1516-129-0x0000000000000000-mapping.dmp
-
memory/1516-277-0x0000000001333000-0x0000000001334000-memory.dmpFilesize
4KB
-
memory/1516-132-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/1516-183-0x0000000007F50000-0x0000000007F51000-memory.dmpFilesize
4KB
-
memory/1516-190-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/1516-149-0x0000000001332000-0x0000000001333000-memory.dmpFilesize
4KB
-
memory/1520-133-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/1520-243-0x000000007E720000-0x000000007E721000-memory.dmpFilesize
4KB
-
memory/1520-282-0x0000000003440000-0x000000000358A000-memory.dmpFilesize
1.3MB
-
memory/1520-147-0x0000000003440000-0x000000000358A000-memory.dmpFilesize
1.3MB
-
memory/1520-134-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/1520-150-0x0000000003440000-0x000000000358A000-memory.dmpFilesize
1.3MB
-
memory/1520-188-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/1520-130-0x0000000000000000-mapping.dmp
-
memory/1656-119-0x0000000000D70000-0x0000000000D71000-memory.dmpFilesize
4KB
-
memory/1656-116-0x0000000000000000-mapping.dmp
-
memory/1656-121-0x0000000005740000-0x0000000005741000-memory.dmpFilesize
4KB
-
memory/1656-122-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/1656-123-0x0000000005660000-0x0000000005663000-memory.dmpFilesize
12KB
-
memory/1656-127-0x0000000007960000-0x00000000079EC000-memory.dmpFilesize
560KB
-
memory/1656-151-0x0000000007B20000-0x0000000007B21000-memory.dmpFilesize
4KB
-
memory/1656-128-0x000000000C2B0000-0x000000000C2B1000-memory.dmpFilesize
4KB
-
memory/1656-141-0x0000000008B60000-0x0000000008B61000-memory.dmpFilesize
4KB
-
memory/1856-138-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/1856-173-0x0000000007A70000-0x0000000007A71000-memory.dmpFilesize
4KB
-
memory/1856-131-0x0000000000000000-mapping.dmp
-
memory/1856-177-0x00000000080D0000-0x00000000080D1000-memory.dmpFilesize
4KB
-
memory/1856-186-0x0000000001220000-0x0000000001221000-memory.dmpFilesize
4KB
-
memory/1856-136-0x0000000001220000-0x0000000001221000-memory.dmpFilesize
4KB
-
memory/1856-167-0x0000000007C50000-0x0000000007C51000-memory.dmpFilesize
4KB
-
memory/1856-163-0x00000000079E0000-0x00000000079E1000-memory.dmpFilesize
4KB
-
memory/1856-158-0x00000000072B0000-0x00000000072B1000-memory.dmpFilesize
4KB
-
memory/1856-137-0x0000000001220000-0x0000000001221000-memory.dmpFilesize
4KB
-
memory/1856-146-0x0000000001360000-0x0000000001361000-memory.dmpFilesize
4KB
-
memory/1856-239-0x000000007F9A0000-0x000000007F9A1000-memory.dmpFilesize
4KB
-
memory/1856-142-0x00000000073B0000-0x00000000073B1000-memory.dmpFilesize
4KB
-
memory/1856-152-0x0000000007190000-0x0000000007191000-memory.dmpFilesize
4KB
-
memory/1856-148-0x0000000001362000-0x0000000001363000-memory.dmpFilesize
4KB
-
memory/1856-285-0x0000000001363000-0x0000000001364000-memory.dmpFilesize
4KB