Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
15-04-2022 00:48
Static task
static1
Behavioral task
behavioral1
Sample
6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe
Resource
win7-20220414-en
General
-
Target
6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe
-
Size
462KB
-
MD5
48d86934fb781685122dfcdae8e4f256
-
SHA1
538e07a3422df1b78540849ab02a69097435adf8
-
SHA256
6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01
-
SHA512
aacaa639400595e66ed86ed69619eae9c5f22882b1a3119d272f8b9af5f1d03212d800813ba66a09a3fd0bda3dbcd6ef6b14eeceafa9b61c40470525af989c16
Malware Config
Extracted
nanocore
1.2.2.0
niiarmah.kozow.com:9301
ef42b77b-c8cc-45cb-b0b4-e774d77e37ba
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-08-21T18:37:07.916019536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9301
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ef42b77b-c8cc-45cb-b0b4-e774d77e37ba
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
niiarmah.kozow.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3628 svhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svhost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1356 set thread context of 3628 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
pid Process 1716 timeout.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Security\Updates.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 3628 svhost.exe 3628 svhost.exe 3628 svhost.exe 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3628 svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe Token: SeDebugPrivilege 3628 svhost.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1356 wrote to memory of 3628 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 82 PID 1356 wrote to memory of 3628 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 82 PID 1356 wrote to memory of 3628 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 82 PID 1356 wrote to memory of 3628 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 82 PID 1356 wrote to memory of 3628 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 82 PID 1356 wrote to memory of 3628 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 82 PID 1356 wrote to memory of 3628 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 82 PID 1356 wrote to memory of 3628 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 82 PID 1356 wrote to memory of 2004 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 83 PID 1356 wrote to memory of 2004 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 83 PID 1356 wrote to memory of 2004 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 83 PID 1356 wrote to memory of 4612 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 85 PID 1356 wrote to memory of 4612 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 85 PID 1356 wrote to memory of 4612 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 85 PID 4612 wrote to memory of 2344 4612 cmd.exe 87 PID 4612 wrote to memory of 2344 4612 cmd.exe 87 PID 4612 wrote to memory of 2344 4612 cmd.exe 87 PID 1356 wrote to memory of 2580 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 88 PID 1356 wrote to memory of 2580 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 88 PID 1356 wrote to memory of 2580 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 88 PID 1356 wrote to memory of 4684 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 90 PID 1356 wrote to memory of 4684 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 90 PID 1356 wrote to memory of 4684 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 90 PID 1356 wrote to memory of 876 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 92 PID 1356 wrote to memory of 876 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 92 PID 1356 wrote to memory of 876 1356 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe 92 PID 876 wrote to memory of 1716 876 cmd.exe 94 PID 876 wrote to memory of 1716 876 cmd.exe 94 PID 876 wrote to memory of 1716 876 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe"C:\Users\Admin\AppData\Local\Temp\6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe" "%appdata%\Security\Updates.exe" /Y2⤵PID:2004
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Security\Updates.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\Updates.exe.lnk" /f3⤵PID:2344
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Security\Updates.exe:Zone.Identifier2⤵
- NTFS ADS
PID:2580
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "%appdata%\Security\Updates.exe.jpg" Updates.exe2⤵PID:4684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Security\Updates.exe.bat2⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
PID:1716
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
Filesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
Filesize
462KB
MD548d86934fb781685122dfcdae8e4f256
SHA1538e07a3422df1b78540849ab02a69097435adf8
SHA2566f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01
SHA512aacaa639400595e66ed86ed69619eae9c5f22882b1a3119d272f8b9af5f1d03212d800813ba66a09a3fd0bda3dbcd6ef6b14eeceafa9b61c40470525af989c16
-
Filesize
205B
MD589c271e144581e0e00347269b020a002
SHA1ad9fe3d0aaf5579f17004982aa1ea53afee6d0d2
SHA256fa4f71efddbbc88768574504f59ca283911cb40cc0ca52185e782436342945a8
SHA512ea099eaf12aa74947171f861af1ee2223178942c722b08e45158dfb85c32fe6f38d61b5f5fea86223b5faede58f32cb6d0661cbdc9a29b78918e9b057bde1ed1