Analysis
-
max time kernel
133s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:37
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7-20220414-en
General
-
Target
Order.exe
-
Size
373KB
-
MD5
77dcd9d7e5f3849d177ec4bf54e8be1d
-
SHA1
ab9579e68dbce78f60833665ee2ece5c737a8c4d
-
SHA256
c43d85dc319a3e0e9faeb9aa8967ab597ce9c7d76d78ad5d7cea309b73a7b653
-
SHA512
d5ac72a5c709d06aa72c9bed9b690555e6e8f6c7395bbda994ab43cb0eb0a086013b23e585d6d17acaed21250b5bd73465da537aa5b17bddea99c8fd83d24743
Malware Config
Extracted
nanocore
1.2.2.0
185.19.85.133:9995
127.0.0.1:9995
eb071d45-47d5-4ca7-a489-0f12cddc481f
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-01-07T00:46:43.694111036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
9995
-
default_group
BLESSED
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
eb071d45-47d5-4ca7-a489-0f12cddc481f
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.19.85.133
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order.exedescription pid process target process PID 1548 set thread context of 1132 1548 Order.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Order.exeMSBuild.exepid process 1548 Order.exe 1132 MSBuild.exe 1132 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 1132 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1548 Order.exe Token: SeDebugPrivilege 1132 MSBuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Order.exedescription pid process target process PID 1548 wrote to memory of 1088 1548 Order.exe schtasks.exe PID 1548 wrote to memory of 1088 1548 Order.exe schtasks.exe PID 1548 wrote to memory of 1088 1548 Order.exe schtasks.exe PID 1548 wrote to memory of 1088 1548 Order.exe schtasks.exe PID 1548 wrote to memory of 1132 1548 Order.exe MSBuild.exe PID 1548 wrote to memory of 1132 1548 Order.exe MSBuild.exe PID 1548 wrote to memory of 1132 1548 Order.exe MSBuild.exe PID 1548 wrote to memory of 1132 1548 Order.exe MSBuild.exe PID 1548 wrote to memory of 1132 1548 Order.exe MSBuild.exe PID 1548 wrote to memory of 1132 1548 Order.exe MSBuild.exe PID 1548 wrote to memory of 1132 1548 Order.exe MSBuild.exe PID 1548 wrote to memory of 1132 1548 Order.exe MSBuild.exe PID 1548 wrote to memory of 1132 1548 Order.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OoAKpqm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp91D5.tmp"2⤵
- Creates scheduled task(s)
PID:1088 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1132
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp91D5.tmpFilesize
1KB
MD5fa44f50d89e73b75920220cf39397bf7
SHA1c84abaef81a97ea701afdb30e84536d681d6c3b8
SHA256f1578bc73d43144cf56e5ba5ed08972ec65267019ef4fe66887b3e33ade44d92
SHA512eb69def26f9add6c58bb1a7972a44ef7de85095750d8ca290a0ba7a9d02bb9a6fa72d50982a25ebe2f657adc1c705dbddc544aec531a49f2fc02bc7ba5e50cb2
-
memory/1088-56-0x0000000000000000-mapping.dmp
-
memory/1132-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1132-58-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1132-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1132-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1132-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1132-65-0x000000000041E792-mapping.dmp
-
memory/1132-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1132-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1132-71-0x0000000074C20000-0x00000000751CB000-memory.dmpFilesize
5.7MB
-
memory/1548-55-0x0000000074C20000-0x00000000751CB000-memory.dmpFilesize
5.7MB
-
memory/1548-54-0x00000000759E1000-0x00000000759E3000-memory.dmpFilesize
8KB