Analysis
-
max time kernel
141s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:37
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7-20220414-en
General
-
Target
Order.exe
-
Size
373KB
-
MD5
77dcd9d7e5f3849d177ec4bf54e8be1d
-
SHA1
ab9579e68dbce78f60833665ee2ece5c737a8c4d
-
SHA256
c43d85dc319a3e0e9faeb9aa8967ab597ce9c7d76d78ad5d7cea309b73a7b653
-
SHA512
d5ac72a5c709d06aa72c9bed9b690555e6e8f6c7395bbda994ab43cb0eb0a086013b23e585d6d17acaed21250b5bd73465da537aa5b17bddea99c8fd83d24743
Malware Config
Extracted
nanocore
1.2.2.0
185.19.85.133:9995
127.0.0.1:9995
eb071d45-47d5-4ca7-a489-0f12cddc481f
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-01-07T00:46:43.694111036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
9995
-
default_group
BLESSED
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
eb071d45-47d5-4ca7-a489-0f12cddc481f
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.19.85.133
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Order.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation Order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order.exedescription pid process target process PID 4760 set thread context of 1820 4760 Order.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Order.exeMSBuild.exepid process 4760 Order.exe 1820 MSBuild.exe 1820 MSBuild.exe 1820 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 1820 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 4760 Order.exe Token: SeDebugPrivilege 1820 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Order.exedescription pid process target process PID 4760 wrote to memory of 4604 4760 Order.exe schtasks.exe PID 4760 wrote to memory of 4604 4760 Order.exe schtasks.exe PID 4760 wrote to memory of 4604 4760 Order.exe schtasks.exe PID 4760 wrote to memory of 1820 4760 Order.exe MSBuild.exe PID 4760 wrote to memory of 1820 4760 Order.exe MSBuild.exe PID 4760 wrote to memory of 1820 4760 Order.exe MSBuild.exe PID 4760 wrote to memory of 1820 4760 Order.exe MSBuild.exe PID 4760 wrote to memory of 1820 4760 Order.exe MSBuild.exe PID 4760 wrote to memory of 1820 4760 Order.exe MSBuild.exe PID 4760 wrote to memory of 1820 4760 Order.exe MSBuild.exe PID 4760 wrote to memory of 1820 4760 Order.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OoAKpqm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB0E6.tmp"2⤵
- Creates scheduled task(s)
PID:4604 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1820
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB0E6.tmpFilesize
1KB
MD57e026dd945135b46ee68d5ee7ba1a96b
SHA10ebc969af33acba7f9e12b3fba01d881c4de0a7f
SHA256a00b17bf73246256302cb55b214c6a44c16ef442b38fdbe57f15fd81066c3979
SHA512f0f57a9b8e31d15aa65b914c2644823c378ff8ef528c4a642986f8b61f7d4820fff2174811dc854a7a9ed7a16180eb6d0b8f4f5a9233a5a99be5a68519b80370
-
memory/1820-133-0x0000000000000000-mapping.dmp
-
memory/1820-134-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1820-135-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB
-
memory/4604-131-0x0000000000000000-mapping.dmp
-
memory/4760-130-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB