Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:31
Static task
static1
Behavioral task
behavioral1
Sample
INV 25527777 REVIEW 779.exe
Resource
win7-20220414-en
General
-
Target
INV 25527777 REVIEW 779.exe
-
Size
533KB
-
MD5
d19fe1e1749edf58558c1e2a5e857853
-
SHA1
70da6330ffde9c61b12a8299a4c2a5099126c59e
-
SHA256
9ca497f6231180ec374837cf77e099a25e8c5cffa16c6599739c92ee03a94d34
-
SHA512
0d5d2bc03a186f0421d401e6fdc74a1e546ba5164233da80e431772bba541438249cea0d14539a8f357c0d093f748c822fb1f2216dd34d4d4e7d366c1b1c744b
Malware Config
Extracted
nanocore
1.2.2.0
looipoko.loseyourip.com:5088
titiaty.duckdns.org:5088
62d96b8a-7e31-4a94-94dd-9033707313e4
-
activate_away_mode
true
-
backup_connection_host
titiaty.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-14T21:42:17.597528436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5088
-
default_group
ssales
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
62d96b8a-7e31-4a94-94dd-9033707313e4
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
looipoko.loseyourip.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
INV 25527777 REVIEW 779.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA INV 25527777 REVIEW 779.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INV 25527777 REVIEW 779.exedescription pid process target process PID 1836 set thread context of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
INV 25527777 REVIEW 779.exeINV 25527777 REVIEW 779.exepid process 1836 INV 25527777 REVIEW 779.exe 1668 INV 25527777 REVIEW 779.exe 1668 INV 25527777 REVIEW 779.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
INV 25527777 REVIEW 779.exepid process 1668 INV 25527777 REVIEW 779.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
INV 25527777 REVIEW 779.exeINV 25527777 REVIEW 779.exedescription pid process Token: SeDebugPrivilege 1836 INV 25527777 REVIEW 779.exe Token: SeDebugPrivilege 1668 INV 25527777 REVIEW 779.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
INV 25527777 REVIEW 779.exedescription pid process target process PID 1836 wrote to memory of 1016 1836 INV 25527777 REVIEW 779.exe schtasks.exe PID 1836 wrote to memory of 1016 1836 INV 25527777 REVIEW 779.exe schtasks.exe PID 1836 wrote to memory of 1016 1836 INV 25527777 REVIEW 779.exe schtasks.exe PID 1836 wrote to memory of 1016 1836 INV 25527777 REVIEW 779.exe schtasks.exe PID 1836 wrote to memory of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe PID 1836 wrote to memory of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe PID 1836 wrote to memory of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe PID 1836 wrote to memory of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe PID 1836 wrote to memory of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe PID 1836 wrote to memory of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe PID 1836 wrote to memory of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe PID 1836 wrote to memory of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe PID 1836 wrote to memory of 1668 1836 INV 25527777 REVIEW 779.exe INV 25527777 REVIEW 779.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV 25527777 REVIEW 779.exe"C:\Users\Admin\AppData\Local\Temp\INV 25527777 REVIEW 779.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCD4E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\INV 25527777 REVIEW 779.exe"C:\Users\Admin\AppData\Local\Temp\INV 25527777 REVIEW 779.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCD4E.tmpFilesize
1KB
MD5c5e5a486021e6137551a468cae265a0f
SHA13f6695a9cb933ec75a064cd18dbb6fb5e8e9ac75
SHA256bfce6d0113e09a260e399ae12b7620c7ac495ca8fedf8093a50b9e55b687bf02
SHA5125947c65bbf87b30f7213aae37c024c8645c4499531846a4fd8318e854a357a1dca928080b481626c2c1606b9e8ebdafd88dd1830e09a11fc5aeb8bc057b028cf
-
memory/1016-59-0x0000000000000000-mapping.dmp
-
memory/1668-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1668-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1668-76-0x00000000006F0000-0x00000000006FA000-memory.dmpFilesize
40KB
-
memory/1668-75-0x0000000000720000-0x000000000073E000-memory.dmpFilesize
120KB
-
memory/1668-74-0x0000000000500000-0x000000000050A000-memory.dmpFilesize
40KB
-
memory/1668-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1668-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1668-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1668-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1668-68-0x000000000041E792-mapping.dmp
-
memory/1668-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1836-55-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB
-
memory/1836-54-0x0000000001390000-0x000000000141C000-memory.dmpFilesize
560KB
-
memory/1836-57-0x0000000004960000-0x00000000049B2000-memory.dmpFilesize
328KB
-
memory/1836-56-0x00000000005B0000-0x00000000005BA000-memory.dmpFilesize
40KB
-
memory/1836-58-0x0000000004FB0000-0x0000000004FEA000-memory.dmpFilesize
232KB