Analysis
-
max time kernel
144s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:39
Static task
static1
Behavioral task
behavioral1
Sample
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe
Resource
win7-20220414-en
General
-
Target
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe
-
Size
341KB
-
MD5
dd6344d938dc89db0608b2822068040f
-
SHA1
233f73f424d2019128538b3650eeb1ba36525732
-
SHA256
ebf3f5dcc1e490b1c671aee03cf66d8ac200303a0615bafecabb5a55819eb0c7
-
SHA512
09a29fb0695dd071212189f11295d4cbffb2a05f4360896b75aa13a707515095a855edf9b85c9c58fa5dec68a4cf8c152b82599a63e732bae2897ed5f08bfd00
Malware Config
Extracted
nanocore
1.2.2.0
adikaremix.linkpc.net:1790
185.140.53.13:1790
9493864b-27d9-4410-9dcc-9a0c4732a1d5
-
activate_away_mode
true
-
backup_connection_host
185.140.53.13
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-21T11:14:38.887176036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1790
-
default_group
June@@
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9493864b-27d9-4410-9dcc-9a0c4732a1d5
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
adikaremix.linkpc.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Subsystem = "C:\\Program Files (x86)\\WPA Subsystem\\wpass.exe" NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription pid process target process PID 1156 set thread context of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Drops file in Program Files directory 2 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription ioc process File created C:\Program Files (x86)\WPA Subsystem\wpass.exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe File opened for modification C:\Program Files (x86)\WPA Subsystem\wpass.exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exeNOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exepid process 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe 1960 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe 1960 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exepid process 1960 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exeNOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription pid process Token: SeDebugPrivilege 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe Token: SeDebugPrivilege 1960 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription pid process target process PID 1156 wrote to memory of 2020 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe schtasks.exe PID 1156 wrote to memory of 2020 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe schtasks.exe PID 1156 wrote to memory of 2020 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe schtasks.exe PID 1156 wrote to memory of 2020 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe schtasks.exe PID 1156 wrote to memory of 2008 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 2008 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 2008 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 2008 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 2012 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 2012 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 2012 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 2012 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1720 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1720 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1720 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1720 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1996 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1996 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1996 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1996 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 1156 wrote to memory of 1960 1156 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ihuScAAQTRSrVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF80.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCF80.tmpFilesize
1KB
MD516c0e05a40ab3c46f58ca2eed202e546
SHA16cdaae801e466c922fe55e03c348d021e254a845
SHA256ade4e3e5bdb069f6ede0766bbfe06a0b9c0c001b3b353cc94fc44336ee37d378
SHA5124321a25df79c43a2b7648d562b60dfde6324f15b008b49e88ce81bfbaa4d4ed3f5585edf031a882d9a51c7fff5b4b19458d74e95140d5a25d28094f5a189b508
-
memory/1156-55-0x0000000074330000-0x00000000748DB000-memory.dmpFilesize
5.7MB
-
memory/1156-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1960-58-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1960-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1960-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1960-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1960-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1960-65-0x000000000041E792-mapping.dmp
-
memory/1960-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1960-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1960-71-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/2020-56-0x0000000000000000-mapping.dmp