Analysis
-
max time kernel
158s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:39
Static task
static1
Behavioral task
behavioral1
Sample
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe
Resource
win7-20220414-en
General
-
Target
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe
-
Size
341KB
-
MD5
dd6344d938dc89db0608b2822068040f
-
SHA1
233f73f424d2019128538b3650eeb1ba36525732
-
SHA256
ebf3f5dcc1e490b1c671aee03cf66d8ac200303a0615bafecabb5a55819eb0c7
-
SHA512
09a29fb0695dd071212189f11295d4cbffb2a05f4360896b75aa13a707515095a855edf9b85c9c58fa5dec68a4cf8c152b82599a63e732bae2897ed5f08bfd00
Malware Config
Extracted
nanocore
1.2.2.0
adikaremix.linkpc.net:1790
185.140.53.13:1790
9493864b-27d9-4410-9dcc-9a0c4732a1d5
-
activate_away_mode
true
-
backup_connection_host
185.140.53.13
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-21T11:14:38.887176036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1790
-
default_group
June@@
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9493864b-27d9-4410-9dcc-9a0c4732a1d5
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
adikaremix.linkpc.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsvc.exe" NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription pid process target process PID 3912 set thread context of 2812 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Drops file in Program Files directory 2 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription ioc process File created C:\Program Files (x86)\TCP Service\tcpsvc.exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe File opened for modification C:\Program Files (x86)\TCP Service\tcpsvc.exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exeNOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exepid process 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe 2812 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe 2812 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe 2812 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exepid process 2812 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exeNOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription pid process Token: SeDebugPrivilege 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe Token: SeDebugPrivilege 2812 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exedescription pid process target process PID 3912 wrote to memory of 4052 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe schtasks.exe PID 3912 wrote to memory of 4052 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe schtasks.exe PID 3912 wrote to memory of 4052 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe schtasks.exe PID 3912 wrote to memory of 4136 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 4136 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 4136 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 2812 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 2812 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 2812 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 2812 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 2812 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 2812 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 2812 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe PID 3912 wrote to memory of 2812 3912 NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ihuScAAQTRSrVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4C5B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\NOVA ARCHANTIQUITIES Official purchase order (PO.4029530).exe.logFilesize
408B
MD58adbb2cb7759fdcbc51cfbf0bfd7c867
SHA1f7549e6ea430e7d64b3afb3fc27c77ed5122f85b
SHA256c67092561e4b1472672374c3439004e2bc0191d9a901cde2b8b69a2d34dc6297
SHA512f465311e884dd82e3152959b6a59ac8d6be0a056a1cfddabbcc6714079a2269cd5c09b2b8fbc87a9ec3323c531383526ae19ef24fed100dec80730fae0d79991
-
C:\Users\Admin\AppData\Local\Temp\tmp4C5B.tmpFilesize
1KB
MD5da4524f74a6143fe5bd42454d58ec4eb
SHA1e184191d9fee814789a34476ac1f2652c2656868
SHA25666be449816d661c7d93a45be6058548aee09731811d368b818289bc9ac6105a2
SHA5128d4a88d3837b71de176f59b8929f27d5515ce71c082528b5fbfb8b0fd499e55e3c1aa921937908667f6aeb1c9bbce7799c3c727b34d458acbf3881152dd0cbe7
-
memory/2812-134-0x0000000000000000-mapping.dmp
-
memory/2812-135-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2812-137-0x00000000748F0000-0x0000000074EA1000-memory.dmpFilesize
5.7MB
-
memory/3912-130-0x00000000748F0000-0x0000000074EA1000-memory.dmpFilesize
5.7MB
-
memory/4052-131-0x0000000000000000-mapping.dmp
-
memory/4136-133-0x0000000000000000-mapping.dmp