Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 18:17
Static task
static1
Behavioral task
behavioral1
Sample
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe
Resource
win7-20220414-en
General
-
Target
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe
-
Size
1.4MB
-
MD5
26baf2fbfd19fc2b3fdd3bfb9ccc94d0
-
SHA1
b956e2cc743f37cc07d68bbca6125575d55dcf5d
-
SHA256
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53
-
SHA512
da130f671883287756eb2fd3163b907a1be8947f81e6a24880c06b762d5190b5ee5488a699319871aa2f48075de225e838377c5c0d92fd8702702a4a4509138f
Malware Config
Extracted
nanocore
1.2.2.0
noway74.ddns.net:5556
06de780d-2603-4153-bb0d-62b9de2c5ca5
-
activate_away_mode
true
-
backup_connection_host
noway74.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-03-22T11:00:54.031861436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5556
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
06de780d-2603-4153-bb0d-62b9de2c5ca5
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
noway74.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2796-130-0x0000000000A00000-0x0000000000BE7000-memory.dmp upx behavioral2/memory/2796-131-0x0000000000A00000-0x0000000000BE7000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime broker = "C:\\Users\\Admin\\AppData\\Roaming\\cvmkgeqxcl\\Runtime broker.exe" 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exedescription ioc process File opened (read-only) \??\n: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\o: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\f: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\j: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\m: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\r: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\v: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\w: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\z: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\g: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\l: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\p: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\s: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\u: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\x: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\y: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\i: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\k: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\q: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\h: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\t: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\a: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\b: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe File opened (read-only) \??\e: 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2796-130-0x0000000000A00000-0x0000000000BE7000-memory.dmp autoit_exe behavioral2/memory/2796-131-0x0000000000A00000-0x0000000000BE7000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exedescription pid process target process PID 2796 set thread context of 2656 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe -
NTFS ADS 1 IoCs
Processes:
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exepid process 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exeRegAsm.exepid process 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe 2656 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2656 RegAsm.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exedescription pid process target process PID 2796 wrote to memory of 2656 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe RegAsm.exe PID 2796 wrote to memory of 2656 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe RegAsm.exe PID 2796 wrote to memory of 2656 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe RegAsm.exe PID 2796 wrote to memory of 2656 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe RegAsm.exe PID 2796 wrote to memory of 2656 2796 3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe"C:\Users\Admin\AppData\Local\Temp\3af45339c0c5cf4fff07c8f46423e5b88a7d423b76b0809a3f9952671fa19f53.exe"1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2656-132-0x0000000000000000-mapping.dmp
-
memory/2656-133-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2656-138-0x0000000073740000-0x0000000073CF1000-memory.dmpFilesize
5.7MB
-
memory/2656-139-0x0000000073740000-0x0000000073CF1000-memory.dmpFilesize
5.7MB
-
memory/2796-130-0x0000000000A00000-0x0000000000BE7000-memory.dmpFilesize
1.9MB
-
memory/2796-131-0x0000000000A00000-0x0000000000BE7000-memory.dmpFilesize
1.9MB