Analysis
-
max time kernel
99s -
max time network
301s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 16:21
Static task
static1
Behavioral task
behavioral1
Sample
RegistryKeyPermissionCh.exe
Resource
win7-20220414-en
General
-
Target
RegistryKeyPermissionCh.exe
-
Size
728KB
-
MD5
f9a9d6614542c8e1ed8eff17f9bfd527
-
SHA1
5b6c2304de9daf1ff1a5dfc4b3bcb69a3e07e348
-
SHA256
7e7550af6931e5e5ccb8dab52ea5976762c5fe1aae8b91dd6db6a122654c83ae
-
SHA512
cb33c069b288b67f6bac6dd54f4f34dc0e70bdd6cac615d65885afec9033800cef80cbd704f44059599f8e2f8ad0599ee1eb38e14d910e780fd16a257ab7f9b6
Malware Config
Extracted
nanocore
1.2.2.0
config.linkpc.net:3425
e5ec3588-c148-476e-a8f8-2e9038dcba4d
-
activate_away_mode
true
- backup_connection_host
- backup_dns_server
-
buffer_size
65535
-
build_time
2022-04-01T12:01:12.053123736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3425
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
e5ec3588-c148-476e-a8f8-2e9038dcba4d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
config.linkpc.net
-
primary_dns_server
config.linkpc.net
-
request_elevation
true
-
restart_delay
5000
-
run_delay
15
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Processes:
RegistryKeyPermissionCh.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegistryKeyPermissionCh.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RegistryKeyPermissionCh.exedescription pid process target process PID 1720 set thread context of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
RegistryKeyPermissionCh.exepowershell.exeRegistryKeyPermissionCh.exepid process 1720 RegistryKeyPermissionCh.exe 1720 RegistryKeyPermissionCh.exe 632 powershell.exe 1868 RegistryKeyPermissionCh.exe 1868 RegistryKeyPermissionCh.exe 1868 RegistryKeyPermissionCh.exe 1868 RegistryKeyPermissionCh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegistryKeyPermissionCh.exepid process 1868 RegistryKeyPermissionCh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegistryKeyPermissionCh.exepowershell.exeRegistryKeyPermissionCh.exedescription pid process Token: SeDebugPrivilege 1720 RegistryKeyPermissionCh.exe Token: SeDebugPrivilege 632 powershell.exe Token: SeDebugPrivilege 1868 RegistryKeyPermissionCh.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
RegistryKeyPermissionCh.exeRegistryKeyPermissionCh.exedescription pid process target process PID 1720 wrote to memory of 632 1720 RegistryKeyPermissionCh.exe powershell.exe PID 1720 wrote to memory of 632 1720 RegistryKeyPermissionCh.exe powershell.exe PID 1720 wrote to memory of 632 1720 RegistryKeyPermissionCh.exe powershell.exe PID 1720 wrote to memory of 632 1720 RegistryKeyPermissionCh.exe powershell.exe PID 1720 wrote to memory of 1236 1720 RegistryKeyPermissionCh.exe schtasks.exe PID 1720 wrote to memory of 1236 1720 RegistryKeyPermissionCh.exe schtasks.exe PID 1720 wrote to memory of 1236 1720 RegistryKeyPermissionCh.exe schtasks.exe PID 1720 wrote to memory of 1236 1720 RegistryKeyPermissionCh.exe schtasks.exe PID 1720 wrote to memory of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe PID 1720 wrote to memory of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe PID 1720 wrote to memory of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe PID 1720 wrote to memory of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe PID 1720 wrote to memory of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe PID 1720 wrote to memory of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe PID 1720 wrote to memory of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe PID 1720 wrote to memory of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe PID 1720 wrote to memory of 1868 1720 RegistryKeyPermissionCh.exe RegistryKeyPermissionCh.exe PID 1868 wrote to memory of 340 1868 RegistryKeyPermissionCh.exe schtasks.exe PID 1868 wrote to memory of 340 1868 RegistryKeyPermissionCh.exe schtasks.exe PID 1868 wrote to memory of 340 1868 RegistryKeyPermissionCh.exe schtasks.exe PID 1868 wrote to memory of 340 1868 RegistryKeyPermissionCh.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RegistryKeyPermissionCh.exe"C:\Users\Admin\AppData\Local\Temp\RegistryKeyPermissionCh.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZCzaLnETi.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZCzaLnETi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA2A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RegistryKeyPermissionCh.exe"C:\Users\Admin\AppData\Local\Temp\RegistryKeyPermissionCh.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE310.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDA2A.tmpFilesize
1KB
MD5386df85a3513d362d30c966d428db5bf
SHA1629e572aea41e95eee6180bc3f3dc79422bfd6c5
SHA256f6379b7945ef1a0b90183f28b83fc7288c187adaef3ad46d0cab89bbc3a2d18a
SHA512ad1e3b756946be9131f741effb0eb8e4c0dd3243e89e89388fd5ce35b51f874b17b3b32f98bafe0649fb685c467219b8f5cecc0589dcb67d3383d468401cb6ac
-
C:\Users\Admin\AppData\Local\Temp\tmpE310.tmpFilesize
1KB
MD5de4f52bed4e8636f355b853a9dde1daf
SHA1f4bdae7d8f03697f482f5080478d6b9c954155fb
SHA25665e60082077485521e14361b66be04a3b5b00c4a0acf833f391dbc6a013c57c3
SHA51268d75f24832280100b4dfa323895cc37a9dc982298a2dc9fae681e84830147d7020eb813ecc4f0c03f60c1ebb1c15a232f8076454864019575e1eb2ff067fde0
-
memory/340-79-0x0000000000000000-mapping.dmp
-
memory/632-84-0x000000006E220000-0x000000006E7CB000-memory.dmpFilesize
5.7MB
-
memory/632-78-0x000000006E220000-0x000000006E7CB000-memory.dmpFilesize
5.7MB
-
memory/632-60-0x0000000000000000-mapping.dmp
-
memory/1236-61-0x0000000000000000-mapping.dmp
-
memory/1720-64-0x0000000005EC0000-0x0000000005EFA000-memory.dmpFilesize
232KB
-
memory/1720-58-0x0000000000790000-0x000000000079E000-memory.dmpFilesize
56KB
-
memory/1720-54-0x00000000002E0000-0x000000000039C000-memory.dmpFilesize
752KB
-
memory/1720-55-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/1720-59-0x0000000005E40000-0x0000000005EBE000-memory.dmpFilesize
504KB
-
memory/1720-56-0x0000000004980000-0x0000000004A0C000-memory.dmpFilesize
560KB
-
memory/1720-57-0x00000000003A0000-0x00000000003C0000-memory.dmpFilesize
128KB
-
memory/1868-82-0x0000000001E90000-0x0000000001EAE000-memory.dmpFilesize
120KB
-
memory/1868-85-0x0000000001F00000-0x0000000001F12000-memory.dmpFilesize
72KB
-
memory/1868-74-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1868-76-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1868-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1868-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1868-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1868-81-0x0000000000620000-0x000000000062A000-memory.dmpFilesize
40KB
-
memory/1868-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1868-83-0x0000000000630000-0x000000000063A000-memory.dmpFilesize
40KB
-
memory/1868-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1868-72-0x000000000041E792-mapping.dmp
-
memory/1868-86-0x0000000001F10000-0x0000000001F2A000-memory.dmpFilesize
104KB
-
memory/1868-87-0x0000000001F80000-0x0000000001F8E000-memory.dmpFilesize
56KB
-
memory/1868-88-0x0000000002160000-0x0000000002172000-memory.dmpFilesize
72KB
-
memory/1868-89-0x0000000002170000-0x000000000217C000-memory.dmpFilesize
48KB
-
memory/1868-90-0x0000000002180000-0x000000000218E000-memory.dmpFilesize
56KB
-
memory/1868-91-0x00000000021A0000-0x00000000021B4000-memory.dmpFilesize
80KB
-
memory/1868-92-0x00000000042F0000-0x0000000004300000-memory.dmpFilesize
64KB
-
memory/1868-93-0x0000000004B50000-0x0000000004B64000-memory.dmpFilesize
80KB
-
memory/1868-94-0x0000000004B60000-0x0000000004B6E000-memory.dmpFilesize
56KB
-
memory/1868-95-0x0000000004B80000-0x0000000004BAE000-memory.dmpFilesize
184KB
-
memory/1868-96-0x0000000004BF0000-0x0000000004C04000-memory.dmpFilesize
80KB