Analysis
-
max time kernel
103s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-09-2022 06:21
Static task
static1
Behavioral task
behavioral1
Sample
a440839332ab9d93644827ad59b21ff2.exe
Resource
win7-20220812-en
General
-
Target
a440839332ab9d93644827ad59b21ff2.exe
-
Size
933KB
-
MD5
a440839332ab9d93644827ad59b21ff2
-
SHA1
d26b7c87b08e46c567323e3f001a51e9d4b2927e
-
SHA256
40163bbe666ea73c550fff89312262d3307ccfdde0d5fec95eae5deb1a1a6243
-
SHA512
1c74859a877881624945a0f8372d074ba0f39cd4bbebbe25b4887306383f664bf3298ed970f2a9100ff91d62792d2c6b206417c2d4ede99eb20d27b4cf978627
-
SSDEEP
24576:bZ5vT5H5dGICDJpXSYOcqFnN9Ir1mcXY+mzo3bv:l5bp5dGICHSYpSS1XlmzM
Malware Config
Extracted
nanocore
1.2.2.0
welu111.ddns.net:2404
127.0.0.1:2404
fc32f95c-2910-433f-b101-8576e258a05d
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
- backup_dns_server
-
buffer_size
65535
-
build_time
2022-06-11T12:29:33.575754536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
2404
-
default_group
Cass
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
fc32f95c-2910-433f-b101-8576e258a05d
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
welu111.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
a440839332ab9d93644827ad59b21ff2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a440839332ab9d93644827ad59b21ff2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exedescription pid process target process PID 1280 set thread context of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exepowershell.exea440839332ab9d93644827ad59b21ff2.exepid process 1280 a440839332ab9d93644827ad59b21ff2.exe 1280 a440839332ab9d93644827ad59b21ff2.exe 1280 a440839332ab9d93644827ad59b21ff2.exe 1280 a440839332ab9d93644827ad59b21ff2.exe 1348 powershell.exe 584 a440839332ab9d93644827ad59b21ff2.exe 584 a440839332ab9d93644827ad59b21ff2.exe 584 a440839332ab9d93644827ad59b21ff2.exe 584 a440839332ab9d93644827ad59b21ff2.exe 584 a440839332ab9d93644827ad59b21ff2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exepid process 584 a440839332ab9d93644827ad59b21ff2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exepowershell.exea440839332ab9d93644827ad59b21ff2.exedescription pid process Token: SeDebugPrivilege 1280 a440839332ab9d93644827ad59b21ff2.exe Token: SeDebugPrivilege 1348 powershell.exe Token: SeDebugPrivilege 584 a440839332ab9d93644827ad59b21ff2.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exedescription pid process target process PID 1280 wrote to memory of 1348 1280 a440839332ab9d93644827ad59b21ff2.exe powershell.exe PID 1280 wrote to memory of 1348 1280 a440839332ab9d93644827ad59b21ff2.exe powershell.exe PID 1280 wrote to memory of 1348 1280 a440839332ab9d93644827ad59b21ff2.exe powershell.exe PID 1280 wrote to memory of 1348 1280 a440839332ab9d93644827ad59b21ff2.exe powershell.exe PID 1280 wrote to memory of 1700 1280 a440839332ab9d93644827ad59b21ff2.exe schtasks.exe PID 1280 wrote to memory of 1700 1280 a440839332ab9d93644827ad59b21ff2.exe schtasks.exe PID 1280 wrote to memory of 1700 1280 a440839332ab9d93644827ad59b21ff2.exe schtasks.exe PID 1280 wrote to memory of 1700 1280 a440839332ab9d93644827ad59b21ff2.exe schtasks.exe PID 1280 wrote to memory of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 1280 wrote to memory of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 1280 wrote to memory of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 1280 wrote to memory of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 1280 wrote to memory of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 1280 wrote to memory of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 1280 wrote to memory of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 1280 wrote to memory of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 1280 wrote to memory of 584 1280 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a440839332ab9d93644827ad59b21ff2.exe"C:\Users\Admin\AppData\Local\Temp\a440839332ab9d93644827ad59b21ff2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wlRIJxyonelRh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlRIJxyonelRh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC0D0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\a440839332ab9d93644827ad59b21ff2.exe"C:\Users\Admin\AppData\Local\Temp\a440839332ab9d93644827ad59b21ff2.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC0D0.tmpFilesize
1KB
MD59748223585378e99d97374981a63fefb
SHA1cd2c1e4943559fd206bbf219abf8d04cceeba070
SHA256ee51c5f7cdec3c63155ec93f37519f3563f54e9391a9d97fd5df7ecaa8d7c4c4
SHA5126c241ef8b37c4f853532c0cd38fc6c91b67c7f5fc3194b4a4c1b0139242714d5ef30c43aabb7f7192794674a877a273ac90680c3e3a72642414d781ae6b62a51
-
memory/584-84-0x00000000009F0000-0x00000000009FE000-memory.dmpFilesize
56KB
-
memory/584-86-0x0000000000C20000-0x0000000000C2C000-memory.dmpFilesize
48KB
-
memory/584-93-0x0000000002260000-0x0000000002274000-memory.dmpFilesize
80KB
-
memory/584-89-0x0000000002220000-0x0000000002230000-memory.dmpFilesize
64KB
-
memory/584-90-0x0000000002230000-0x0000000002244000-memory.dmpFilesize
80KB
-
memory/584-91-0x0000000002240000-0x000000000224E000-memory.dmpFilesize
56KB
-
memory/584-92-0x0000000004800000-0x000000000482E000-memory.dmpFilesize
184KB
-
memory/584-78-0x00000000004B0000-0x00000000004BA000-memory.dmpFilesize
40KB
-
memory/584-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/584-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/584-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/584-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/584-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/584-79-0x00000000009A0000-0x00000000009BE000-memory.dmpFilesize
120KB
-
memory/584-73-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/584-75-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/584-88-0x0000000002210000-0x0000000002224000-memory.dmpFilesize
80KB
-
memory/584-87-0x0000000000C30000-0x0000000000C3E000-memory.dmpFilesize
56KB
-
memory/584-71-0x000000000041E792-mapping.dmp
-
memory/584-80-0x00000000004C0000-0x00000000004CA000-memory.dmpFilesize
40KB
-
memory/584-85-0x0000000000A60000-0x0000000000A72000-memory.dmpFilesize
72KB
-
memory/584-82-0x00000000009C0000-0x00000000009D2000-memory.dmpFilesize
72KB
-
memory/584-83-0x0000000000A40000-0x0000000000A5A000-memory.dmpFilesize
104KB
-
memory/1280-54-0x00000000001B0000-0x000000000029E000-memory.dmpFilesize
952KB
-
memory/1280-56-0x0000000000360000-0x0000000000378000-memory.dmpFilesize
96KB
-
memory/1280-63-0x0000000004890000-0x00000000048CA000-memory.dmpFilesize
232KB
-
memory/1280-58-0x0000000005F60000-0x0000000005FF4000-memory.dmpFilesize
592KB
-
memory/1280-55-0x0000000075811000-0x0000000075813000-memory.dmpFilesize
8KB
-
memory/1280-57-0x00000000002F0000-0x00000000002FC000-memory.dmpFilesize
48KB
-
memory/1348-81-0x000000006E580000-0x000000006EB2B000-memory.dmpFilesize
5.7MB
-
memory/1348-59-0x0000000000000000-mapping.dmp
-
memory/1348-77-0x000000006E580000-0x000000006EB2B000-memory.dmpFilesize
5.7MB
-
memory/1700-60-0x0000000000000000-mapping.dmp