Analysis
-
max time kernel
123s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2022 06:21
Static task
static1
Behavioral task
behavioral1
Sample
a440839332ab9d93644827ad59b21ff2.exe
Resource
win7-20220812-en
General
-
Target
a440839332ab9d93644827ad59b21ff2.exe
-
Size
933KB
-
MD5
a440839332ab9d93644827ad59b21ff2
-
SHA1
d26b7c87b08e46c567323e3f001a51e9d4b2927e
-
SHA256
40163bbe666ea73c550fff89312262d3307ccfdde0d5fec95eae5deb1a1a6243
-
SHA512
1c74859a877881624945a0f8372d074ba0f39cd4bbebbe25b4887306383f664bf3298ed970f2a9100ff91d62792d2c6b206417c2d4ede99eb20d27b4cf978627
-
SSDEEP
24576:bZ5vT5H5dGICDJpXSYOcqFnN9Ir1mcXY+mzo3bv:l5bp5dGICHSYpSS1XlmzM
Malware Config
Extracted
nanocore
1.2.2.0
welu111.ddns.net:2404
127.0.0.1:2404
fc32f95c-2910-433f-b101-8576e258a05d
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
- backup_dns_server
-
buffer_size
65535
-
build_time
2022-06-11T12:29:33.575754536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
2404
-
default_group
Cass
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
fc32f95c-2910-433f-b101-8576e258a05d
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
welu111.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a440839332ab9d93644827ad59b21ff2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation a440839332ab9d93644827ad59b21ff2.exe -
Processes:
a440839332ab9d93644827ad59b21ff2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a440839332ab9d93644827ad59b21ff2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exedescription pid process target process PID 4952 set thread context of 4212 4952 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exepowershell.exea440839332ab9d93644827ad59b21ff2.exepid process 4952 a440839332ab9d93644827ad59b21ff2.exe 4952 a440839332ab9d93644827ad59b21ff2.exe 4952 a440839332ab9d93644827ad59b21ff2.exe 4952 a440839332ab9d93644827ad59b21ff2.exe 1980 powershell.exe 1980 powershell.exe 4212 a440839332ab9d93644827ad59b21ff2.exe 4212 a440839332ab9d93644827ad59b21ff2.exe 4212 a440839332ab9d93644827ad59b21ff2.exe 4212 a440839332ab9d93644827ad59b21ff2.exe 4212 a440839332ab9d93644827ad59b21ff2.exe 4212 a440839332ab9d93644827ad59b21ff2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exepid process 4212 a440839332ab9d93644827ad59b21ff2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exepowershell.exea440839332ab9d93644827ad59b21ff2.exedescription pid process Token: SeDebugPrivilege 4952 a440839332ab9d93644827ad59b21ff2.exe Token: SeDebugPrivilege 1980 powershell.exe Token: SeDebugPrivilege 4212 a440839332ab9d93644827ad59b21ff2.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
a440839332ab9d93644827ad59b21ff2.exedescription pid process target process PID 4952 wrote to memory of 1980 4952 a440839332ab9d93644827ad59b21ff2.exe powershell.exe PID 4952 wrote to memory of 1980 4952 a440839332ab9d93644827ad59b21ff2.exe powershell.exe PID 4952 wrote to memory of 1980 4952 a440839332ab9d93644827ad59b21ff2.exe powershell.exe PID 4952 wrote to memory of 4280 4952 a440839332ab9d93644827ad59b21ff2.exe schtasks.exe PID 4952 wrote to memory of 4280 4952 a440839332ab9d93644827ad59b21ff2.exe schtasks.exe PID 4952 wrote to memory of 4280 4952 a440839332ab9d93644827ad59b21ff2.exe schtasks.exe PID 4952 wrote to memory of 4212 4952 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 4952 wrote to memory of 4212 4952 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 4952 wrote to memory of 4212 4952 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 4952 wrote to memory of 4212 4952 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 4952 wrote to memory of 4212 4952 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 4952 wrote to memory of 4212 4952 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 4952 wrote to memory of 4212 4952 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe PID 4952 wrote to memory of 4212 4952 a440839332ab9d93644827ad59b21ff2.exe a440839332ab9d93644827ad59b21ff2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a440839332ab9d93644827ad59b21ff2.exe"C:\Users\Admin\AppData\Local\Temp\a440839332ab9d93644827ad59b21ff2.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wlRIJxyonelRh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlRIJxyonelRh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp440E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\a440839332ab9d93644827ad59b21ff2.exe"C:\Users\Admin\AppData\Local\Temp\a440839332ab9d93644827ad59b21ff2.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a440839332ab9d93644827ad59b21ff2.exe.logFilesize
1KB
MD5e08f822522c617a40840c62e4b0fb45e
SHA1ae516dca4da5234be6676d3f234c19ec55725be7
SHA256bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
SHA512894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
-
C:\Users\Admin\AppData\Local\Temp\tmp440E.tmpFilesize
1KB
MD576aa0b852ece641e706716e0642f5c22
SHA1e2916bc9d73ea6186bdf94da1d7e750df8b7f196
SHA2568884eaa81a30292d13af4c42c45a61e3563b275841593dc172f452d9fe79c126
SHA5125a737ffb24597991b936b7c76be4a56f84e760995c78870be1e4025562323df5290917e611306ff9ed1620ac19416d5c85fd755b73d01b5612e8af799fed71f5
-
memory/1980-150-0x00000000706E0000-0x000000007072C000-memory.dmpFilesize
304KB
-
memory/1980-138-0x0000000000000000-mapping.dmp
-
memory/1980-146-0x0000000004C90000-0x0000000004CB2000-memory.dmpFilesize
136KB
-
memory/1980-158-0x0000000007280000-0x0000000007288000-memory.dmpFilesize
32KB
-
memory/1980-147-0x00000000055C0000-0x0000000005626000-memory.dmpFilesize
408KB
-
memory/1980-157-0x00000000072A0000-0x00000000072BA000-memory.dmpFilesize
104KB
-
memory/1980-140-0x00000000046B0000-0x00000000046E6000-memory.dmpFilesize
216KB
-
memory/1980-148-0x0000000005C60000-0x0000000005C7E000-memory.dmpFilesize
120KB
-
memory/1980-142-0x0000000004E90000-0x00000000054B8000-memory.dmpFilesize
6.2MB
-
memory/1980-156-0x0000000007190000-0x000000000719E000-memory.dmpFilesize
56KB
-
memory/1980-155-0x00000000071E0000-0x0000000007276000-memory.dmpFilesize
600KB
-
memory/1980-154-0x0000000006FD0000-0x0000000006FDA000-memory.dmpFilesize
40KB
-
memory/1980-153-0x0000000006F60000-0x0000000006F7A000-memory.dmpFilesize
104KB
-
memory/1980-152-0x00000000075A0000-0x0000000007C1A000-memory.dmpFilesize
6.5MB
-
memory/1980-151-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/1980-149-0x0000000006220000-0x0000000006252000-memory.dmpFilesize
200KB
-
memory/4212-144-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4212-143-0x0000000000000000-mapping.dmp
-
memory/4280-139-0x0000000000000000-mapping.dmp
-
memory/4952-132-0x0000000000B50000-0x0000000000C3E000-memory.dmpFilesize
952KB
-
memory/4952-134-0x0000000005600000-0x0000000005692000-memory.dmpFilesize
584KB
-
memory/4952-135-0x00000000055E0000-0x00000000055EA000-memory.dmpFilesize
40KB
-
memory/4952-136-0x0000000009020000-0x00000000090BC000-memory.dmpFilesize
624KB
-
memory/4952-133-0x0000000005B10000-0x00000000060B4000-memory.dmpFilesize
5.6MB
-
memory/4952-137-0x0000000009330000-0x0000000009396000-memory.dmpFilesize
408KB