Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe
Resource
win7-20220812-en
General
-
Target
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe
-
Size
328KB
-
MD5
d4c5e5e909ff0def4cd6be23a09d43ae
-
SHA1
d7ce18914c638c66d6e5377c40adf22c7c847289
-
SHA256
64f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
-
SHA512
01bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
SSDEEP
6144:ty3ZvTcfs331nuT8n2+a0JDj21k4/WQUDu5IYuVpij4eNtkH9d7mCvd:t0vTcfsHcwn2+tkVODDOqgUKt+3mC
Malware Config
Extracted
nanocore
1.2.2.0
intercambiotestg99.duckdns.org:1501
38adc800-c0b8-451a-9a6c-a172c6e3f300
-
activate_away_mode
true
-
backup_connection_host
intercambiotestg99.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2017-06-21T02:56:21.560821236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
1501
-
default_group
Team
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
38adc800-c0b8-451a-9a6c-a172c6e3f300
-
mutex_timeout
5000
-
prevent_system_sleep
true
- primary_connection_host
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
complementooffice.execomplementooffice.exepid process 3992 complementooffice.exe 2824 complementooffice.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Try2 = "C:\\Users\\Admin\\Documents\\complementooffice.exe -boot" 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe -
Processes:
complementooffice.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA complementooffice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
complementooffice.exedescription pid process target process PID 3992 set thread context of 2824 3992 complementooffice.exe complementooffice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
complementooffice.exepid process 2824 complementooffice.exe 2824 complementooffice.exe 2824 complementooffice.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
complementooffice.exepid process 2824 complementooffice.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.execomplementooffice.execomplementooffice.exedescription pid process Token: SeDebugPrivilege 4440 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe Token: SeDebugPrivilege 3992 complementooffice.exe Token: SeDebugPrivilege 2824 complementooffice.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.execomplementooffice.exedescription pid process target process PID 4440 wrote to memory of 3992 4440 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe complementooffice.exe PID 4440 wrote to memory of 3992 4440 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe complementooffice.exe PID 4440 wrote to memory of 3992 4440 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe complementooffice.exe PID 3992 wrote to memory of 2824 3992 complementooffice.exe complementooffice.exe PID 3992 wrote to memory of 2824 3992 complementooffice.exe complementooffice.exe PID 3992 wrote to memory of 2824 3992 complementooffice.exe complementooffice.exe PID 3992 wrote to memory of 2824 3992 complementooffice.exe complementooffice.exe PID 3992 wrote to memory of 2824 3992 complementooffice.exe complementooffice.exe PID 3992 wrote to memory of 2824 3992 complementooffice.exe complementooffice.exe PID 3992 wrote to memory of 2824 3992 complementooffice.exe complementooffice.exe PID 3992 wrote to memory of 2824 3992 complementooffice.exe complementooffice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe"C:\Users\Admin\AppData\Local\Temp\64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\complementooffice.exe"C:\Users\Admin\Documents\complementooffice.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\complementooffice.exe"C:\Users\Admin\Documents\complementooffice.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\complementooffice.exeFilesize
328KB
MD5d4c5e5e909ff0def4cd6be23a09d43ae
SHA1d7ce18914c638c66d6e5377c40adf22c7c847289
SHA25664f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
SHA51201bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
C:\Users\Admin\Documents\complementooffice.exeFilesize
328KB
MD5d4c5e5e909ff0def4cd6be23a09d43ae
SHA1d7ce18914c638c66d6e5377c40adf22c7c847289
SHA25664f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
SHA51201bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
C:\Users\Admin\Documents\complementooffice.exeFilesize
328KB
MD5d4c5e5e909ff0def4cd6be23a09d43ae
SHA1d7ce18914c638c66d6e5377c40adf22c7c847289
SHA25664f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
SHA51201bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
memory/2824-141-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2824-140-0x0000000000000000-mapping.dmp
-
memory/2824-144-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/2824-145-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/3992-134-0x0000000000000000-mapping.dmp
-
memory/3992-138-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/3992-139-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/3992-143-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/4440-137-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/4440-132-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/4440-133-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB