Analysis
-
max time kernel
95s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-09-2022 07:03
Static task
static1
Behavioral task
behavioral1
Sample
7d12de10e595f4317136eaeccf447629.exe
Resource
win7-20220812-en
General
-
Target
7d12de10e595f4317136eaeccf447629.exe
-
Size
938KB
-
MD5
7d12de10e595f4317136eaeccf447629
-
SHA1
2fcd94c8a01744ef37e997abc292bc6deac00026
-
SHA256
da9ca371e55c5038fb258edd2fda1c788934b7fad232e3b9bd0949fc50a26d92
-
SHA512
87506f2829244927ea159ba245ebe3ec4b61b88a3d4713c9352b8570d8ba36bc6ba4e88228afa95f5013c2f4c0c8031ee942bca977edbe67780d43cbf885e34f
-
SSDEEP
12288:Exbrym2bTZ04mhX7c8u+d2TBLP2bHxApnBL7Uud6Aqy:ExrDY04qrc8u+d8BL0gB9
Malware Config
Extracted
nanocore
1.2.2.0
rolandlandson149.bounceme.net:1007
127.0.0.1:1007
48099ca8-c1b4-49f3-9fe1-d8dfcbf66c09
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-13T20:58:05.824762936Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1007
-
default_group
sepTmAn
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
48099ca8-c1b4-49f3-9fe1-d8dfcbf66c09
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
rolandlandson149.bounceme.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe" 7d12de10e595f4317136eaeccf447629.exe -
Processes:
7d12de10e595f4317136eaeccf447629.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7d12de10e595f4317136eaeccf447629.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exedescription pid process target process PID 2020 set thread context of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe -
Drops file in Program Files directory 2 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exedescription ioc process File created C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe 7d12de10e595f4317136eaeccf447629.exe File opened for modification C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe 7d12de10e595f4317136eaeccf447629.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exepid process 836 7d12de10e595f4317136eaeccf447629.exe 836 7d12de10e595f4317136eaeccf447629.exe 836 7d12de10e595f4317136eaeccf447629.exe 836 7d12de10e595f4317136eaeccf447629.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exepid process 836 7d12de10e595f4317136eaeccf447629.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exedescription pid process Token: SeDebugPrivilege 836 7d12de10e595f4317136eaeccf447629.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exe7d12de10e595f4317136eaeccf447629.exedescription pid process target process PID 2020 wrote to memory of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2020 wrote to memory of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2020 wrote to memory of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2020 wrote to memory of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2020 wrote to memory of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2020 wrote to memory of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2020 wrote to memory of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2020 wrote to memory of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2020 wrote to memory of 836 2020 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 836 wrote to memory of 520 836 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 836 wrote to memory of 520 836 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 836 wrote to memory of 520 836 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 836 wrote to memory of 520 836 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 836 wrote to memory of 1312 836 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 836 wrote to memory of 1312 836 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 836 wrote to memory of 1312 836 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 836 wrote to memory of 1312 836 7d12de10e595f4317136eaeccf447629.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d12de10e595f4317136eaeccf447629.exe"C:\Users\Admin\AppData\Local\Temp\7d12de10e595f4317136eaeccf447629.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7d12de10e595f4317136eaeccf447629.exe"C:\Users\Admin\AppData\Local\Temp\7d12de10e595f4317136eaeccf447629.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAB3E.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAD23.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAB3E.tmpFilesize
1KB
MD533100b06e0a3ddf67488894bbb3f2bcb
SHA17c2fac8a173868be0a334dc2d565f10e9e205b93
SHA2566f41974ad5b771367c665f6f54e9f2fe04f2900a68ce32e40e85b3d446d83440
SHA512392540f2c42c39aed6ecd98b4961c53c5232d062119b926fb3354fea6e16d93ae4d92d402099c8e37bd81e77b2c7b6282178f2afbed6987668a3acbef29c9123
-
C:\Users\Admin\AppData\Local\Temp\tmpAD23.tmpFilesize
1KB
MD5981e126601526eaa5b0ad45c496c4465
SHA1d610d6a21a8420cc73fcd3e54ddae75a5897b28b
SHA25611ae277dfa39e7038b782ca6557339e7fe88533fe83705c356a1500a1402d527
SHA512a59fb704d931ccb7e1ec1a7b98e24ccd8708be529066c6de4b673098cdebef539f7f50d9e051c43954b5a8e7f810862b3a4ede170f131e080dadc3e763ed4bdb
-
memory/520-73-0x0000000000000000-mapping.dmp
-
memory/836-83-0x0000000002170000-0x0000000002182000-memory.dmpFilesize
72KB
-
memory/836-84-0x0000000002210000-0x000000000221E000-memory.dmpFilesize
56KB
-
memory/836-77-0x0000000000610000-0x000000000061A000-memory.dmpFilesize
40KB
-
memory/836-60-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-67-0x000000000041E792-mapping.dmp
-
memory/836-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-90-0x0000000004E60000-0x0000000004E8E000-memory.dmpFilesize
184KB
-
memory/836-89-0x0000000004DA0000-0x0000000004DAE000-memory.dmpFilesize
56KB
-
memory/836-88-0x0000000004D50000-0x0000000004D64000-memory.dmpFilesize
80KB
-
memory/836-91-0x0000000004DC0000-0x0000000004DD4000-memory.dmpFilesize
80KB
-
memory/836-87-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/836-78-0x0000000000670000-0x000000000068E000-memory.dmpFilesize
120KB
-
memory/836-79-0x0000000000620000-0x000000000062A000-memory.dmpFilesize
40KB
-
memory/836-80-0x00000000007F0000-0x0000000000802000-memory.dmpFilesize
72KB
-
memory/836-81-0x0000000002150000-0x000000000216A000-memory.dmpFilesize
104KB
-
memory/836-82-0x0000000000A10000-0x0000000000A1E000-memory.dmpFilesize
56KB
-
memory/836-86-0x00000000022E0000-0x00000000022F4000-memory.dmpFilesize
80KB
-
memory/836-85-0x0000000002220000-0x000000000222C000-memory.dmpFilesize
48KB
-
memory/1312-75-0x0000000000000000-mapping.dmp
-
memory/2020-58-0x0000000005900000-0x0000000005994000-memory.dmpFilesize
592KB
-
memory/2020-54-0x0000000000310000-0x0000000000400000-memory.dmpFilesize
960KB
-
memory/2020-59-0x0000000000780000-0x00000000007BA000-memory.dmpFilesize
232KB
-
memory/2020-56-0x00000000002E0000-0x00000000002FA000-memory.dmpFilesize
104KB
-
memory/2020-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2020-55-0x00000000756B1000-0x00000000756B3000-memory.dmpFilesize
8KB