Analysis
-
max time kernel
123s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2022 13:37
Static task
static1
Behavioral task
behavioral1
Sample
Machinary Presentation.exe
Resource
win7-20220901-en
General
-
Target
Machinary Presentation.exe
-
Size
910KB
-
MD5
efd47ec7f797f124bf10402bdb4f4345
-
SHA1
fd8001d24f58cb528fcac4c360f207d5c8995150
-
SHA256
1b8211b6c45db62e042398a3d94c429941a3f91b26736cd4fdcb712b70d2c194
-
SHA512
94c5313ef50690aeafbe396ecedd24f0a66523f244084a6d3f2a329915f9cab4d91e7316554d8f76ef7e4f4356f634b3dc5eb0dc081389fe3cf6cd322e86cb8a
-
SSDEEP
12288:5FGnOhY8lylSx1TADqjJ5n8sKdirYJzwCk93ginKqPrW/DPvtDJ9fEP2xq+ello/:/GnOTrjr8D/zwCUZnKqPrW/Df9M+Ea
Malware Config
Extracted
nanocore
1.2.2.0
dera5nano.ddns.net:1010
107.182.129.248:1010
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
activate_away_mode
true
-
backup_connection_host
107.182.129.248
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-06T12:07:01.612898436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1010
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dera5nano.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Machinary Presentation.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Machinary Presentation.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Machinary Presentation.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe" Machinary Presentation.exe -
Processes:
Machinary Presentation.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Machinary Presentation.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Machinary Presentation.exedescription pid process target process PID 5056 set thread context of 3488 5056 Machinary Presentation.exe Machinary Presentation.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Machinary Presentation.exedescription ioc process File created C:\Program Files (x86)\DDP Manager\ddpmgr.exe Machinary Presentation.exe File opened for modification C:\Program Files (x86)\DDP Manager\ddpmgr.exe Machinary Presentation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2332 schtasks.exe 2400 schtasks.exe 3392 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Machinary Presentation.exepid process 3488 Machinary Presentation.exe 3488 Machinary Presentation.exe 3488 Machinary Presentation.exe 3488 Machinary Presentation.exe 3488 Machinary Presentation.exe 3488 Machinary Presentation.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Machinary Presentation.exepid process 3488 Machinary Presentation.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Machinary Presentation.exedescription pid process Token: SeDebugPrivilege 3488 Machinary Presentation.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Machinary Presentation.exeMachinary Presentation.exedescription pid process target process PID 5056 wrote to memory of 2332 5056 Machinary Presentation.exe schtasks.exe PID 5056 wrote to memory of 2332 5056 Machinary Presentation.exe schtasks.exe PID 5056 wrote to memory of 2332 5056 Machinary Presentation.exe schtasks.exe PID 5056 wrote to memory of 3488 5056 Machinary Presentation.exe Machinary Presentation.exe PID 5056 wrote to memory of 3488 5056 Machinary Presentation.exe Machinary Presentation.exe PID 5056 wrote to memory of 3488 5056 Machinary Presentation.exe Machinary Presentation.exe PID 5056 wrote to memory of 3488 5056 Machinary Presentation.exe Machinary Presentation.exe PID 5056 wrote to memory of 3488 5056 Machinary Presentation.exe Machinary Presentation.exe PID 5056 wrote to memory of 3488 5056 Machinary Presentation.exe Machinary Presentation.exe PID 5056 wrote to memory of 3488 5056 Machinary Presentation.exe Machinary Presentation.exe PID 5056 wrote to memory of 3488 5056 Machinary Presentation.exe Machinary Presentation.exe PID 3488 wrote to memory of 2400 3488 Machinary Presentation.exe schtasks.exe PID 3488 wrote to memory of 2400 3488 Machinary Presentation.exe schtasks.exe PID 3488 wrote to memory of 2400 3488 Machinary Presentation.exe schtasks.exe PID 3488 wrote to memory of 3392 3488 Machinary Presentation.exe schtasks.exe PID 3488 wrote to memory of 3392 3488 Machinary Presentation.exe schtasks.exe PID 3488 wrote to memory of 3392 3488 Machinary Presentation.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Machinary Presentation.exe"C:\Users\Admin\AppData\Local\Temp\Machinary Presentation.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GBOYyQc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6BF8.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Machinary Presentation.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp735B.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp73D9.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Machinary Presentation.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
C:\Users\Admin\AppData\Local\Temp\tmp6BF8.tmpFilesize
1KB
MD51c835f8e06edbf32a8d6d969855760ac
SHA1adeed7150947f44143268c390f37c9c28d3b3589
SHA2561d07cb9e40f472ef79032c30f9c78d4736102c8581a14a43a830e8ba88e55853
SHA5128574cf7283e360f447e7655882360b03723c9433d65c1da115bd49a2660f5c116704e4dc36493ffbd08f14db9bd1d7579f3dce2dd76ce31ee2671c52b6bf77fd
-
C:\Users\Admin\AppData\Local\Temp\tmp735B.tmpFilesize
1KB
MD5bace03bd34d833f7c4587df18d4a884e
SHA1271cfd5ab3a2b85ca43c6c99b030f4dd3825aafa
SHA256518f6d5503aedc731b1f5e10e5718ac377c6fab85ed6a00f1fc333557c3e54dd
SHA5121211d69ee9fad7e33494b8b0e7d083f54752e31a881e874c8f8209b9c8e796edebece255f0ec5fecb63ddf657878cc90ce70d478880427b8b705dc477cc5491f
-
C:\Users\Admin\AppData\Local\Temp\tmp73D9.tmpFilesize
1KB
MD5677848190631e19222304d1982aa2e1b
SHA1bed6cf97d3458e4ea59ff9823375d915a9b3d682
SHA2568bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d
SHA512f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e
-
memory/2332-137-0x0000000000000000-mapping.dmp
-
memory/2400-142-0x0000000000000000-mapping.dmp
-
memory/3392-144-0x0000000000000000-mapping.dmp
-
memory/3488-139-0x0000000000000000-mapping.dmp
-
memory/3488-140-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3488-146-0x0000000007590000-0x00000000075F6000-memory.dmpFilesize
408KB
-
memory/5056-134-0x0000000005020000-0x00000000050B2000-memory.dmpFilesize
584KB
-
memory/5056-132-0x00000000005B0000-0x000000000069A000-memory.dmpFilesize
936KB
-
memory/5056-133-0x00000000054E0000-0x0000000005A84000-memory.dmpFilesize
5.6MB
-
memory/5056-136-0x00000000050D0000-0x00000000050DA000-memory.dmpFilesize
40KB
-
memory/5056-135-0x0000000005160000-0x00000000051FC000-memory.dmpFilesize
624KB