Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2022 12:20
Static task
static1
Behavioral task
behavioral1
Sample
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe
Resource
win7-20220812-en
General
-
Target
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe
-
Size
1.1MB
-
MD5
6ae67ecaac66fa631f901da9710f1e47
-
SHA1
39cfe8d12f85e0c53e8e8e8b457a33848b15c60e
-
SHA256
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa
-
SHA512
55c832e1844983cd47d4c2108a93e9615a5ac298875e09ae8f3a9e1726f8663b619b2731c80503204df3e14467d663c2ee71769aebb9948e6449726bbf6bd967
-
SSDEEP
12288:4F7eXmERWKyWL6aRuZox9dh+HIUnxcp+4lblyI36lqxJnE70oTbnem9BAlPDr7aC:bHlua+ox/h+HHnap+45S3
Malware Config
Extracted
nanocore
1.2.2.0
sharongrace.ddns.net:8223
1bc5fd65-b5d0-4528-8c0b-bb56e6cefa77
-
activate_away_mode
true
-
backup_connection_host
sharongrace.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-21T04:35:20.632438136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8223
-
default_group
MSword
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
1bc5fd65-b5d0-4528-8c0b-bb56e6cefa77
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
sharongrace.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe" 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription pid process target process PID 3884 set thread context of 3784 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Drops file in Program Files directory 2 IoCs
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription ioc process File created C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe File opened for modification C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exepowershell.exepowershell.exe61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exepid process 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 5112 powershell.exe 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 4084 powershell.exe 5112 powershell.exe 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 4084 powershell.exe 3784 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 3784 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 3784 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exepid process 3784 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exepowershell.exepowershell.exe61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription pid process Token: SeDebugPrivilege 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe Token: SeDebugPrivilege 5112 powershell.exe Token: SeDebugPrivilege 4084 powershell.exe Token: SeDebugPrivilege 3784 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exedescription pid process target process PID 3884 wrote to memory of 5112 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe powershell.exe PID 3884 wrote to memory of 5112 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe powershell.exe PID 3884 wrote to memory of 5112 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe powershell.exe PID 3884 wrote to memory of 4084 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe powershell.exe PID 3884 wrote to memory of 4084 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe powershell.exe PID 3884 wrote to memory of 4084 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe powershell.exe PID 3884 wrote to memory of 308 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe schtasks.exe PID 3884 wrote to memory of 308 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe schtasks.exe PID 3884 wrote to memory of 308 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe schtasks.exe PID 3884 wrote to memory of 3784 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe PID 3884 wrote to memory of 3784 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe PID 3884 wrote to memory of 3784 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe PID 3884 wrote to memory of 3784 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe PID 3884 wrote to memory of 3784 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe PID 3884 wrote to memory of 3784 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe PID 3884 wrote to memory of 3784 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe PID 3884 wrote to memory of 3784 3884 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe 61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe"C:\Users\Admin\AppData\Local\Temp\61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XFIutXLAqZ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XFIutXLAqZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7743.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe"C:\Users\Admin\AppData\Local\Temp\61281ee8c26307ca4a56e9972b574a65199dfce222843d9a6445324b57cb42fa.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5fe39bb2b0408711687eea3a37800683c
SHA1e5bfbf6da4f3d3e2da096adf13534adefbfeaf4a
SHA25620de1f8e6da07b80eb9841c3fc5f253867b6f312f43c9d72373ce2f259d33dbd
SHA5128fe3ffc9a01c714f0488bd8089a120d530d8b504d3748bd82d147b9a8db3b115356d9cd05f2479c36eec7f3caf51807e0c281bb3d4360998c4e0789ad59972b4
-
C:\Users\Admin\AppData\Local\Temp\tmp7743.tmpFilesize
1KB
MD5a6b7d6c2496e02bdc6f227c2911e579c
SHA13734fdda0bd9f8463b4b547f5460ac67bf807463
SHA256ffa664b2cab9175c5b2a8a97c536a8b5f8c79488ad09ab93b1703292e94e4045
SHA5128954b18b37566f25554c6287472dfcc8bee3d8ce899d11122673fd40ddb0498c3b6d02c3c769c8c9a0cd2001ed2e62b251cccb35365974cc6e8343202fdf741e
-
memory/308-142-0x0000000000000000-mapping.dmp
-
memory/3784-147-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3784-146-0x0000000000000000-mapping.dmp
-
memory/3884-133-0x0000000004FD0000-0x0000000005574000-memory.dmpFilesize
5.6MB
-
memory/3884-134-0x0000000004A20000-0x0000000004AB2000-memory.dmpFilesize
584KB
-
memory/3884-135-0x0000000004BD0000-0x0000000004BDA000-memory.dmpFilesize
40KB
-
memory/3884-136-0x0000000007130000-0x00000000071CC000-memory.dmpFilesize
624KB
-
memory/3884-137-0x0000000007560000-0x00000000075C6000-memory.dmpFilesize
408KB
-
memory/3884-132-0x0000000000090000-0x00000000001AE000-memory.dmpFilesize
1.1MB
-
memory/4084-153-0x00000000073B0000-0x0000000007A2A000-memory.dmpFilesize
6.5MB
-
memory/4084-152-0x0000000071910000-0x000000007195C000-memory.dmpFilesize
304KB
-
memory/4084-159-0x0000000007090000-0x0000000007098000-memory.dmpFilesize
32KB
-
memory/4084-141-0x0000000000000000-mapping.dmp
-
memory/4084-158-0x00000000070B0000-0x00000000070CA000-memory.dmpFilesize
104KB
-
memory/4084-156-0x0000000006FF0000-0x0000000007086000-memory.dmpFilesize
600KB
-
memory/4084-155-0x0000000006DE0000-0x0000000006DEA000-memory.dmpFilesize
40KB
-
memory/5112-140-0x0000000005590000-0x0000000005BB8000-memory.dmpFilesize
6.2MB
-
memory/5112-151-0x0000000006960000-0x000000000697E000-memory.dmpFilesize
120KB
-
memory/5112-144-0x0000000005CB0000-0x0000000005D16000-memory.dmpFilesize
408KB
-
memory/5112-154-0x00000000076B0000-0x00000000076CA000-memory.dmpFilesize
104KB
-
memory/5112-150-0x0000000071910000-0x000000007195C000-memory.dmpFilesize
304KB
-
memory/5112-149-0x00000000075A0000-0x00000000075D2000-memory.dmpFilesize
200KB
-
memory/5112-157-0x00000000078E0000-0x00000000078EE000-memory.dmpFilesize
56KB
-
memory/5112-148-0x00000000063B0000-0x00000000063CE000-memory.dmpFilesize
120KB
-
memory/5112-143-0x0000000005C10000-0x0000000005C32000-memory.dmpFilesize
136KB
-
memory/5112-139-0x0000000004DE0000-0x0000000004E16000-memory.dmpFilesize
216KB
-
memory/5112-138-0x0000000000000000-mapping.dmp