Analysis
-
max time kernel
124s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-09-2022 05:33
Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7-20220812-en
General
-
Target
new order.exe
-
Size
929KB
-
MD5
450aa1d2ac8e10a3b8363fe2945462bd
-
SHA1
173275f693a10f8919c45dfb21f8035c7bc45fb6
-
SHA256
316ff42588b6cf8c5a435efb67d44d08a2d860bab89612fc3e85ec6e9f4b4455
-
SHA512
c3f95286f4bd09c87dd41acb12c1279b0cf6a547fed73c7c073c21728503ae8fec4974bdec351b9049acbb3a42f497a9731496073a39ccc6f08234f6df20dc99
-
SSDEEP
24576:q/hIikSs/wzknb6gT3wvFHANcvqpbInfDcvkCqvH:q/eNhYkbQvp8cNnbcsCqvH
Malware Config
Extracted
nanocore
1.2.2.0
146.70.76.43:56281
6a8dc68c-2ae6-4a66-b5dc-80cfa679c766
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-03-18T21:54:26.619077736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
56281
-
default_group
jop
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
6a8dc68c-2ae6-4a66-b5dc-80cfa679c766
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
146.70.76.43
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
9
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
new order.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Luqkasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Znxqmfqxv\\Luqkasd.exe\"" new order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
new order.exedescription pid process target process PID 2004 set thread context of 1640 2004 new order.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exeInstallUtil.exepid process 968 powershell.exe 1640 InstallUtil.exe 1640 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exenew order.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 968 powershell.exe Token: SeDebugPrivilege 2004 new order.exe Token: SeDebugPrivilege 1640 InstallUtil.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
new order.exedescription pid process target process PID 2004 wrote to memory of 968 2004 new order.exe powershell.exe PID 2004 wrote to memory of 968 2004 new order.exe powershell.exe PID 2004 wrote to memory of 968 2004 new order.exe powershell.exe PID 2004 wrote to memory of 968 2004 new order.exe powershell.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe PID 2004 wrote to memory of 1640 2004 new order.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"C:\Users\Admin\AppData\Local\Temp\new order.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-58-0x0000000000000000-mapping.dmp
-
memory/968-62-0x000000006FC60000-0x000000007020B000-memory.dmpFilesize
5.7MB
-
memory/968-61-0x000000006FC60000-0x000000007020B000-memory.dmpFilesize
5.7MB
-
memory/968-60-0x000000006FC60000-0x000000007020B000-memory.dmpFilesize
5.7MB
-
memory/1640-66-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1640-68-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1640-79-0x0000000004E05000-0x0000000004E16000-memory.dmpFilesize
68KB
-
memory/1640-78-0x0000000000570000-0x000000000057A000-memory.dmpFilesize
40KB
-
memory/1640-63-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1640-64-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1640-77-0x0000000000550000-0x000000000056E000-memory.dmpFilesize
120KB
-
memory/1640-76-0x0000000000500000-0x000000000050A000-memory.dmpFilesize
40KB
-
memory/1640-69-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1640-70-0x000000000043D98E-mapping.dmp
-
memory/1640-72-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1640-74-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2004-57-0x0000000004C20000-0x0000000004CB2000-memory.dmpFilesize
584KB
-
memory/2004-54-0x00000000000C0000-0x00000000001AC000-memory.dmpFilesize
944KB
-
memory/2004-55-0x0000000004870000-0x0000000004942000-memory.dmpFilesize
840KB
-
memory/2004-56-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB