Analysis
-
max time kernel
74s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-09-2022 07:24
Static task
static1
Behavioral task
behavioral1
Sample
Shaheed CV.exe
Resource
win7-20220812-en
General
-
Target
Shaheed CV.exe
-
Size
941KB
-
MD5
bea958c83d0aa73cdf2c72485c4d2fe8
-
SHA1
ffc8e9e84a7b7cb625bfebd041ce39ec0f20c573
-
SHA256
3507dd4118b87dcecb315684892df75af68bcfa1860a10f17309a76fecc45fda
-
SHA512
4e045fac70205fdb6e872fcda7e56aad993941c4b95b1ec468d9fec2281ebdfd7855dd67d2479c520fa029f5911007bf9b84dd501d0f9a9262097ff96b4eba6f
-
SSDEEP
12288:Z9F2iNf2kIE8Jk84Hr7KYuzfUGCfA1s5DL8cCG1ADqjJ5npVNFDlnl/9yHWWDdjI:Z9F1A28KrHuDwIs5DoFwjrp7
Malware Config
Extracted
nanocore
1.2.2.0
xp230522.ddns.net:1996
99bdd317-26d2-4098-abcb-4bff156f262b
-
activate_away_mode
true
-
backup_connection_host
xp230522.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-05-07T04:04:00.193503536Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1996
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
99bdd317-26d2-4098-abcb-4bff156f262b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
xp230522.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Shaheed CV.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" Shaheed CV.exe -
Processes:
Shaheed CV.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Shaheed CV.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shaheed CV.exedescription pid process target process PID 864 set thread context of 2024 864 Shaheed CV.exe Shaheed CV.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Shaheed CV.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisvc.exe Shaheed CV.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe Shaheed CV.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1360 schtasks.exe 1716 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Shaheed CV.exepid process 2024 Shaheed CV.exe 2024 Shaheed CV.exe 2024 Shaheed CV.exe 2024 Shaheed CV.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Shaheed CV.exepid process 2024 Shaheed CV.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Shaheed CV.exedescription pid process Token: SeDebugPrivilege 2024 Shaheed CV.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Shaheed CV.exeShaheed CV.exedescription pid process target process PID 864 wrote to memory of 2024 864 Shaheed CV.exe Shaheed CV.exe PID 864 wrote to memory of 2024 864 Shaheed CV.exe Shaheed CV.exe PID 864 wrote to memory of 2024 864 Shaheed CV.exe Shaheed CV.exe PID 864 wrote to memory of 2024 864 Shaheed CV.exe Shaheed CV.exe PID 864 wrote to memory of 2024 864 Shaheed CV.exe Shaheed CV.exe PID 864 wrote to memory of 2024 864 Shaheed CV.exe Shaheed CV.exe PID 864 wrote to memory of 2024 864 Shaheed CV.exe Shaheed CV.exe PID 864 wrote to memory of 2024 864 Shaheed CV.exe Shaheed CV.exe PID 864 wrote to memory of 2024 864 Shaheed CV.exe Shaheed CV.exe PID 2024 wrote to memory of 1360 2024 Shaheed CV.exe schtasks.exe PID 2024 wrote to memory of 1360 2024 Shaheed CV.exe schtasks.exe PID 2024 wrote to memory of 1360 2024 Shaheed CV.exe schtasks.exe PID 2024 wrote to memory of 1360 2024 Shaheed CV.exe schtasks.exe PID 2024 wrote to memory of 1716 2024 Shaheed CV.exe schtasks.exe PID 2024 wrote to memory of 1716 2024 Shaheed CV.exe schtasks.exe PID 2024 wrote to memory of 1716 2024 Shaheed CV.exe schtasks.exe PID 2024 wrote to memory of 1716 2024 Shaheed CV.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shaheed CV.exe"C:\Users\Admin\AppData\Local\Temp\Shaheed CV.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shaheed CV.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6440.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6624.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6440.tmpFilesize
1KB
MD5d48f566eec93c656b3b5333c24ea199e
SHA1916f6940f164d5c4024d3f979a1fff32d4485cfa
SHA256c3047f0d885b675b5a70ebce2336809feab8ddc685eee03309f9f726ddfa4f49
SHA512a72b66390c9720742090a7737cd893d8547cd5e83ab7ed65462b51f5fc701eba65509b1a56d15bc0f17d38879ac48cee0a67665f33b02dffbfa6de06433ee18d
-
C:\Users\Admin\AppData\Local\Temp\tmp6624.tmpFilesize
1KB
MD54e71faa3a77029484cfaba423d96618f
SHA19c837d050bb43d69dc608af809c292e13bca4718
SHA256c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb
SHA5126d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0
-
memory/864-55-0x0000000076321000-0x0000000076323000-memory.dmpFilesize
8KB
-
memory/864-56-0x00000000005A0000-0x00000000005C0000-memory.dmpFilesize
128KB
-
memory/864-57-0x0000000005170000-0x00000000051FA000-memory.dmpFilesize
552KB
-
memory/864-58-0x00000000022E0000-0x000000000231A000-memory.dmpFilesize
232KB
-
memory/864-54-0x0000000000D80000-0x0000000000E70000-memory.dmpFilesize
960KB
-
memory/1360-72-0x0000000000000000-mapping.dmp
-
memory/1716-74-0x0000000000000000-mapping.dmp
-
memory/2024-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2024-79-0x0000000000B40000-0x0000000000B52000-memory.dmpFilesize
72KB
-
memory/2024-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2024-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2024-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2024-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2024-60-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2024-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2024-76-0x0000000000930000-0x000000000093A000-memory.dmpFilesize
40KB
-
memory/2024-77-0x00000000009E0000-0x00000000009FE000-memory.dmpFilesize
120KB
-
memory/2024-78-0x0000000000940000-0x000000000094A000-memory.dmpFilesize
40KB
-
memory/2024-66-0x000000000041E792-mapping.dmp
-
memory/2024-80-0x0000000000CB0000-0x0000000000CCA000-memory.dmpFilesize
104KB
-
memory/2024-81-0x0000000000C60000-0x0000000000C6E000-memory.dmpFilesize
56KB
-
memory/2024-82-0x0000000000D20000-0x0000000000D32000-memory.dmpFilesize
72KB
-
memory/2024-83-0x0000000000D30000-0x0000000000D3C000-memory.dmpFilesize
48KB
-
memory/2024-84-0x0000000000D40000-0x0000000000D4E000-memory.dmpFilesize
56KB
-
memory/2024-85-0x0000000000D50000-0x0000000000D64000-memory.dmpFilesize
80KB
-
memory/2024-86-0x0000000000D60000-0x0000000000D70000-memory.dmpFilesize
64KB
-
memory/2024-87-0x0000000000D70000-0x0000000000D84000-memory.dmpFilesize
80KB
-
memory/2024-88-0x00000000043D0000-0x00000000043DE000-memory.dmpFilesize
56KB
-
memory/2024-89-0x0000000004800000-0x000000000482E000-memory.dmpFilesize
184KB
-
memory/2024-90-0x0000000004830000-0x0000000004844000-memory.dmpFilesize
80KB