nanocore | 60951ec1ed11f5ca0eeda2940466dc675d2fefa2bf3750c26b12c967d0c1fba4

System Information Discovery

Processes:

a0090a664165ba54933e2a9ca46ad35b.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a0090a664165ba54933e2a9ca46ad35b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a0090a664165ba54933e2a9ca46ad35b.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

a0090a664165ba54933e2a9ca46ad35b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a0090a664165ba54933e2a9ca46ad35b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a0090a664165ba54933e2a9ca46ad35b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Monitor = "C:\\Program Files (x86)\\AGP Monitor\\agpmon.exe"	a0090a664165ba54933e2a9ca46ad35b.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

a0090a664165ba54933e2a9ca46ad35b.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a0090a664165ba54933e2a9ca46ad35b.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

a0090a664165ba54933e2a9ca46ad35b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	a0090a664165ba54933e2a9ca46ad35b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	a0090a664165ba54933e2a9ca46ad35b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a0090a664165ba54933e2a9ca46ad35b.exe

description pid process target process

PID 4808 set thread context of 4680 4808 a0090a664165ba54933e2a9ca46ad35b.exe a0090a664165ba54933e2a9ca46ad35b.exe

description	pid	process	target process
PID 4808 set thread context of 4680	4808	a0090a664165ba54933e2a9ca46ad35b.exe	a0090a664165ba54933e2a9ca46ad35b.exe

Drops file in Program Files directory 2 IoCs

Processes:

a0090a664165ba54933e2a9ca46ad35b.exe

description	ioc	process
File created	C:\Program Files (x86)\AGP Monitor\agpmon.exe	a0090a664165ba54933e2a9ca46ad35b.exe
File opened for modification	C:\Program Files (x86)\AGP Monitor\agpmon.exe	a0090a664165ba54933e2a9ca46ad35b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

440 schtasks.exe
2788 schtasks.exe
4372 schtasks.exe

pid	process
440	schtasks.exe
2788	schtasks.exe
4372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

a0090a664165ba54933e2a9ca46ad35b.exepowershell.exea0090a664165ba54933e2a9ca46ad35b.exe

pid	process
4808	a0090a664165ba54933e2a9ca46ad35b.exe
4808	a0090a664165ba54933e2a9ca46ad35b.exe
4808	a0090a664165ba54933e2a9ca46ad35b.exe
4808	a0090a664165ba54933e2a9ca46ad35b.exe
4808	a0090a664165ba54933e2a9ca46ad35b.exe
4808	a0090a664165ba54933e2a9ca46ad35b.exe
4328	powershell.exe
4808	a0090a664165ba54933e2a9ca46ad35b.exe
4328	powershell.exe
4680	a0090a664165ba54933e2a9ca46ad35b.exe
4680	a0090a664165ba54933e2a9ca46ad35b.exe
4680	a0090a664165ba54933e2a9ca46ad35b.exe
4680	a0090a664165ba54933e2a9ca46ad35b.exe
4680	a0090a664165ba54933e2a9ca46ad35b.exe
4680	a0090a664165ba54933e2a9ca46ad35b.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

a0090a664165ba54933e2a9ca46ad35b.exe

pid process

4680 a0090a664165ba54933e2a9ca46ad35b.exe

pid	process
4680	a0090a664165ba54933e2a9ca46ad35b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

a0090a664165ba54933e2a9ca46ad35b.exepowershell.exea0090a664165ba54933e2a9ca46ad35b.exe

description	pid	process
Token: SeDebugPrivilege	4808	a0090a664165ba54933e2a9ca46ad35b.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4680	a0090a664165ba54933e2a9ca46ad35b.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

a0090a664165ba54933e2a9ca46ad35b.exea0090a664165ba54933e2a9ca46ad35b.exe

description	pid	process	target process
PID 4808 wrote to memory of 4328	4808	a0090a664165ba54933e2a9ca46ad35b.exe	powershell.exe
PID 4808 wrote to memory of 4328	4808	a0090a664165ba54933e2a9ca46ad35b.exe	powershell.exe
PID 4808 wrote to memory of 4328	4808	a0090a664165ba54933e2a9ca46ad35b.exe	powershell.exe
PID 4808 wrote to memory of 440	4808	a0090a664165ba54933e2a9ca46ad35b.exe	schtasks.exe
PID 4808 wrote to memory of 440	4808	a0090a664165ba54933e2a9ca46ad35b.exe	schtasks.exe
PID 4808 wrote to memory of 440	4808	a0090a664165ba54933e2a9ca46ad35b.exe	schtasks.exe
PID 4808 wrote to memory of 4680	4808	a0090a664165ba54933e2a9ca46ad35b.exe	a0090a664165ba54933e2a9ca46ad35b.exe
PID 4808 wrote to memory of 4680	4808	a0090a664165ba54933e2a9ca46ad35b.exe	a0090a664165ba54933e2a9ca46ad35b.exe
PID 4808 wrote to memory of 4680	4808	a0090a664165ba54933e2a9ca46ad35b.exe	a0090a664165ba54933e2a9ca46ad35b.exe
PID 4808 wrote to memory of 4680	4808	a0090a664165ba54933e2a9ca46ad35b.exe	a0090a664165ba54933e2a9ca46ad35b.exe
PID 4808 wrote to memory of 4680	4808	a0090a664165ba54933e2a9ca46ad35b.exe	a0090a664165ba54933e2a9ca46ad35b.exe
PID 4808 wrote to memory of 4680	4808	a0090a664165ba54933e2a9ca46ad35b.exe	a0090a664165ba54933e2a9ca46ad35b.exe
PID 4808 wrote to memory of 4680	4808	a0090a664165ba54933e2a9ca46ad35b.exe	a0090a664165ba54933e2a9ca46ad35b.exe
PID 4808 wrote to memory of 4680	4808	a0090a664165ba54933e2a9ca46ad35b.exe	a0090a664165ba54933e2a9ca46ad35b.exe
PID 4680 wrote to memory of 2788	4680	a0090a664165ba54933e2a9ca46ad35b.exe	schtasks.exe
PID 4680 wrote to memory of 2788	4680	a0090a664165ba54933e2a9ca46ad35b.exe	schtasks.exe
PID 4680 wrote to memory of 2788	4680	a0090a664165ba54933e2a9ca46ad35b.exe	schtasks.exe
PID 4680 wrote to memory of 4372	4680	a0090a664165ba54933e2a9ca46ad35b.exe	schtasks.exe
PID 4680 wrote to memory of 4372	4680	a0090a664165ba54933e2a9ca46ad35b.exe	schtasks.exe
PID 4680 wrote to memory of 4372	4680	a0090a664165ba54933e2a9ca46ad35b.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\a0090a664165ba54933e2a9ca46ad35b.exe
"C:\Users\Admin\AppData\Local\Temp\a0090a664165ba54933e2a9ca46ad35b.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GUszqdnI.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GUszqdnI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2DD1.tmp"
2⤵
- Creates scheduled task(s)
PID:440

C:\Users\Admin\AppData\Local\Temp\a0090a664165ba54933e2a9ca46ad35b.exe
"C:\Users\Admin\AppData\Local\Temp\a0090a664165ba54933e2a9ca46ad35b.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4BC9.tmp"
3⤵
- Creates scheduled task(s)
PID:2788

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5E78.tmp"
3⤵
- Creates scheduled task(s)
PID:4372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Modify Registry

T1112

Credential Access

Discovery

Query Registry

5

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

5

Peripheral Device Discovery