Analysis
-
max time kernel
138s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-10-2022 05:20
Static task
static1
Behavioral task
behavioral1
Sample
IMG_9085976792.scr.exe
Resource
win7-20220812-en
General
-
Target
IMG_9085976792.scr.exe
-
Size
1.2MB
-
MD5
47b5a15673dcf8713891f464a3de8aaf
-
SHA1
8c83f68168599dd761c47e37cb6030c70040175a
-
SHA256
adb13e04eb377b8049411a827c557c9e3b788c54b6495cea68ae496ebc56f389
-
SHA512
4b2ae36b48a523e78f8a77367e74b9ddbe49e03bbc4f6332cf031c91077e89dbb3b36b29efd6ceb853ba4b8fdfaa59b3ab65725eb4ed24116360a48e46e38c51
-
SSDEEP
24576:0AOcZ2i7gl0p6QqMotiBsk+h6j5HUSIOg0+MkYGE:iPl0YMotiBchq5HPnr
Malware Config
Extracted
nanocore
1.2.2.0
lowaspeed.ddnsfree.com:48562
411speed.duckdns.org:48562
042723c4-0804-4212-bf56-4b1b2669ca7c
-
activate_away_mode
false
-
backup_connection_host
411speed.duckdns.org
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-07-02T05:32:06.440076436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
48562
-
default_group
Clowns
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
042723c4-0804-4212-bf56-4b1b2669ca7c
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
lowaspeed.ddnsfree.com
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
dpkvsht.exeRegSvcs.exepid process 956 dpkvsht.exe 1772 RegSvcs.exe -
Loads dropped DLL 2 IoCs
Processes:
WScript.exedpkvsht.exepid process 1344 WScript.exe 956 dpkvsht.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
dpkvsht.exeRegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "0\\8_66\\dpkvsht.exe 0\\8_66\\mfoppmxb.isi" dpkvsht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "0\\8_66\\Update.vbs" dpkvsht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run dpkvsht.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dpkvsht.exedescription pid process target process PID 956 set thread context of 1772 956 dpkvsht.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\UDP Service\udpsv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\UDP Service\udpsv.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1496 schtasks.exe 1296 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
RegSvcs.exepid process 1772 RegSvcs.exe 1772 RegSvcs.exe 1772 RegSvcs.exe 1772 RegSvcs.exe 1772 RegSvcs.exe 1772 RegSvcs.exe 1772 RegSvcs.exe 1772 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1772 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1772 RegSvcs.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
IMG_9085976792.scr.exeWScript.exedpkvsht.exeRegSvcs.exedescription pid process target process PID 1424 wrote to memory of 1344 1424 IMG_9085976792.scr.exe WScript.exe PID 1424 wrote to memory of 1344 1424 IMG_9085976792.scr.exe WScript.exe PID 1424 wrote to memory of 1344 1424 IMG_9085976792.scr.exe WScript.exe PID 1424 wrote to memory of 1344 1424 IMG_9085976792.scr.exe WScript.exe PID 1344 wrote to memory of 956 1344 WScript.exe dpkvsht.exe PID 1344 wrote to memory of 956 1344 WScript.exe dpkvsht.exe PID 1344 wrote to memory of 956 1344 WScript.exe dpkvsht.exe PID 1344 wrote to memory of 956 1344 WScript.exe dpkvsht.exe PID 956 wrote to memory of 1772 956 dpkvsht.exe RegSvcs.exe PID 956 wrote to memory of 1772 956 dpkvsht.exe RegSvcs.exe PID 956 wrote to memory of 1772 956 dpkvsht.exe RegSvcs.exe PID 956 wrote to memory of 1772 956 dpkvsht.exe RegSvcs.exe PID 956 wrote to memory of 1772 956 dpkvsht.exe RegSvcs.exe PID 956 wrote to memory of 1772 956 dpkvsht.exe RegSvcs.exe PID 956 wrote to memory of 1772 956 dpkvsht.exe RegSvcs.exe PID 956 wrote to memory of 1772 956 dpkvsht.exe RegSvcs.exe PID 956 wrote to memory of 1772 956 dpkvsht.exe RegSvcs.exe PID 1772 wrote to memory of 1496 1772 RegSvcs.exe schtasks.exe PID 1772 wrote to memory of 1496 1772 RegSvcs.exe schtasks.exe PID 1772 wrote to memory of 1496 1772 RegSvcs.exe schtasks.exe PID 1772 wrote to memory of 1496 1772 RegSvcs.exe schtasks.exe PID 1772 wrote to memory of 1296 1772 RegSvcs.exe schtasks.exe PID 1772 wrote to memory of 1296 1772 RegSvcs.exe schtasks.exe PID 1772 wrote to memory of 1296 1772 RegSvcs.exe schtasks.exe PID 1772 wrote to memory of 1296 1772 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_9085976792.scr.exe"C:\Users\Admin\AppData\Local\Temp\IMG_9085976792.scr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\8_66\vxkv.vbe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exe"C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exe" mfoppmxb.isi3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp99D0.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9BB5.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8_66\daunmepxpv.mkkFilesize
420KB
MD57d650e083326918985a7f10e9cd52b9a
SHA1a7567064bc8b719e0044f2d238c744074afb6712
SHA256b8df60912886a2fc4940532e71783b6966d9412c8725b7960f08c35db58b5242
SHA5124a8fa25fc202c8e93e56b76b9d764a980ee9ad5ceab4d61af85ab280cd50a30722eabaf71e3b73469345d204728c70b3a9c5d021645a7d17652d68c76b20e503
-
C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exeFilesize
1.1MB
MD5b5b4f7b97106aff4bd860cff0e13dcdc
SHA142ca977e0d14bde5d5831b7fe10f516186df3fc5
SHA2561dbad30b09c655ff987f25c312f56e9695d60105c240686d05d33941c854fa73
SHA5123e6742aea38c0cbfee8e5cb8f11d328c947c7e4fcca4604b498a7e254aacfe53cc8fc6171d5ed2db7755abb510c09036bfbb1e5a9d9b7b47a587b43c828e3185
-
C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exeFilesize
1.1MB
MD5b5b4f7b97106aff4bd860cff0e13dcdc
SHA142ca977e0d14bde5d5831b7fe10f516186df3fc5
SHA2561dbad30b09c655ff987f25c312f56e9695d60105c240686d05d33941c854fa73
SHA5123e6742aea38c0cbfee8e5cb8f11d328c947c7e4fcca4604b498a7e254aacfe53cc8fc6171d5ed2db7755abb510c09036bfbb1e5a9d9b7b47a587b43c828e3185
-
C:\Users\Admin\AppData\Local\Temp\8_66\mfoppmxb.isiFilesize
83.5MB
MD5e22106d436abd75caddd165838ec2826
SHA1b78e01d180056de7d6e4bbeb3ade97cced937fd8
SHA2569beac8bffb4d174454cf883282c81029cdf9a5cb88844e2798888697bed4e7a9
SHA512c7ba9d5c8bc13689d92bfb35a0588699e14d67b0a9e0a1b644f5ae26b5895c756384104f77fbff8b81c10b3bee9568bd40df2dc803900eff590a60b62d4d690b
-
C:\Users\Admin\AppData\Local\Temp\8_66\nvkm.cplFilesize
53KB
MD55a5c3d5b8d53016d4e779d2b8544d450
SHA1593eef2e4649651ad7c3c049d1274d47d3978212
SHA25682db089eced8f93e91bb2cea90288325a704fef6ef57a785bdec5a83c83419d3
SHA51217d7d1a645e1abc7d315d38521643f62013111313641d738c0131e69b72d09234924eafc4ce21c4653d72b7a30e758bb97e5f25655211ba732fb26790fb6d687
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp99D0.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp9BB5.tmpFilesize
1KB
MD50a24db62cb5b84309c4803346caaa25d
SHA167660778f61bb44168c33ed3fe56ed86cf9583e8
SHA25638d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
SHA512d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548
-
C:\Users\Admin\AppData\Local\temp\8_66\vxkv.vbeFilesize
23KB
MD5d828ba09830284028a632050a12bd1e4
SHA1f64d64d97574611c78169d6294f47f3c97c47572
SHA256882b5c9138d1bf2b38c1ea49b49943d95ed2f254c88c57bacb82e58852722371
SHA512fee86c63d1be1482a466e25191eda89e452abf2e0d845109407bd587c10517c4586e98acc6453a430fe9e280ab2c35b6b86f5a923a0d0d28bb2518aac07f5f7b
-
\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exeFilesize
1.1MB
MD5b5b4f7b97106aff4bd860cff0e13dcdc
SHA142ca977e0d14bde5d5831b7fe10f516186df3fc5
SHA2561dbad30b09c655ff987f25c312f56e9695d60105c240686d05d33941c854fa73
SHA5123e6742aea38c0cbfee8e5cb8f11d328c947c7e4fcca4604b498a7e254aacfe53cc8fc6171d5ed2db7755abb510c09036bfbb1e5a9d9b7b47a587b43c828e3185
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/956-60-0x0000000000000000-mapping.dmp
-
memory/1296-81-0x0000000000000000-mapping.dmp
-
memory/1344-55-0x0000000000000000-mapping.dmp
-
memory/1424-54-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB
-
memory/1496-79-0x0000000000000000-mapping.dmp
-
memory/1772-77-0x0000000000370000-0x00000000003AA000-memory.dmpFilesize
232KB
-
memory/1772-88-0x0000000000F60000-0x0000000000F7A000-memory.dmpFilesize
104KB
-
memory/1772-73-0x0000000000370000-0x0000000000A7A000-memory.dmpFilesize
7.0MB
-
memory/1772-69-0x0000000000370000-0x0000000000A7A000-memory.dmpFilesize
7.0MB
-
memory/1772-70-0x000000000038E792-mapping.dmp
-
memory/1772-67-0x0000000000370000-0x0000000000A7A000-memory.dmpFilesize
7.0MB
-
memory/1772-83-0x0000000000BE0000-0x0000000000BEA000-memory.dmpFilesize
40KB
-
memory/1772-84-0x0000000000C90000-0x0000000000C9C000-memory.dmpFilesize
48KB
-
memory/1772-85-0x0000000000CF0000-0x0000000000D0E000-memory.dmpFilesize
120KB
-
memory/1772-86-0x0000000000CA0000-0x0000000000CAA000-memory.dmpFilesize
40KB
-
memory/1772-87-0x0000000000D60000-0x0000000000D72000-memory.dmpFilesize
72KB
-
memory/1772-75-0x0000000000370000-0x0000000000A7A000-memory.dmpFilesize
7.0MB
-
memory/1772-89-0x00000000025D0000-0x00000000025DE000-memory.dmpFilesize
56KB
-
memory/1772-90-0x0000000004850000-0x0000000004862000-memory.dmpFilesize
72KB
-
memory/1772-91-0x0000000004860000-0x000000000486E000-memory.dmpFilesize
56KB
-
memory/1772-92-0x0000000004C40000-0x0000000004C4C000-memory.dmpFilesize
48KB
-
memory/1772-93-0x0000000004C50000-0x0000000004C64000-memory.dmpFilesize
80KB
-
memory/1772-94-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/1772-95-0x0000000004C70000-0x0000000004C84000-memory.dmpFilesize
80KB
-
memory/1772-96-0x0000000004F30000-0x0000000004F3E000-memory.dmpFilesize
56KB
-
memory/1772-97-0x0000000004F40000-0x0000000004F6E000-memory.dmpFilesize
184KB
-
memory/1772-98-0x0000000004F80000-0x0000000004F94000-memory.dmpFilesize
80KB