Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2022 05:20
Static task
static1
Behavioral task
behavioral1
Sample
IMG_9085976792.scr.exe
Resource
win7-20220812-en
General
-
Target
IMG_9085976792.scr.exe
-
Size
1.2MB
-
MD5
47b5a15673dcf8713891f464a3de8aaf
-
SHA1
8c83f68168599dd761c47e37cb6030c70040175a
-
SHA256
adb13e04eb377b8049411a827c557c9e3b788c54b6495cea68ae496ebc56f389
-
SHA512
4b2ae36b48a523e78f8a77367e74b9ddbe49e03bbc4f6332cf031c91077e89dbb3b36b29efd6ceb853ba4b8fdfaa59b3ab65725eb4ed24116360a48e46e38c51
-
SSDEEP
24576:0AOcZ2i7gl0p6QqMotiBsk+h6j5HUSIOg0+MkYGE:iPl0YMotiBchq5HPnr
Malware Config
Extracted
nanocore
1.2.2.0
lowaspeed.ddnsfree.com:48562
411speed.duckdns.org:48562
042723c4-0804-4212-bf56-4b1b2669ca7c
-
activate_away_mode
false
-
backup_connection_host
411speed.duckdns.org
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-07-02T05:32:06.440076436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
48562
-
default_group
Clowns
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
042723c4-0804-4212-bf56-4b1b2669ca7c
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
lowaspeed.ddnsfree.com
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
dpkvsht.exeRegSvcs.exepid process 2960 dpkvsht.exe 2808 RegSvcs.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IMG_9085976792.scr.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation IMG_9085976792.scr.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
dpkvsht.exeRegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "0\\8_66\\Update.vbs" dpkvsht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dpkvsht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "0\\8_66\\dpkvsht.exe 0\\8_66\\mfoppmxb.isi" dpkvsht.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dpkvsht.exedescription pid process target process PID 2960 set thread context of 2808 2960 dpkvsht.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\DDP Host\ddphost.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 2 IoCs
Processes:
WScript.exeIMG_9085976792.scr.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings IMG_9085976792.scr.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
RegSvcs.exepid process 2808 RegSvcs.exe 2808 RegSvcs.exe 2808 RegSvcs.exe 2808 RegSvcs.exe 2808 RegSvcs.exe 2808 RegSvcs.exe 2808 RegSvcs.exe 2808 RegSvcs.exe 2808 RegSvcs.exe 2808 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2808 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2808 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
IMG_9085976792.scr.exeWScript.exedpkvsht.exeRegSvcs.exedescription pid process target process PID 1480 wrote to memory of 1296 1480 IMG_9085976792.scr.exe WScript.exe PID 1480 wrote to memory of 1296 1480 IMG_9085976792.scr.exe WScript.exe PID 1480 wrote to memory of 1296 1480 IMG_9085976792.scr.exe WScript.exe PID 1296 wrote to memory of 2960 1296 WScript.exe dpkvsht.exe PID 1296 wrote to memory of 2960 1296 WScript.exe dpkvsht.exe PID 1296 wrote to memory of 2960 1296 WScript.exe dpkvsht.exe PID 2960 wrote to memory of 2808 2960 dpkvsht.exe RegSvcs.exe PID 2960 wrote to memory of 2808 2960 dpkvsht.exe RegSvcs.exe PID 2960 wrote to memory of 2808 2960 dpkvsht.exe RegSvcs.exe PID 2960 wrote to memory of 2808 2960 dpkvsht.exe RegSvcs.exe PID 2960 wrote to memory of 2808 2960 dpkvsht.exe RegSvcs.exe PID 2808 wrote to memory of 4612 2808 RegSvcs.exe schtasks.exe PID 2808 wrote to memory of 4612 2808 RegSvcs.exe schtasks.exe PID 2808 wrote to memory of 4612 2808 RegSvcs.exe schtasks.exe PID 2808 wrote to memory of 312 2808 RegSvcs.exe schtasks.exe PID 2808 wrote to memory of 312 2808 RegSvcs.exe schtasks.exe PID 2808 wrote to memory of 312 2808 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_9085976792.scr.exe"C:\Users\Admin\AppData\Local\Temp\IMG_9085976792.scr.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\8_66\vxkv.vbe"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exe"C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exe" mfoppmxb.isi3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8BCA.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8CB5.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8_66\daunmepxpv.mkkFilesize
420KB
MD57d650e083326918985a7f10e9cd52b9a
SHA1a7567064bc8b719e0044f2d238c744074afb6712
SHA256b8df60912886a2fc4940532e71783b6966d9412c8725b7960f08c35db58b5242
SHA5124a8fa25fc202c8e93e56b76b9d764a980ee9ad5ceab4d61af85ab280cd50a30722eabaf71e3b73469345d204728c70b3a9c5d021645a7d17652d68c76b20e503
-
C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exeFilesize
1.1MB
MD5b5b4f7b97106aff4bd860cff0e13dcdc
SHA142ca977e0d14bde5d5831b7fe10f516186df3fc5
SHA2561dbad30b09c655ff987f25c312f56e9695d60105c240686d05d33941c854fa73
SHA5123e6742aea38c0cbfee8e5cb8f11d328c947c7e4fcca4604b498a7e254aacfe53cc8fc6171d5ed2db7755abb510c09036bfbb1e5a9d9b7b47a587b43c828e3185
-
C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exeFilesize
1.1MB
MD5b5b4f7b97106aff4bd860cff0e13dcdc
SHA142ca977e0d14bde5d5831b7fe10f516186df3fc5
SHA2561dbad30b09c655ff987f25c312f56e9695d60105c240686d05d33941c854fa73
SHA5123e6742aea38c0cbfee8e5cb8f11d328c947c7e4fcca4604b498a7e254aacfe53cc8fc6171d5ed2db7755abb510c09036bfbb1e5a9d9b7b47a587b43c828e3185
-
C:\Users\Admin\AppData\Local\Temp\8_66\mfoppmxb.isiFilesize
83.5MB
MD5e22106d436abd75caddd165838ec2826
SHA1b78e01d180056de7d6e4bbeb3ade97cced937fd8
SHA2569beac8bffb4d174454cf883282c81029cdf9a5cb88844e2798888697bed4e7a9
SHA512c7ba9d5c8bc13689d92bfb35a0588699e14d67b0a9e0a1b644f5ae26b5895c756384104f77fbff8b81c10b3bee9568bd40df2dc803900eff590a60b62d4d690b
-
C:\Users\Admin\AppData\Local\Temp\8_66\nvkm.cplFilesize
53KB
MD55a5c3d5b8d53016d4e779d2b8544d450
SHA1593eef2e4649651ad7c3c049d1274d47d3978212
SHA25682db089eced8f93e91bb2cea90288325a704fef6ef57a785bdec5a83c83419d3
SHA51217d7d1a645e1abc7d315d38521643f62013111313641d738c0131e69b72d09234924eafc4ce21c4653d72b7a30e758bb97e5f25655211ba732fb26790fb6d687
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\tmp8BCA.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp8CB5.tmpFilesize
1KB
MD52271642ca970891700e3f48439739ed8
SHA1cd472df2349f7db9e1e460d0ee28acd97b8a8793
SHA2567aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68
SHA5124669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807
-
C:\Users\Admin\AppData\Local\temp\8_66\vxkv.vbeFilesize
23KB
MD5d828ba09830284028a632050a12bd1e4
SHA1f64d64d97574611c78169d6294f47f3c97c47572
SHA256882b5c9138d1bf2b38c1ea49b49943d95ed2f254c88c57bacb82e58852722371
SHA512fee86c63d1be1482a466e25191eda89e452abf2e0d845109407bd587c10517c4586e98acc6453a430fe9e280ab2c35b6b86f5a923a0d0d28bb2518aac07f5f7b
-
memory/312-151-0x0000000000000000-mapping.dmp
-
memory/1296-132-0x0000000000000000-mapping.dmp
-
memory/2808-144-0x0000000000570000-0x00000000005AA000-memory.dmpFilesize
232KB
-
memory/2808-145-0x0000000005920000-0x0000000005EC4000-memory.dmpFilesize
5.6MB
-
memory/2808-146-0x0000000005410000-0x00000000054A2000-memory.dmpFilesize
584KB
-
memory/2808-147-0x00000000054B0000-0x000000000554C000-memory.dmpFilesize
624KB
-
memory/2808-148-0x00000000053F0000-0x00000000053FA000-memory.dmpFilesize
40KB
-
memory/2808-141-0x000000000058E792-mapping.dmp
-
memory/2808-140-0x0000000000570000-0x0000000000C9F000-memory.dmpFilesize
7.2MB
-
memory/2808-153-0x0000000006E00000-0x0000000006E66000-memory.dmpFilesize
408KB
-
memory/2960-135-0x0000000000000000-mapping.dmp
-
memory/4612-149-0x0000000000000000-mapping.dmp