Analysis
-
max time kernel
90s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2022 05:19
Static task
static1
Behavioral task
behavioral1
Sample
IMG_9085976792.scr
Resource
win7-20220812-en
General
-
Target
IMG_9085976792.scr
-
Size
1.2MB
-
MD5
47b5a15673dcf8713891f464a3de8aaf
-
SHA1
8c83f68168599dd761c47e37cb6030c70040175a
-
SHA256
adb13e04eb377b8049411a827c557c9e3b788c54b6495cea68ae496ebc56f389
-
SHA512
4b2ae36b48a523e78f8a77367e74b9ddbe49e03bbc4f6332cf031c91077e89dbb3b36b29efd6ceb853ba4b8fdfaa59b3ab65725eb4ed24116360a48e46e38c51
-
SSDEEP
24576:0AOcZ2i7gl0p6QqMotiBsk+h6j5HUSIOg0+MkYGE:iPl0YMotiBchq5HPnr
Malware Config
Extracted
nanocore
1.2.2.0
lowaspeed.ddnsfree.com:48562
411speed.duckdns.org:48562
042723c4-0804-4212-bf56-4b1b2669ca7c
-
activate_away_mode
false
-
backup_connection_host
411speed.duckdns.org
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-07-02T05:32:06.440076436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
48562
-
default_group
Clowns
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
042723c4-0804-4212-bf56-4b1b2669ca7c
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
lowaspeed.ddnsfree.com
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
dpkvsht.exeRegSvcs.exepid process 3652 dpkvsht.exe 4280 RegSvcs.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exeIMG_9085976792.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation IMG_9085976792.scr -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
dpkvsht.exeRegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "0\\8_66\\dpkvsht.exe 0\\8_66\\mfoppmxb.isi" dpkvsht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "0\\8_66\\Update.vbs" dpkvsht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dpkvsht.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dpkvsht.exedescription pid process target process PID 3652 set thread context of 4280 3652 dpkvsht.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe RegSvcs.exe File created C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3324 schtasks.exe 4832 schtasks.exe -
Modifies registry class 2 IoCs
Processes:
WScript.exeIMG_9085976792.scrdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings IMG_9085976792.scr -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
RegSvcs.exepid process 4280 RegSvcs.exe 4280 RegSvcs.exe 4280 RegSvcs.exe 4280 RegSvcs.exe 4280 RegSvcs.exe 4280 RegSvcs.exe 4280 RegSvcs.exe 4280 RegSvcs.exe 4280 RegSvcs.exe 4280 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 4280 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4280 RegSvcs.exe Token: SeDebugPrivilege 4280 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
IMG_9085976792.scrWScript.exedpkvsht.exeRegSvcs.exedescription pid process target process PID 652 wrote to memory of 3932 652 IMG_9085976792.scr WScript.exe PID 652 wrote to memory of 3932 652 IMG_9085976792.scr WScript.exe PID 652 wrote to memory of 3932 652 IMG_9085976792.scr WScript.exe PID 3932 wrote to memory of 3652 3932 WScript.exe dpkvsht.exe PID 3932 wrote to memory of 3652 3932 WScript.exe dpkvsht.exe PID 3932 wrote to memory of 3652 3932 WScript.exe dpkvsht.exe PID 3652 wrote to memory of 4280 3652 dpkvsht.exe RegSvcs.exe PID 3652 wrote to memory of 4280 3652 dpkvsht.exe RegSvcs.exe PID 3652 wrote to memory of 4280 3652 dpkvsht.exe RegSvcs.exe PID 3652 wrote to memory of 4280 3652 dpkvsht.exe RegSvcs.exe PID 3652 wrote to memory of 4280 3652 dpkvsht.exe RegSvcs.exe PID 4280 wrote to memory of 3324 4280 RegSvcs.exe schtasks.exe PID 4280 wrote to memory of 3324 4280 RegSvcs.exe schtasks.exe PID 4280 wrote to memory of 3324 4280 RegSvcs.exe schtasks.exe PID 4280 wrote to memory of 4832 4280 RegSvcs.exe schtasks.exe PID 4280 wrote to memory of 4832 4280 RegSvcs.exe schtasks.exe PID 4280 wrote to memory of 4832 4280 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_9085976792.scr"C:\Users\Admin\AppData\Local\Temp\IMG_9085976792.scr" /S1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\8_66\vxkv.vbe"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exe"C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exe" mfoppmxb.isi3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE890.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEA75.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8_66\daunmepxpv.mkkFilesize
420KB
MD57d650e083326918985a7f10e9cd52b9a
SHA1a7567064bc8b719e0044f2d238c744074afb6712
SHA256b8df60912886a2fc4940532e71783b6966d9412c8725b7960f08c35db58b5242
SHA5124a8fa25fc202c8e93e56b76b9d764a980ee9ad5ceab4d61af85ab280cd50a30722eabaf71e3b73469345d204728c70b3a9c5d021645a7d17652d68c76b20e503
-
C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exeFilesize
1.1MB
MD5b5b4f7b97106aff4bd860cff0e13dcdc
SHA142ca977e0d14bde5d5831b7fe10f516186df3fc5
SHA2561dbad30b09c655ff987f25c312f56e9695d60105c240686d05d33941c854fa73
SHA5123e6742aea38c0cbfee8e5cb8f11d328c947c7e4fcca4604b498a7e254aacfe53cc8fc6171d5ed2db7755abb510c09036bfbb1e5a9d9b7b47a587b43c828e3185
-
C:\Users\Admin\AppData\Local\Temp\8_66\dpkvsht.exeFilesize
1.1MB
MD5b5b4f7b97106aff4bd860cff0e13dcdc
SHA142ca977e0d14bde5d5831b7fe10f516186df3fc5
SHA2561dbad30b09c655ff987f25c312f56e9695d60105c240686d05d33941c854fa73
SHA5123e6742aea38c0cbfee8e5cb8f11d328c947c7e4fcca4604b498a7e254aacfe53cc8fc6171d5ed2db7755abb510c09036bfbb1e5a9d9b7b47a587b43c828e3185
-
C:\Users\Admin\AppData\Local\Temp\8_66\mfoppmxb.isiFilesize
83.5MB
MD5e22106d436abd75caddd165838ec2826
SHA1b78e01d180056de7d6e4bbeb3ade97cced937fd8
SHA2569beac8bffb4d174454cf883282c81029cdf9a5cb88844e2798888697bed4e7a9
SHA512c7ba9d5c8bc13689d92bfb35a0588699e14d67b0a9e0a1b644f5ae26b5895c756384104f77fbff8b81c10b3bee9568bd40df2dc803900eff590a60b62d4d690b
-
C:\Users\Admin\AppData\Local\Temp\8_66\nvkm.cplFilesize
53KB
MD55a5c3d5b8d53016d4e779d2b8544d450
SHA1593eef2e4649651ad7c3c049d1274d47d3978212
SHA25682db089eced8f93e91bb2cea90288325a704fef6ef57a785bdec5a83c83419d3
SHA51217d7d1a645e1abc7d315d38521643f62013111313641d738c0131e69b72d09234924eafc4ce21c4653d72b7a30e758bb97e5f25655211ba732fb26790fb6d687
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\tmpE890.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmpEA75.tmpFilesize
1KB
MD52f26d92c1eeead3896820e56ec46f6f1
SHA1d95533b61eed7d89e4ada56bc566d60e42ac1f61
SHA25699a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa
SHA5126c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892
-
C:\Users\Admin\AppData\Local\temp\8_66\vxkv.vbeFilesize
23KB
MD5d828ba09830284028a632050a12bd1e4
SHA1f64d64d97574611c78169d6294f47f3c97c47572
SHA256882b5c9138d1bf2b38c1ea49b49943d95ed2f254c88c57bacb82e58852722371
SHA512fee86c63d1be1482a466e25191eda89e452abf2e0d845109407bd587c10517c4586e98acc6453a430fe9e280ab2c35b6b86f5a923a0d0d28bb2518aac07f5f7b
-
memory/3324-149-0x0000000000000000-mapping.dmp
-
memory/3652-135-0x0000000000000000-mapping.dmp
-
memory/3932-132-0x0000000000000000-mapping.dmp
-
memory/4280-145-0x0000000005EA0000-0x0000000006444000-memory.dmpFilesize
5.6MB
-
memory/4280-146-0x00000000057F0000-0x0000000005882000-memory.dmpFilesize
584KB
-
memory/4280-147-0x0000000005990000-0x0000000005A2C000-memory.dmpFilesize
624KB
-
memory/4280-148-0x00000000057D0000-0x00000000057DA000-memory.dmpFilesize
40KB
-
memory/4280-144-0x0000000000BC0000-0x0000000000BFA000-memory.dmpFilesize
232KB
-
memory/4280-141-0x0000000000BDE792-mapping.dmp
-
memory/4280-140-0x0000000000BC0000-0x000000000109B000-memory.dmpFilesize
4.9MB
-
memory/4280-153-0x0000000007200000-0x0000000007266000-memory.dmpFilesize
408KB
-
memory/4832-151-0x0000000000000000-mapping.dmp