Analysis
-
max time kernel
108s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-10-2022 06:06
Static task
static1
Behavioral task
behavioral1
Sample
resume.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
resume.exe
Resource
win10v2004-20220901-en
General
-
Target
resume.exe
-
Size
1.1MB
-
MD5
36fdb56f5242a38b5857f791e7a3162d
-
SHA1
1e9207d91cc127b28a13835295cdb24cc7aa7508
-
SHA256
a04ab9db28f46cc5a2efc487c63660df3c7c061f179dbe5e0cc175915720a832
-
SHA512
46c5dcf5dcbfdbc885a86d8e86a6ee1c63f383abb0c0c1f3fc16c43d1257fdd85c29357da94ad3eea09fe317634f21142ab28c7eb9a50632b5b35153dbc7a109
-
SSDEEP
24576:3W/PgWHKk8I1d7e9UcR8wu5ekv1O4arMG3WccNxkjr:3W/PgWHKYc45ekQfr13Wcok
Malware Config
Extracted
nanocore
1.2.2.0
dera5nano.ddns.net:1010
107.182.129.248:1010
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
activate_away_mode
true
-
backup_connection_host
107.182.129.248
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-06T12:07:01.612898436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1010
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dera5nano.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
resume.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" resume.exe -
Processes:
resume.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA resume.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
resume.exedescription pid process target process PID 1048 set thread context of 1316 1048 resume.exe resume.exe -
Drops file in Program Files directory 2 IoCs
Processes:
resume.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisvc.exe resume.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe resume.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1296 schtasks.exe 1540 schtasks.exe 1708 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
resume.exepid process 1316 resume.exe 1316 resume.exe 1316 resume.exe 1316 resume.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
resume.exepid process 1316 resume.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
resume.exedescription pid process Token: SeDebugPrivilege 1316 resume.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
resume.exeresume.exedescription pid process target process PID 1048 wrote to memory of 1296 1048 resume.exe schtasks.exe PID 1048 wrote to memory of 1296 1048 resume.exe schtasks.exe PID 1048 wrote to memory of 1296 1048 resume.exe schtasks.exe PID 1048 wrote to memory of 1296 1048 resume.exe schtasks.exe PID 1048 wrote to memory of 1316 1048 resume.exe resume.exe PID 1048 wrote to memory of 1316 1048 resume.exe resume.exe PID 1048 wrote to memory of 1316 1048 resume.exe resume.exe PID 1048 wrote to memory of 1316 1048 resume.exe resume.exe PID 1048 wrote to memory of 1316 1048 resume.exe resume.exe PID 1048 wrote to memory of 1316 1048 resume.exe resume.exe PID 1048 wrote to memory of 1316 1048 resume.exe resume.exe PID 1048 wrote to memory of 1316 1048 resume.exe resume.exe PID 1048 wrote to memory of 1316 1048 resume.exe resume.exe PID 1316 wrote to memory of 1540 1316 resume.exe schtasks.exe PID 1316 wrote to memory of 1540 1316 resume.exe schtasks.exe PID 1316 wrote to memory of 1540 1316 resume.exe schtasks.exe PID 1316 wrote to memory of 1540 1316 resume.exe schtasks.exe PID 1316 wrote to memory of 1708 1316 resume.exe schtasks.exe PID 1316 wrote to memory of 1708 1316 resume.exe schtasks.exe PID 1316 wrote to memory of 1708 1316 resume.exe schtasks.exe PID 1316 wrote to memory of 1708 1316 resume.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\resume.exe"C:\Users\Admin\AppData\Local\Temp\resume.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IBJXRapSa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC0C1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\resume.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC5A1.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC65D.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC0C1.tmpFilesize
1KB
MD54f90b12b222cdeebdf85edadadead66f
SHA110e49567854c53b870adf19337fcbb95fabc76bf
SHA2560d60dc8e8237705165f7f3e9201cf39605f22fbb717e1de862dbc0f15924acb7
SHA5124a963ca7d77dccba31d6f6384f1b1e01f0a044aa7657ef28e9fc1a2ae4347ed758914ee7635a86c425f2ce12a0beb93bb21c89f8f4fcac67f64373815eab9b2a
-
C:\Users\Admin\AppData\Local\Temp\tmpC5A1.tmpFilesize
1KB
MD527b1f082d8e93c2d948f1028aed9c88e
SHA1f658bc7c50010c82900d5e889d57588452071f47
SHA256cdd6e5a2d1e254468bc174e84ba8d23d30a4255e65cda2d1d33e68a3c03baf8d
SHA512a1260fd1dd50d9488792f0a92c0be5d62a438888c0e7ae524daae87501e59d86c49895e4d027e3ef42a3ed4974de038b61ee1fd40b1a35da4710077b0add477f
-
C:\Users\Admin\AppData\Local\Temp\tmpC65D.tmpFilesize
1KB
MD54e71faa3a77029484cfaba423d96618f
SHA19c837d050bb43d69dc608af809c292e13bca4718
SHA256c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb
SHA5126d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0
-
memory/1048-55-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1048-56-0x0000000000540000-0x0000000000560000-memory.dmpFilesize
128KB
-
memory/1048-57-0x00000000082A0000-0x000000000836E000-memory.dmpFilesize
824KB
-
memory/1048-58-0x00000000045C0000-0x0000000004640000-memory.dmpFilesize
512KB
-
memory/1048-54-0x0000000000A40000-0x0000000000B64000-memory.dmpFilesize
1.1MB
-
memory/1296-59-0x0000000000000000-mapping.dmp
-
memory/1316-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1316-81-0x0000000000850000-0x0000000000862000-memory.dmpFilesize
72KB
-
memory/1316-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1316-68-0x000000000041E792-mapping.dmp
-
memory/1316-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1316-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1316-92-0x0000000004530000-0x0000000004544000-memory.dmpFilesize
80KB
-
memory/1316-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1316-91-0x0000000004A20000-0x0000000004A4E000-memory.dmpFilesize
184KB
-
memory/1316-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1316-78-0x0000000000590000-0x000000000059A000-memory.dmpFilesize
40KB
-
memory/1316-79-0x00000000005A0000-0x00000000005BE000-memory.dmpFilesize
120KB
-
memory/1316-80-0x0000000000610000-0x000000000061A000-memory.dmpFilesize
40KB
-
memory/1316-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1316-82-0x0000000002210000-0x000000000222A000-memory.dmpFilesize
104KB
-
memory/1316-83-0x0000000000A30000-0x0000000000A3E000-memory.dmpFilesize
56KB
-
memory/1316-84-0x0000000002230000-0x0000000002242000-memory.dmpFilesize
72KB
-
memory/1316-85-0x0000000002240000-0x000000000224E000-memory.dmpFilesize
56KB
-
memory/1316-86-0x00000000022D0000-0x00000000022DC000-memory.dmpFilesize
48KB
-
memory/1316-87-0x00000000022E0000-0x00000000022F4000-memory.dmpFilesize
80KB
-
memory/1316-88-0x00000000022F0000-0x0000000002300000-memory.dmpFilesize
64KB
-
memory/1316-89-0x0000000004400000-0x0000000004414000-memory.dmpFilesize
80KB
-
memory/1316-90-0x0000000004410000-0x000000000441E000-memory.dmpFilesize
56KB
-
memory/1540-74-0x0000000000000000-mapping.dmp
-
memory/1708-76-0x0000000000000000-mapping.dmp