Analysis
-
max time kernel
73s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 08:32
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe
Resource
win7-20221111-en
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe
-
Size
325KB
-
MD5
fd3e30e6cc538bb462a2907e2372802d
-
SHA1
815cbdc11aaaea43bc3fbac418afa420e38ebd43
-
SHA256
09bb497c378ed884983055338dce20e8db38ed9b966da929b0f1d5d646a52808
-
SHA512
114e1f4ba5a35ab5c1aafaf309e68b87dcef7297aab96c2d81ca6ae9073c3cc44b6ebdce39bd83743939c92f34f2c64338554f2659877892326c717ffd847e70
-
SSDEEP
6144:5KgJA/UVYk+V8tHRLaam09031jpj8kIsjMUWCVdKrLuzGq:5K+dVYk+qjaR09031jpjOsjMNCi/vq
Malware Config
Extracted
nanocore
1.2.2.0
brewsterchristophe.ddns.net:5899
194,147,5,75:5899
b8aebc29-8c64-444f-99e6-dc4122e9bbfc
-
activate_away_mode
true
-
backup_connection_host
194,147,5,75
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-04-29T03:26:40.572298236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5899
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b8aebc29-8c64-444f-99e6-dc4122e9bbfc
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
brewsterchristophe.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systhhbbem.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systhhbbem.exe Powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PCI Subsystem = "C:\\Program Files (x86)\\PCI Subsystem\\pciss.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exedescription pid process target process PID 1576 set thread context of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\PCI Subsystem\pciss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\PCI Subsystem\pciss.exe RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Powershell.exeRegSvcs.exepid process 568 Powershell.exe 748 RegSvcs.exe 748 RegSvcs.exe 748 RegSvcs.exe 748 RegSvcs.exe 748 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 748 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exePowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe Token: SeDebugPrivilege 568 Powershell.exe Token: SeDebugPrivilege 748 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exeRegSvcs.exedescription pid process target process PID 1576 wrote to memory of 568 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe Powershell.exe PID 1576 wrote to memory of 568 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe Powershell.exe PID 1576 wrote to memory of 568 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe Powershell.exe PID 1576 wrote to memory of 568 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe Powershell.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 1576 wrote to memory of 748 1576 SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe RegSvcs.exe PID 748 wrote to memory of 540 748 RegSvcs.exe schtasks.exe PID 748 wrote to memory of 540 748 RegSvcs.exe schtasks.exe PID 748 wrote to memory of 540 748 RegSvcs.exe schtasks.exe PID 748 wrote to memory of 540 748 RegSvcs.exe schtasks.exe PID 748 wrote to memory of 1664 748 RegSvcs.exe schtasks.exe PID 748 wrote to memory of 1664 748 RegSvcs.exe schtasks.exe PID 748 wrote to memory of 1664 748 RegSvcs.exe schtasks.exe PID 748 wrote to memory of 1664 748 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23719.26078.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systhhbbem.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp840F.tmp"3⤵
- Creates scheduled task(s)
PID:540 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9CDD.tmp"3⤵
- Creates scheduled task(s)
PID:1664
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58cad1b41587ced0f1e74396794f31d58
SHA111054bf74fcf5e8e412768035e4dae43aa7b710f
SHA2563086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c
SHA51299c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef
-
Filesize
1KB
MD509063e7cc0d66a9aed53f2e2d2409103
SHA196f8fa15b5a3b2646f6691770a158c69ea7405a4
SHA256369b159ef60c988373a3c85e0b10b5ff2178504465f11965ab0d66f14124f9a1
SHA512c460a3cab70270c5cefe0464df6ddb9d50bb58ac9c49c7e62c9a55cc6bc30b6411cbc28ae418dd91b1ba1190f8394ccd937452ae70d7062740207d2ffc68e2ec