Analysis

  • max time kernel
    173s
  • max time network
    88s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 12:44

General

  • Target

    f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe

  • Size

    220KB

  • MD5

    31a3abe2824e6e4cce48e207df6b3aa5

  • SHA1

    cd1466b5c1e964c53ade0acdcd3ad6ecf2fc8505

  • SHA256

    f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333

  • SHA512

    c93a1310ebcfe3472e68a4db45d1dabfabaa18711997286d9f2986bae1d63d66f3e09a397c6bde3c12d11e4669b6e9a699fa6ad09a657d603c1749e45971e7e2

  • SSDEEP

    3072:xKNQHcGBMVpXUxRVE+FXeRiD1zuO9T1eRp7VFtJW6uVRK0q/3/v:xK5+MVpWRVyR6uI1eP7VFtJkwv

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe
    "C:\Users\Admin\AppData\Local\Temp\f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        3⤵
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /create /f /tn "PCI Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC063.tmp"
          4⤵
          • Creates scheduled task(s)
          PID:1596
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /create /f /tn "PCI Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF2C9.tmp"
          4⤵
          • Creates scheduled task(s)
          PID:2012
      • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe" -keyhide -prochide 1700 -reg C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe -proc 1700 C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1088

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpC063.tmp

    Filesize

    1KB

    MD5

    28258c5ed38ce92a70b8279890118dad

    SHA1

    975e9d2851e0fac8a150822ac12766e7498393e8

    SHA256

    5e4399d3686f5b17651cd096bdab270c2d4f33f87aa39e750e00d2431fd03c4a

    SHA512

    d13d9d836ee68f59aaea24a7500fcef7078b74837f9188b18ebd06df0e83d22f5595bd53562a637a38daa526f6bc0884d9aa9d5348f0134a1ac21ec702031414

  • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe

    Filesize

    220KB

    MD5

    31a3abe2824e6e4cce48e207df6b3aa5

    SHA1

    cd1466b5c1e964c53ade0acdcd3ad6ecf2fc8505

    SHA256

    f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333

    SHA512

    c93a1310ebcfe3472e68a4db45d1dabfabaa18711997286d9f2986bae1d63d66f3e09a397c6bde3c12d11e4669b6e9a699fa6ad09a657d603c1749e45971e7e2

  • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe

    Filesize

    220KB

    MD5

    31a3abe2824e6e4cce48e207df6b3aa5

    SHA1

    cd1466b5c1e964c53ade0acdcd3ad6ecf2fc8505

    SHA256

    f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333

    SHA512

    c93a1310ebcfe3472e68a4db45d1dabfabaa18711997286d9f2986bae1d63d66f3e09a397c6bde3c12d11e4669b6e9a699fa6ad09a657d603c1749e45971e7e2

  • \Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe

    Filesize

    220KB

    MD5

    31a3abe2824e6e4cce48e207df6b3aa5

    SHA1

    cd1466b5c1e964c53ade0acdcd3ad6ecf2fc8505

    SHA256

    f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333

    SHA512

    c93a1310ebcfe3472e68a4db45d1dabfabaa18711997286d9f2986bae1d63d66f3e09a397c6bde3c12d11e4669b6e9a699fa6ad09a657d603c1749e45971e7e2

  • memory/1052-57-0x0000000000000000-mapping.dmp

  • memory/1052-60-0x00000000745D0000-0x0000000074B7B000-memory.dmp

    Filesize

    5.7MB

  • memory/1052-61-0x0000000000CF6000-0x0000000000D07000-memory.dmp

    Filesize

    68KB

  • memory/1052-84-0x00000000745D0000-0x0000000074B7B000-memory.dmp

    Filesize

    5.7MB

  • memory/1052-85-0x0000000000CF6000-0x0000000000D07000-memory.dmp

    Filesize

    68KB

  • memory/1088-88-0x00000000745D0000-0x0000000074B7B000-memory.dmp

    Filesize

    5.7MB

  • memory/1088-80-0x0000000000000000-mapping.dmp

  • memory/1088-91-0x00000000745D0000-0x0000000074B7B000-memory.dmp

    Filesize

    5.7MB

  • memory/1596-79-0x0000000000000000-mapping.dmp

  • memory/1700-62-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1700-63-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1700-74-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1700-72-0x000000000041C01E-mapping.dmp

  • memory/1700-70-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1700-65-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1700-67-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1700-76-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1700-90-0x00000000745D0000-0x0000000074B7B000-memory.dmp

    Filesize

    5.7MB

  • memory/1700-87-0x00000000745D0000-0x0000000074B7B000-memory.dmp

    Filesize

    5.7MB

  • memory/1792-59-0x00000000745D0000-0x0000000074B7B000-memory.dmp

    Filesize

    5.7MB

  • memory/1792-56-0x0000000000B46000-0x0000000000B57000-memory.dmp

    Filesize

    68KB

  • memory/1792-54-0x00000000760A1000-0x00000000760A3000-memory.dmp

    Filesize

    8KB

  • memory/1792-55-0x00000000745D0000-0x0000000074B7B000-memory.dmp

    Filesize

    5.7MB

  • memory/2012-89-0x0000000000000000-mapping.dmp