Analysis
-
max time kernel
117s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26/11/2022, 23:39
Static task
static1
Behavioral task
behavioral1
Sample
742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
Resource
win7-20220812-en
General
-
Target
742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
-
Size
1.1MB
-
MD5
75342cdd702056910a3fce3b434cf1b1
-
SHA1
02728d0ad5e5c1f34ee3bd77bb7af144f83438f9
-
SHA256
742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d
-
SHA512
dd6dc0a07f0ffbbf0793c3e97d86de80720e6dca0216441b3ab46014975e186b975887a8cde3530b7a43fcbc078788ebe8df5fd065c0ac5779b98febaf7409ec
-
SSDEEP
24576:Ktb20pkaCqT5TBWgNQ7aulZsRTXRDL6nY935ZSS6A:3Vg5tQ7aulZsRTXRD/55
Malware Config
Extracted
nanocore
1.2.2.0
moftsvs.ig42.org:9045
212.7.192.242:9045
c7bf44a3-7212-4d60-9ee3-f0991c8392f8
-
activate_away_mode
false
-
backup_connection_host
212.7.192.242
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-03-06T14:55:41.478810836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9045
-
default_group
Default Team
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c7bf44a3-7212-4d60-9ee3-f0991c8392f8
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
moftsvs.ig42.org
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1108 set thread context of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000331126ddb6d31640a6a032b98ff4e0ef00000000020000000000106600000001000020000000bc3acb2698163e8290d1cf2b32e24cb4456a46cb49274f63e48b011bf2e8fc29000000000e8000000002000020000000fb5d9bc80368ca2d6b1cf92723d9f637cda1de4edc2053c642a32e3a98d2bc69200000000f7d7eefb3751e977f8ee79760bdfbacf9187d6d6eb2a5d7ac6949f64ac897e340000000aaab6c06016d580eae40a4d35042a461b641fea9aa7a9f5f429f0d132ed1778081706362894063cd53ca3e17e06a880ff3823f1e18786c2c29c908592756eff2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a743e18a02d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000331126ddb6d31640a6a032b98ff4e0ef000000000200000000001066000000010000200000001ea2417990666b42e9aa5f4594bc780bc6164b5fcc964f13dbc88520a4140089000000000e8000000002000020000000a1e2329c70fde387d7f748a921bd4320f03e515b31c490a3781c929e8a2437da90000000336c5872df0cdfdf4c14ab0fb75ca33e7e25aab045cc96863c6031739d3c010b1594cc4a1412991455067d8ab7739b5aa69ad5008e6020558f80612b8772fbc37bb3666e9538cdb715e11b54b7b9026968a6579feda091b8ba95a30ffe1b68062697fd7a7fffa915204eaa9f63dc1feb410c1156e92d7310b15e4524d9c91ff9114b6635fcbf020d3575b8ea71f7686140000000be050080364f8a4676fca16e3a6be6be091919813a53112f87c344d6714a5e3264425cbc43ceac1801c414ad2c10e4809927af9e80c15dcb6a9579897a2f2e5e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{074FB401-6E7E-11ED-979E-6A94EDCEDC7A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376337284" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 624 iexplore.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 624 iexplore.exe 624 iexplore.exe 1192 IEXPLORE.EXE 1192 IEXPLORE.EXE 1192 IEXPLORE.EXE 1192 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1108 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 28 PID 1652 wrote to memory of 1108 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 28 PID 1652 wrote to memory of 1108 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 28 PID 1652 wrote to memory of 1108 1652 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 28 PID 1108 wrote to memory of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 PID 1108 wrote to memory of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 PID 1108 wrote to memory of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 PID 1108 wrote to memory of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 PID 1108 wrote to memory of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 PID 1108 wrote to memory of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 PID 1108 wrote to memory of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 PID 1108 wrote to memory of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 PID 1108 wrote to memory of 960 1108 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 29 PID 624 wrote to memory of 1192 624 iexplore.exe 32 PID 624 wrote to memory of 1192 624 iexplore.exe 32 PID 624 wrote to memory of 1192 624 iexplore.exe 32 PID 624 wrote to memory of 1192 624 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\lf2" "C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" "742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\SysWOW64\WerFault.exe"3⤵PID:960
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WerFault.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.04⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1192
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD562cddffde88715a338548dbfa47b555c
SHA117d9eed664beee32f9fa62d61daaaac931885e51
SHA25606538639dc35c0781397871581f21949a11afd5080d0f6a69b5c09c8d278cb8a
SHA5120fe70f5fae9ca1fee043b00bd0119dc1c5a7055881c1ed91a725a8cf7476c365e0b0d621ce35b5e6ff9e07687e5fa8901c47c4496297723288b10b39bbaa5442
-
Filesize
5KB
MD54ff1ccdb9061a9ee17931de9cc506a0f
SHA118246065474565a991de8b76043dca47c6afb51a
SHA256b513a4cace0f3b588f32baba51b487d774de220503746f56ae9a655737a6d532
SHA5126de408adf1dd625fe2917771aac3fbe5c88b1342382ee608684940e928392752ee4d7917667d25542ce982f2f86c6e06f14c6accdccba14921978ab399750886
-
Filesize
603B
MD52651c96a3257575cb931b8e4fb14ffc7
SHA16c87e74d8d25ed07049f1accb0ac16ba1f80e5ab
SHA2565a90db3e066ee772457401b1fbbb37fe48f98518eb3d2343546cb4d7bf5fa118
SHA512c7c40294d88d174114653524945e59adf16a65d9ba5ed742eede51e0ebd040136ca20682eab7f8164467dc05f25ffe324dbf8420f1622dee7097acf526442657