Analysis
-
max time kernel
153s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:29
Static task
static1
Behavioral task
behavioral1
Sample
ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe
Resource
win7-20221111-en
General
-
Target
ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe
-
Size
521KB
-
MD5
87ff74c6fc7166d9365f6376fa260026
-
SHA1
a91a2e81a4cd43dbe12aa1219bd0585ffd555002
-
SHA256
ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f
-
SHA512
1186569a4655486cecbb3067ac2d480a1a7fca9926e1a6764325b4a477b829ee97e07e32119b8c9998a15caff6feecca7e477ccfba1fe64e52aac20c397c2b6f
-
SSDEEP
12288:mJZrZfSXwNFqo4R3Zbs4ys7U7cgt/GFr1PIxW1qM:sVFTAJFA/t/YRPIxxM
Malware Config
Extracted
nanocore
1.2.1.1
87.231.21.54:4242
192.168.0.18:4242
cb32a65b-351e-4743-9439-5a68c0b610bb
-
activate_away_mode
true
-
backup_connection_host
192.168.0.18
- backup_dns_server
-
buffer_size
65535
-
build_time
2014-10-30T07:51:34.058785536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4242
-
default_group
Owww
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
cb32a65b-351e-4743-9439-5a68c0b610bb
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
87.231.21.54
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.1.1
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
notepad .exepid process 3220 notepad .exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation wscript.exe -
Processes:
notepad .exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA notepad .exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exedescription pid process target process PID 2220 set thread context of 3220 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe notepad .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exenotepad .exepid process 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe 3220 notepad .exe 3220 notepad .exe 3220 notepad .exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
notepad .exepid process 3220 notepad .exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exenotepad .exedescription pid process Token: SeDebugPrivilege 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe Token: 33 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe Token: SeIncBasePriorityPrivilege 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe Token: SeDebugPrivilege 3220 notepad .exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.execmd.exedescription pid process target process PID 2220 wrote to memory of 2744 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe cmd.exe PID 2220 wrote to memory of 2744 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe cmd.exe PID 2220 wrote to memory of 2744 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe cmd.exe PID 2744 wrote to memory of 1752 2744 cmd.exe wscript.exe PID 2744 wrote to memory of 1752 2744 cmd.exe wscript.exe PID 2744 wrote to memory of 1752 2744 cmd.exe wscript.exe PID 2220 wrote to memory of 3220 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe notepad .exe PID 2220 wrote to memory of 3220 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe notepad .exe PID 2220 wrote to memory of 3220 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe notepad .exe PID 2220 wrote to memory of 3220 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe notepad .exe PID 2220 wrote to memory of 3220 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe notepad .exe PID 2220 wrote to memory of 3220 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe notepad .exe PID 2220 wrote to memory of 3220 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe notepad .exe PID 2220 wrote to memory of 3220 2220 ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe notepad .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe"C:\Users\Admin\AppData\Local\Temp\ccd8fc18705b53aca63ce82b944858323498512cf5087696aed7fee39358cc2f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderName\mata.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat"3⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\notepad .exe"C:\Users\Admin\AppData\Local\Temp\notepad .exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\FolderName\mata.batFilesize
70B
MD523f72401196919748c14cb64c1d55c3b
SHA1869e3809cb4391e6f5aee5349a871e40a1e1fb22
SHA256d09c4054568f89c5de2bd9bae9cbcbcb3ef2dda9a9ded0153e29da26dc405d11
SHA5122ab844717c31c4819d8773d7604dfc831e950ae9e38fe311acf8178d46f39fafb54b448ebb6b9cf5d1edd47ed36eae11d649c1be346b0a35d380dd07101c79f1
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
memory/1752-136-0x0000000000000000-mapping.dmp
-
memory/2220-133-0x0000000074FF0000-0x00000000755A1000-memory.dmpFilesize
5.7MB
-
memory/2220-143-0x0000000074FF0000-0x00000000755A1000-memory.dmpFilesize
5.7MB
-
memory/2220-145-0x0000000074FF0000-0x00000000755A1000-memory.dmpFilesize
5.7MB
-
memory/2744-134-0x0000000000000000-mapping.dmp
-
memory/3220-138-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3220-137-0x0000000000000000-mapping.dmp
-
memory/3220-142-0x0000000074FF0000-0x00000000755A1000-memory.dmpFilesize
5.7MB
-
memory/3220-144-0x0000000074FF0000-0x00000000755A1000-memory.dmpFilesize
5.7MB