Analysis
-
max time kernel
154s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 15:09
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
927KB
-
MD5
8f5920453b064caa5ee67496beab3fd2
-
SHA1
ab3584e9f44da128e5e35f1f247ad9b867272bca
-
SHA256
e776e62db68dc135108e036829e0d3ee1af54534bad98aa13f6ec2aa51ce1b04
-
SHA512
c6910532261655275c29cd5371214ed16a9ef31524ee3dc69a0018ec726fd2efe8915e94e3a9b9ad2d870ac642d292258bb06eae3f1659f851b1bf8668acb330
-
SSDEEP
12288:MGZqU+t8g067Stjib3LTmt+N0lA8hd3uc8vcolhh3HadKBDdzoa1cfN:3gJ0KS9ib/NMfudcolhh3QKBDdEPf
Malware Config
Extracted
nanocore
1.2.2.0
tzitziklishop.ddns.net:1665
127.0.0.1:1665
54c43eb3-9a5e-48cf-bbb9-9a65e46643a1
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-09-09T09:23:36.606577636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
NOV282022
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
54c43eb3-9a5e-48cf-bbb9-9a65e46643a1
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tzitziklishop.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe" file.exe -
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 1672 set thread context of 1100 1672 file.exe file.exe -
Drops file in Program Files directory 2 IoCs
Processes:
file.exedescription ioc process File created C:\Program Files (x86)\UDP Service\udpsv.exe file.exe File opened for modification C:\Program Files (x86)\UDP Service\udpsv.exe file.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1912 schtasks.exe 1252 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
file.exepid process 1100 file.exe 1100 file.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
file.exedescription pid process Token: SeDebugPrivilege 1100 file.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
file.exefile.exedescription pid process target process PID 1672 wrote to memory of 1100 1672 file.exe file.exe PID 1672 wrote to memory of 1100 1672 file.exe file.exe PID 1672 wrote to memory of 1100 1672 file.exe file.exe PID 1672 wrote to memory of 1100 1672 file.exe file.exe PID 1672 wrote to memory of 1100 1672 file.exe file.exe PID 1672 wrote to memory of 1100 1672 file.exe file.exe PID 1672 wrote to memory of 1100 1672 file.exe file.exe PID 1672 wrote to memory of 1100 1672 file.exe file.exe PID 1672 wrote to memory of 1100 1672 file.exe file.exe PID 1100 wrote to memory of 1912 1100 file.exe schtasks.exe PID 1100 wrote to memory of 1912 1100 file.exe schtasks.exe PID 1100 wrote to memory of 1912 1100 file.exe schtasks.exe PID 1100 wrote to memory of 1912 1100 file.exe schtasks.exe PID 1100 wrote to memory of 1252 1100 file.exe schtasks.exe PID 1100 wrote to memory of 1252 1100 file.exe schtasks.exe PID 1100 wrote to memory of 1252 1100 file.exe schtasks.exe PID 1100 wrote to memory of 1252 1100 file.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9148.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp988A.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9148.tmpFilesize
1KB
MD55719058dd234db87508ef2540e5d8ff0
SHA1669c8d71202ab3321e6619871705c06864b9c2bd
SHA25674d2ad38b4aa2c15240fd3dcbf8b348c068f94e4ee6b2a9a77672912abe1cb2e
SHA5126cc9107fcf2d73543f3ae2a76b4bcd63b24b8a5156abe247f26a396d00f8afa1d8a3aeb6ec5cc56e62391fff44fef9c0716e8cb47b10a9f1feb4b03f40662790
-
C:\Users\Admin\AppData\Local\Temp\tmp988A.tmpFilesize
1KB
MD50a24db62cb5b84309c4803346caaa25d
SHA167660778f61bb44168c33ed3fe56ed86cf9583e8
SHA25638d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
SHA512d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548
-
memory/1100-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-67-0x000000000041E792-mapping.dmp
-
memory/1100-79-0x00000000004B0000-0x00000000004BA000-memory.dmpFilesize
40KB
-
memory/1100-78-0x0000000000600000-0x000000000061E000-memory.dmpFilesize
120KB
-
memory/1100-60-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-77-0x00000000004A0000-0x00000000004AA000-memory.dmpFilesize
40KB
-
memory/1100-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1252-75-0x0000000000000000-mapping.dmp
-
memory/1672-57-0x00000000004E0000-0x00000000004EE000-memory.dmpFilesize
56KB
-
memory/1672-56-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1672-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1672-54-0x0000000000920000-0x0000000000A0E000-memory.dmpFilesize
952KB
-
memory/1672-59-0x0000000004180000-0x00000000041E2000-memory.dmpFilesize
392KB
-
memory/1672-58-0x0000000005140000-0x00000000051DA000-memory.dmpFilesize
616KB
-
memory/1912-73-0x0000000000000000-mapping.dmp