Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:11
Static task
static1
Behavioral task
behavioral1
Sample
78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe
Resource
win7-20220812-en
General
-
Target
78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe
-
Size
1.3MB
-
MD5
a11ab784e6d3546992d20dd689053590
-
SHA1
efb53ba66291154d758e033d24ad19a1567918db
-
SHA256
78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34
-
SHA512
73b093e8fcf0c9c8b4d8bf83f1b210b10ced13b093482f63f771a41774a72e3bbfe0e617255f869be54cecdd0d356856af000e61cdd02a890f89e798c49091a2
-
SSDEEP
24576:3u6J33O0c+JY5UZ+XC0kGso6FaUngm/MmiTv5WYk:Ru0c++OCvkGs9FaoiTMYk
Malware Config
Extracted
nanocore
1.2.2.0
microsoft.btc-crypto-rewards.cash:3020
91.192.100.7:3020
8f96fcee-6a12-4372-9c82-ebf284f80be1
-
activate_away_mode
true
-
backup_connection_host
91.192.100.7
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-12-17T05:15:58.097142536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3020
-
default_group
macro doc pop up
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
8f96fcee-6a12-4372-9c82-ebf284f80be1
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
microsoft.btc-crypto-rewards.cash
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
qprocess.exepid process 1320 qprocess.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AuthHostProxy\qprocess.exe autoit_exe C:\Users\Admin\AuthHostProxy\qprocess.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exeqprocess.exedescription pid process target process PID 864 set thread context of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 1320 set thread context of 1764 1320 qprocess.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegAsm.exepid process 1060 RegAsm.exe 1060 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1060 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1060 RegAsm.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exetaskeng.exeqprocess.exedescription pid process target process PID 864 wrote to memory of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 864 wrote to memory of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 864 wrote to memory of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 864 wrote to memory of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 864 wrote to memory of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 864 wrote to memory of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 864 wrote to memory of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 864 wrote to memory of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 864 wrote to memory of 1060 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe RegAsm.exe PID 864 wrote to memory of 568 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe schtasks.exe PID 864 wrote to memory of 568 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe schtasks.exe PID 864 wrote to memory of 568 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe schtasks.exe PID 864 wrote to memory of 568 864 78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe schtasks.exe PID 700 wrote to memory of 1320 700 taskeng.exe qprocess.exe PID 700 wrote to memory of 1320 700 taskeng.exe qprocess.exe PID 700 wrote to memory of 1320 700 taskeng.exe qprocess.exe PID 700 wrote to memory of 1320 700 taskeng.exe qprocess.exe PID 1320 wrote to memory of 1764 1320 qprocess.exe RegAsm.exe PID 1320 wrote to memory of 1764 1320 qprocess.exe RegAsm.exe PID 1320 wrote to memory of 1764 1320 qprocess.exe RegAsm.exe PID 1320 wrote to memory of 1764 1320 qprocess.exe RegAsm.exe PID 1320 wrote to memory of 1764 1320 qprocess.exe RegAsm.exe PID 1320 wrote to memory of 1764 1320 qprocess.exe RegAsm.exe PID 1320 wrote to memory of 1764 1320 qprocess.exe RegAsm.exe PID 1320 wrote to memory of 1764 1320 qprocess.exe RegAsm.exe PID 1320 wrote to memory of 1764 1320 qprocess.exe RegAsm.exe PID 1320 wrote to memory of 364 1320 qprocess.exe schtasks.exe PID 1320 wrote to memory of 364 1320 qprocess.exe schtasks.exe PID 1320 wrote to memory of 364 1320 qprocess.exe schtasks.exe PID 1320 wrote to memory of 364 1320 qprocess.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe"C:\Users\Admin\AppData\Local\Temp\78098846a197b5b8a1d18c8d63bb6d3ddbf63721a1362530a382fbba5a0e0b34.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WUDFHost /tr "C:\Users\Admin\AuthHostProxy\qprocess.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {82D1F39C-1ABE-40A1-A218-D9E44806B398} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AuthHostProxy\qprocess.exeC:\Users\Admin\AuthHostProxy\qprocess.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WUDFHost /tr "C:\Users\Admin\AuthHostProxy\qprocess.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AuthHostProxy\qprocess.exeFilesize
1.3MB
MD59dcb552157050ba190f9a99c0ae7ef5a
SHA1be36a4f57bece1f6fcdac92922d311cb1eb677ac
SHA2567f82b2bca77c878e9957be2472716ccc7cbc286261c53f443692132e21f1ddbc
SHA5128c7da6cfa11a8433c9fdf44b40bdcb91020867e225a25303d33148c5da46e072c1e74cd028015ca6109e7b577f96f3ea4ed37376c6d5543469140c96b7d73941
-
C:\Users\Admin\AuthHostProxy\qprocess.exeFilesize
1.3MB
MD59dcb552157050ba190f9a99c0ae7ef5a
SHA1be36a4f57bece1f6fcdac92922d311cb1eb677ac
SHA2567f82b2bca77c878e9957be2472716ccc7cbc286261c53f443692132e21f1ddbc
SHA5128c7da6cfa11a8433c9fdf44b40bdcb91020867e225a25303d33148c5da46e072c1e74cd028015ca6109e7b577f96f3ea4ed37376c6d5543469140c96b7d73941
-
memory/364-86-0x0000000000000000-mapping.dmp
-
memory/568-68-0x0000000000000000-mapping.dmp
-
memory/864-54-0x0000000076831000-0x0000000076833000-memory.dmpFilesize
8KB
-
memory/1060-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1060-66-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1060-67-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1060-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1060-62-0x000000000041E792-mapping.dmp
-
memory/1060-57-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1060-55-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1320-70-0x0000000000000000-mapping.dmp
-
memory/1764-80-0x000000000041E792-mapping.dmp
-
memory/1764-84-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1764-85-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1764-87-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB