Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:12
Static task
static1
Behavioral task
behavioral1
Sample
def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe
Resource
win7-20220901-en
General
-
Target
def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe
-
Size
1.2MB
-
MD5
ab97523c0c284868c08c9120d921ba06
-
SHA1
0c79283dff6d22f7cf85561f33ff8f2753de880a
-
SHA256
def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27
-
SHA512
06c09f00cc60e682453b5317f23f9c1d36a1535b0f5de10e491dc587953d43345e41dd50acfc7019487180f48e504cd8a6d4b10029c1508b367ba9609e96f554
-
SSDEEP
24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHa+erpr3rzzF5:gh+ZkldoPK8Ya+WL
Malware Config
Extracted
nanocore
1.2.2.0
185.162.88.16:2359
dish123newpro.publicvm.com:2359
c253fe26-7f15-444b-bcbf-bdaaa6a4fb19
-
activate_away_mode
true
-
backup_connection_host
dish123newpro.publicvm.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-12-27T16:33:42.242053636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2359
-
default_group
NANO17032019
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c253fe26-7f15-444b-bcbf-bdaaa6a4fb19
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.162.88.16
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
osk.exeosk.exeosk.exepid process 1532 osk.exe 1884 osk.exe 888 osk.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\authfwcfg\osk.exe autoit_exe C:\Users\Admin\authfwcfg\osk.exe autoit_exe C:\Users\Admin\authfwcfg\osk.exe autoit_exe C:\Users\Admin\authfwcfg\osk.exe autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exeosk.exeosk.exeosk.exedescription pid process target process PID 1900 set thread context of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1532 set thread context of 836 1532 osk.exe RegAsm.exe PID 1884 set thread context of 1716 1884 osk.exe RegAsm.exe PID 888 set thread context of 1372 888 osk.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1156 schtasks.exe 860 schtasks.exe 764 schtasks.exe 1260 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegAsm.exepid process 1928 RegAsm.exe 1928 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1928 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1928 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exetaskeng.exeosk.exeosk.exeosk.exedescription pid process target process PID 1900 wrote to memory of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1900 wrote to memory of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1900 wrote to memory of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1900 wrote to memory of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1900 wrote to memory of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1900 wrote to memory of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1900 wrote to memory of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1900 wrote to memory of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1900 wrote to memory of 1928 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe RegAsm.exe PID 1900 wrote to memory of 860 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe schtasks.exe PID 1900 wrote to memory of 860 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe schtasks.exe PID 1900 wrote to memory of 860 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe schtasks.exe PID 1900 wrote to memory of 860 1900 def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe schtasks.exe PID 1696 wrote to memory of 1532 1696 taskeng.exe osk.exe PID 1696 wrote to memory of 1532 1696 taskeng.exe osk.exe PID 1696 wrote to memory of 1532 1696 taskeng.exe osk.exe PID 1696 wrote to memory of 1532 1696 taskeng.exe osk.exe PID 1532 wrote to memory of 836 1532 osk.exe RegAsm.exe PID 1532 wrote to memory of 836 1532 osk.exe RegAsm.exe PID 1532 wrote to memory of 836 1532 osk.exe RegAsm.exe PID 1532 wrote to memory of 836 1532 osk.exe RegAsm.exe PID 1532 wrote to memory of 836 1532 osk.exe RegAsm.exe PID 1532 wrote to memory of 836 1532 osk.exe RegAsm.exe PID 1532 wrote to memory of 836 1532 osk.exe RegAsm.exe PID 1532 wrote to memory of 836 1532 osk.exe RegAsm.exe PID 1532 wrote to memory of 836 1532 osk.exe RegAsm.exe PID 1532 wrote to memory of 764 1532 osk.exe schtasks.exe PID 1532 wrote to memory of 764 1532 osk.exe schtasks.exe PID 1532 wrote to memory of 764 1532 osk.exe schtasks.exe PID 1532 wrote to memory of 764 1532 osk.exe schtasks.exe PID 1696 wrote to memory of 1884 1696 taskeng.exe osk.exe PID 1696 wrote to memory of 1884 1696 taskeng.exe osk.exe PID 1696 wrote to memory of 1884 1696 taskeng.exe osk.exe PID 1696 wrote to memory of 1884 1696 taskeng.exe osk.exe PID 1884 wrote to memory of 1716 1884 osk.exe RegAsm.exe PID 1884 wrote to memory of 1716 1884 osk.exe RegAsm.exe PID 1884 wrote to memory of 1716 1884 osk.exe RegAsm.exe PID 1884 wrote to memory of 1716 1884 osk.exe RegAsm.exe PID 1884 wrote to memory of 1716 1884 osk.exe RegAsm.exe PID 1884 wrote to memory of 1716 1884 osk.exe RegAsm.exe PID 1884 wrote to memory of 1716 1884 osk.exe RegAsm.exe PID 1884 wrote to memory of 1716 1884 osk.exe RegAsm.exe PID 1884 wrote to memory of 1716 1884 osk.exe RegAsm.exe PID 1884 wrote to memory of 1260 1884 osk.exe schtasks.exe PID 1884 wrote to memory of 1260 1884 osk.exe schtasks.exe PID 1884 wrote to memory of 1260 1884 osk.exe schtasks.exe PID 1884 wrote to memory of 1260 1884 osk.exe schtasks.exe PID 1696 wrote to memory of 888 1696 taskeng.exe osk.exe PID 1696 wrote to memory of 888 1696 taskeng.exe osk.exe PID 1696 wrote to memory of 888 1696 taskeng.exe osk.exe PID 1696 wrote to memory of 888 1696 taskeng.exe osk.exe PID 888 wrote to memory of 1372 888 osk.exe RegAsm.exe PID 888 wrote to memory of 1372 888 osk.exe RegAsm.exe PID 888 wrote to memory of 1372 888 osk.exe RegAsm.exe PID 888 wrote to memory of 1372 888 osk.exe RegAsm.exe PID 888 wrote to memory of 1372 888 osk.exe RegAsm.exe PID 888 wrote to memory of 1372 888 osk.exe RegAsm.exe PID 888 wrote to memory of 1372 888 osk.exe RegAsm.exe PID 888 wrote to memory of 1372 888 osk.exe RegAsm.exe PID 888 wrote to memory of 1372 888 osk.exe RegAsm.exe PID 888 wrote to memory of 1156 888 osk.exe schtasks.exe PID 888 wrote to memory of 1156 888 osk.exe schtasks.exe PID 888 wrote to memory of 1156 888 osk.exe schtasks.exe PID 888 wrote to memory of 1156 888 osk.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe"C:\Users\Admin\AppData\Local\Temp\def61d4f51f9e74dd472f3d3a815ab228d40fd4ff1b9fcc51c56f291270bcf27.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemPropertiesHardware /tr "C:\Users\Admin\authfwcfg\osk.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {D67763A8-D20C-4CA6-B9EC-80B9C1BD9889} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\authfwcfg\osk.exeC:\Users\Admin\authfwcfg\osk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemPropertiesHardware /tr "C:\Users\Admin\authfwcfg\osk.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\authfwcfg\osk.exeC:\Users\Admin\authfwcfg\osk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemPropertiesHardware /tr "C:\Users\Admin\authfwcfg\osk.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\authfwcfg\osk.exeC:\Users\Admin\authfwcfg\osk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemPropertiesHardware /tr "C:\Users\Admin\authfwcfg\osk.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\authfwcfg\osk.exeFilesize
1.2MB
MD5e76459c1f2a0636a19c74debe9d7367a
SHA15f24f955046cabc029d55758addf9b8c6feeb214
SHA2564f13a224055a37c8bc0636795ac6358651eb011bc976d8f18ed35bb0a078bc2d
SHA512ba9400af234148baa4c71fdf1768902b64c15b917889d4db77d21d5a2d6e427a4fc6ee0ed4c9151ef4b25d0128ccdab1e561506f523e61c020a0250dfe08f6b2
-
C:\Users\Admin\authfwcfg\osk.exeFilesize
1.2MB
MD5e76459c1f2a0636a19c74debe9d7367a
SHA15f24f955046cabc029d55758addf9b8c6feeb214
SHA2564f13a224055a37c8bc0636795ac6358651eb011bc976d8f18ed35bb0a078bc2d
SHA512ba9400af234148baa4c71fdf1768902b64c15b917889d4db77d21d5a2d6e427a4fc6ee0ed4c9151ef4b25d0128ccdab1e561506f523e61c020a0250dfe08f6b2
-
C:\Users\Admin\authfwcfg\osk.exeFilesize
1.2MB
MD5e76459c1f2a0636a19c74debe9d7367a
SHA15f24f955046cabc029d55758addf9b8c6feeb214
SHA2564f13a224055a37c8bc0636795ac6358651eb011bc976d8f18ed35bb0a078bc2d
SHA512ba9400af234148baa4c71fdf1768902b64c15b917889d4db77d21d5a2d6e427a4fc6ee0ed4c9151ef4b25d0128ccdab1e561506f523e61c020a0250dfe08f6b2
-
C:\Users\Admin\authfwcfg\osk.exeFilesize
1.2MB
MD5e76459c1f2a0636a19c74debe9d7367a
SHA15f24f955046cabc029d55758addf9b8c6feeb214
SHA2564f13a224055a37c8bc0636795ac6358651eb011bc976d8f18ed35bb0a078bc2d
SHA512ba9400af234148baa4c71fdf1768902b64c15b917889d4db77d21d5a2d6e427a4fc6ee0ed4c9151ef4b25d0128ccdab1e561506f523e61c020a0250dfe08f6b2
-
memory/764-83-0x0000000000000000-mapping.dmp
-
memory/836-84-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/836-86-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/836-87-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/836-80-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-81-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-74-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/836-79-0x000000000041E792-mapping.dmp
-
memory/860-66-0x0000000000000000-mapping.dmp
-
memory/888-106-0x0000000000000000-mapping.dmp
-
memory/1156-120-0x0000000000000000-mapping.dmp
-
memory/1260-102-0x0000000000000000-mapping.dmp
-
memory/1372-116-0x000000000041E792-mapping.dmp
-
memory/1372-121-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/1532-69-0x0000000000000000-mapping.dmp
-
memory/1716-104-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/1716-105-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/1716-98-0x000000000041E792-mapping.dmp
-
memory/1716-103-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/1884-88-0x0000000000000000-mapping.dmp
-
memory/1900-54-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1928-85-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/1928-57-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1928-55-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1928-67-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/1928-63-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1928-62-0x00000000000AE792-mapping.dmp
-
memory/1928-64-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB