Analysis
-
max time kernel
156s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 19:10
Static task
static1
Behavioral task
behavioral1
Sample
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
Resource
win7-20220901-en
General
-
Target
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
-
Size
914KB
-
MD5
fa451d9fcbb382547304fb3c197df41f
-
SHA1
a94eab5ed10b473a368bd2b952a36e1cfb6a86f3
-
SHA256
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a
-
SHA512
4205f65b521bbd54287184c2a064f0f6b43fa500d1fb350bd81f120e7f5bca64e8201909ac105ae0d2a7196a7e1199bace5fa0533951436051deed3e44ff8ee5
-
SSDEEP
12288:Ha05RoPvP+hzDMm/xy/e4rJPVI80bk7DrBfJgZWw:hQPvGhHZWe4rJrMq5wW
Malware Config
Extracted
nanocore
1.2.2.0
judge777.ddns.net:8282
127.0.0.1:8282
ff326974-84e5-4f7e-884c-dce6bafebcc3
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
37.235.1.177
-
buffer_size
65535
-
build_time
2020-11-15T21:34:27.835212036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8282
-
default_group
FEB
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ff326974-84e5-4f7e-884c-dce6bafebcc3
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
judge777.ddns.net
-
primary_dns_server
37.235.1.174
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 37.235.1.174 Destination IP 37.235.1.177 Destination IP 37.235.1.177 Destination IP 37.235.1.174 Destination IP 37.235.1.177 Destination IP 37.235.1.174 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe" d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe -
Processes:
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exedescription pid process target process PID 4032 set thread context of 5112 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe -
Drops file in Program Files directory 2 IoCs
Processes:
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exedescription ioc process File created C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe File opened for modification C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exepid process 5112 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe 5112 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe 5112 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exepid process 5112 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exedescription pid process Token: SeDebugPrivilege 5112 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exedescription pid process target process PID 4032 wrote to memory of 4480 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe schtasks.exe PID 4032 wrote to memory of 4480 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe schtasks.exe PID 4032 wrote to memory of 4480 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe schtasks.exe PID 4032 wrote to memory of 5112 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe PID 4032 wrote to memory of 5112 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe PID 4032 wrote to memory of 5112 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe PID 4032 wrote to memory of 5112 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe PID 4032 wrote to memory of 5112 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe PID 4032 wrote to memory of 5112 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe PID 4032 wrote to memory of 5112 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe PID 4032 wrote to memory of 5112 4032 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe"C:\Users\Admin\AppData\Local\Temp\d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sfnsjitbxRvkvq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC9A9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe"C:\Users\Admin\AppData\Local\Temp\d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe.logFilesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
C:\Users\Admin\AppData\Local\Temp\tmpC9A9.tmpFilesize
1KB
MD5334218d8945f4b313c6e32ff6e0991f2
SHA1370b5d5460f07b950290c47890d45072e9f10c11
SHA256f1a7d9f1ea49ada51a5fd53ed4f4d70a698d4f838ed4c67d2026c133cf230136
SHA512090d2a41e5e515a55f516c6655009af96c8176daf71231a7a63c28aa8add4363cdcd671ac41c1b42c385a2abb3749b9453c7724f29debc8337d786bc345b7096
-
memory/4032-132-0x0000000000250000-0x000000000033A000-memory.dmpFilesize
936KB
-
memory/4032-133-0x0000000004CD0000-0x0000000004D6C000-memory.dmpFilesize
624KB
-
memory/4032-134-0x00000000053E0000-0x0000000005984000-memory.dmpFilesize
5.6MB
-
memory/4032-135-0x0000000004E30000-0x0000000004EC2000-memory.dmpFilesize
584KB
-
memory/4032-136-0x0000000004D70000-0x0000000004D7A000-memory.dmpFilesize
40KB
-
memory/4032-137-0x0000000005010000-0x0000000005066000-memory.dmpFilesize
344KB
-
memory/4480-138-0x0000000000000000-mapping.dmp
-
memory/5112-140-0x0000000000000000-mapping.dmp
-
memory/5112-141-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB