Analysis
-
max time kernel
220s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 07:06
Static task
static1
Behavioral task
behavioral1
Sample
28ad0cd53851b9f95638c150a2a60816.scr.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
28ad0cd53851b9f95638c150a2a60816.scr.exe
Resource
win10v2004-20221111-en
General
-
Target
28ad0cd53851b9f95638c150a2a60816.scr.exe
-
Size
1.1MB
-
MD5
a5e3eba4539903c8572a0378ad9f3df4
-
SHA1
5958932fb8735c23c92e913d838cedc8997421c9
-
SHA256
2a6896423cc62446d775c28aedc44306fbf3ee3c4e15eff8ebb4cf148360b4d9
-
SHA512
f5887a117eca808fb01830d5e8d07787f3a09275b15f49e5cd45beac27c15400f55919df82a863f04a893eb5b551d1968068ddd90db0efcd41be0fffb324a175
-
SSDEEP
24576:LAOcZXMum64nDVHPeP7ghtOJer0hspaAcK3UCaIXlUSrNqCe:NZ64nBvc7ghtCgaAcSaIXlhNqCe
Malware Config
Extracted
nanocore
1.2.2.0
lowaspeed.ddnsfree.com:48562
411speed.duckdns.org:48562
042723c4-0804-4212-bf56-4b1b2669ca7c
-
activate_away_mode
false
-
backup_connection_host
411speed.duckdns.org
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-07-02T05:32:06.440076436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
48562
-
default_group
Clowns
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
042723c4-0804-4212-bf56-4b1b2669ca7c
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
lowaspeed.ddnsfree.com
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
lbjedtahbv.exeRegSvcs.exepid process 340 lbjedtahbv.exe 832 RegSvcs.exe -
Loads dropped DLL 2 IoCs
Processes:
WScript.exelbjedtahbv.exepid process 1504 WScript.exe 340 lbjedtahbv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
lbjedtahbv.exeRegSvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run lbjedtahbv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10_87\\LBJEDT~1.EXE C:\\Users\\Admin\\AppData\\Local\\Temp\\10_87\\EROVGP~1.MP3" lbjedtahbv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10_87\\Update.vbs" lbjedtahbv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" RegSvcs.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lbjedtahbv.exedescription pid process target process PID 340 set thread context of 832 340 lbjedtahbv.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1776 schtasks.exe 1956 schtasks.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
28ad0cd53851b9f95638c150a2a60816.scr.exeWScript.exelbjedtahbv.exeRegSvcs.exedescription pid process target process PID 2020 wrote to memory of 1504 2020 28ad0cd53851b9f95638c150a2a60816.scr.exe WScript.exe PID 2020 wrote to memory of 1504 2020 28ad0cd53851b9f95638c150a2a60816.scr.exe WScript.exe PID 2020 wrote to memory of 1504 2020 28ad0cd53851b9f95638c150a2a60816.scr.exe WScript.exe PID 2020 wrote to memory of 1504 2020 28ad0cd53851b9f95638c150a2a60816.scr.exe WScript.exe PID 1504 wrote to memory of 340 1504 WScript.exe lbjedtahbv.exe PID 1504 wrote to memory of 340 1504 WScript.exe lbjedtahbv.exe PID 1504 wrote to memory of 340 1504 WScript.exe lbjedtahbv.exe PID 1504 wrote to memory of 340 1504 WScript.exe lbjedtahbv.exe PID 340 wrote to memory of 832 340 lbjedtahbv.exe RegSvcs.exe PID 340 wrote to memory of 832 340 lbjedtahbv.exe RegSvcs.exe PID 340 wrote to memory of 832 340 lbjedtahbv.exe RegSvcs.exe PID 340 wrote to memory of 832 340 lbjedtahbv.exe RegSvcs.exe PID 340 wrote to memory of 832 340 lbjedtahbv.exe RegSvcs.exe PID 340 wrote to memory of 832 340 lbjedtahbv.exe RegSvcs.exe PID 340 wrote to memory of 832 340 lbjedtahbv.exe RegSvcs.exe PID 340 wrote to memory of 832 340 lbjedtahbv.exe RegSvcs.exe PID 340 wrote to memory of 832 340 lbjedtahbv.exe RegSvcs.exe PID 832 wrote to memory of 1776 832 RegSvcs.exe schtasks.exe PID 832 wrote to memory of 1776 832 RegSvcs.exe schtasks.exe PID 832 wrote to memory of 1776 832 RegSvcs.exe schtasks.exe PID 832 wrote to memory of 1776 832 RegSvcs.exe schtasks.exe PID 832 wrote to memory of 1956 832 RegSvcs.exe schtasks.exe PID 832 wrote to memory of 1956 832 RegSvcs.exe schtasks.exe PID 832 wrote to memory of 1956 832 RegSvcs.exe schtasks.exe PID 832 wrote to memory of 1956 832 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28ad0cd53851b9f95638c150a2a60816.scr.exe"C:\Users\Admin\AppData\Local\Temp\28ad0cd53851b9f95638c150a2a60816.scr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\10_87\poustmi.vbe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10_87\lbjedtahbv.exe"C:\Users\Admin\AppData\Local\Temp\10_87\lbjedtahbv.exe" erovgptdv.mp33⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5F6F.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8D82.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\10_87\erovgptdv.mp3Filesize
91.8MB
MD5c43678e9746e9ac9c92a3a4ff59e65af
SHA1a790f62c1074b2de6b5617f404f05e2c00e3d355
SHA256d8f10bfc38580231755a86ccd651512b990d5aadc0248977a6e2153e26bb8025
SHA5126102a2905ade1123982bacd6d560826d710f18d2d54d6adc90ecbdf7c6717db093b0787728f74aea9fbc10851a1b5d61dc3138dbbd78cfa02efdf6b9c9e2595d
-
C:\Users\Admin\AppData\Local\Temp\10_87\lbjedtahbv.exeFilesize
942KB
MD5e8273675c4c1675943e9bdcf90ab97af
SHA1e356c5f9be58ab311997ec9780c46032886c669a
SHA2569fc7375923bd996c3faf56495f07ab665d0e07cd311874b0c841959f99792907
SHA512e5decbde7e62a4529df46f7e37bfb7d1eea69f94da0a5faf028859fdddf900d5427bfdf85788b4ac1e1698ddbd3df1414a9f0f838994b86274560fee7c9aa4f0
-
C:\Users\Admin\AppData\Local\Temp\10_87\lbjedtahbv.exeFilesize
942KB
MD5e8273675c4c1675943e9bdcf90ab97af
SHA1e356c5f9be58ab311997ec9780c46032886c669a
SHA2569fc7375923bd996c3faf56495f07ab665d0e07cd311874b0c841959f99792907
SHA512e5decbde7e62a4529df46f7e37bfb7d1eea69f94da0a5faf028859fdddf900d5427bfdf85788b4ac1e1698ddbd3df1414a9f0f838994b86274560fee7c9aa4f0
-
C:\Users\Admin\AppData\Local\Temp\10_87\tnboas.xkeFilesize
418KB
MD54df3ef316de715e1f82556250827dc9c
SHA1abc6e1779f7024c4ebcaa88c82488a2e30d382b1
SHA2569c03de5ead6a9cff7e1994f76dd81bce49a8fd6f6895f6a6116609d947d667a5
SHA5122ab6245fd7ecc303d5d29d4892dda5d6119d0058f62b3dea420fe255bab412c0665d3e3896661c28e1fd5e9e9e551f92b9deb576a8ca5dd64cbfef79aea538f2
-
C:\Users\Admin\AppData\Local\Temp\10_87\unxbvqtr.mscFilesize
50KB
MD5a45453fef6a35f6e243087732ef43760
SHA1750e71f006d259b08554271dd45a8994616d355a
SHA256ec8731a8962951860f833bfd7f80d338b091181bb97f471213207c40af4e3df8
SHA512e451446534b0dc43013b875ded59c61f727d6156882fcef4ac7ec397d62e7ec016be9005ad2b50abb9c14249bedb0a8e18e68b82639748d5417d75117a6e3a42
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp5F6F.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\temp\10_87\poustmi.vbeFilesize
69KB
MD567c05f68180e2eb78461c027eb98149e
SHA1f8976cac3449ab950c48f9181a8fa9a23ddda531
SHA2565776001bf988fd4c14d9ae098eef0a9227e7033e8d0fbc70dea5573da6fd50a4
SHA51284c9e8a83365097846baf46fb8a8869690ba817017940106bfe7cf3703fbb7bb0927137a80c55115f31c4bd2123fac08941f0fb5456e60fdd23850c5238cedae
-
\Users\Admin\AppData\Local\Temp\10_87\lbjedtahbv.exeFilesize
942KB
MD5e8273675c4c1675943e9bdcf90ab97af
SHA1e356c5f9be58ab311997ec9780c46032886c669a
SHA2569fc7375923bd996c3faf56495f07ab665d0e07cd311874b0c841959f99792907
SHA512e5decbde7e62a4529df46f7e37bfb7d1eea69f94da0a5faf028859fdddf900d5427bfdf85788b4ac1e1698ddbd3df1414a9f0f838994b86274560fee7c9aa4f0
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/340-60-0x0000000000000000-mapping.dmp
-
memory/832-67-0x00000000003E0000-0x0000000000ADB000-memory.dmpFilesize
7.0MB
-
memory/832-69-0x00000000003E0000-0x0000000000ADB000-memory.dmpFilesize
7.0MB
-
memory/832-70-0x00000000003FE792-mapping.dmp
-
memory/832-73-0x00000000003E0000-0x0000000000ADB000-memory.dmpFilesize
7.0MB
-
memory/832-75-0x00000000003E0000-0x0000000000ADB000-memory.dmpFilesize
7.0MB
-
memory/832-77-0x00000000003E0000-0x000000000041A000-memory.dmpFilesize
232KB
-
memory/1504-55-0x0000000000000000-mapping.dmp
-
memory/1776-79-0x0000000000000000-mapping.dmp
-
memory/1956-81-0x0000000000000000-mapping.dmp
-
memory/2020-54-0x00000000763A1000-0x00000000763A3000-memory.dmpFilesize
8KB