Analysis
-
max time kernel
241s -
max time network
340s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 15:45
Static task
static1
Behavioral task
behavioral1
Sample
70ffe72e6292909f6abe3dff77e9678e.exe
Resource
win7-20221111-en
General
-
Target
70ffe72e6292909f6abe3dff77e9678e.exe
-
Size
965KB
-
MD5
70ffe72e6292909f6abe3dff77e9678e
-
SHA1
ff0973eda1737d251c6e0ee298c37a6e133b5cbf
-
SHA256
075a3133c28b8d249aa9993fa917059708ae537f3518f61065db553d325c4aa7
-
SHA512
06c4a24d68c5f6aa161018f604babd36543dff53dbb8876a41b9207bcfdceeaec0f4252bbc629eaf1eaa6b60b97f42998dd17f1c112fac34e532c615c253c12f
-
SSDEEP
24576:w0qQgCpPKBn11H636y6kuGx+TiwAAgEEY4:hLhu6367IATQp
Malware Config
Extracted
nanocore
1.2.2.0
tzitziklishop.ddns.net:1665
127.0.0.1:1665
54c43eb3-9a5e-48cf-bbb9-9a65e46643a1
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-09-09T09:23:36.606577636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
NOV282022
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
54c43eb3-9a5e-48cf-bbb9-9a65e46643a1
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tzitziklishop.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" 70ffe72e6292909f6abe3dff77e9678e.exe -
Processes:
70ffe72e6292909f6abe3dff77e9678e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 70ffe72e6292909f6abe3dff77e9678e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exedescription pid process target process PID 520 set thread context of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe -
Drops file in Program Files directory 2 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exedescription ioc process File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe 70ffe72e6292909f6abe3dff77e9678e.exe File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe 70ffe72e6292909f6abe3dff77e9678e.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exepid process 872 70ffe72e6292909f6abe3dff77e9678e.exe 872 70ffe72e6292909f6abe3dff77e9678e.exe 872 70ffe72e6292909f6abe3dff77e9678e.exe 872 70ffe72e6292909f6abe3dff77e9678e.exe 872 70ffe72e6292909f6abe3dff77e9678e.exe 872 70ffe72e6292909f6abe3dff77e9678e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exedescription pid process Token: SeDebugPrivilege 872 70ffe72e6292909f6abe3dff77e9678e.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exe70ffe72e6292909f6abe3dff77e9678e.exedescription pid process target process PID 520 wrote to memory of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 520 wrote to memory of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 520 wrote to memory of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 520 wrote to memory of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 520 wrote to memory of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 520 wrote to memory of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 520 wrote to memory of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 520 wrote to memory of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 520 wrote to memory of 872 520 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 872 wrote to memory of 924 872 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 872 wrote to memory of 924 872 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 872 wrote to memory of 924 872 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 872 wrote to memory of 924 872 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 872 wrote to memory of 1064 872 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 872 wrote to memory of 1064 872 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 872 wrote to memory of 1064 872 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 872 wrote to memory of 1064 872 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD03B.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD9A.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD03B.tmpFilesize
1KB
MD5ce33bea88ce57f8ee7ba12068a258d29
SHA1bd3f7808813b86cc40a2ad3252788f9b385d3b34
SHA256ffe44624099058d30e876b3061e27cdd7bfcfc8bf444e2d901529f70de3e966f
SHA51235f1776f168d75d1c77bbce9e6de845021f40deac55d4b41a118a30aded20b3d9a5838a5960dfeeb9d669eb9064f188bd9e8882c3e87d24ae7645846ba339e1e
-
memory/520-55-0x0000000074E61000-0x0000000074E63000-memory.dmpFilesize
8KB
-
memory/520-56-0x0000000000450000-0x0000000000466000-memory.dmpFilesize
88KB
-
memory/520-57-0x00000000008D0000-0x00000000008DE000-memory.dmpFilesize
56KB
-
memory/520-58-0x0000000005F80000-0x0000000006014000-memory.dmpFilesize
592KB
-
memory/520-59-0x0000000000EA0000-0x0000000000EFA000-memory.dmpFilesize
360KB
-
memory/520-54-0x00000000010F0000-0x00000000011E8000-memory.dmpFilesize
992KB
-
memory/872-83-0x0000000004600000-0x000000000460E000-memory.dmpFilesize
56KB
-
memory/872-85-0x00000000046A0000-0x00000000046B4000-memory.dmpFilesize
80KB
-
memory/872-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/872-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/872-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/872-67-0x000000000041E792-mapping.dmp
-
memory/872-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/872-90-0x0000000004980000-0x0000000004994000-memory.dmpFilesize
80KB
-
memory/872-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/872-89-0x0000000004950000-0x000000000497E000-memory.dmpFilesize
184KB
-
memory/872-76-0x0000000000920000-0x000000000092A000-memory.dmpFilesize
40KB
-
memory/872-77-0x0000000000930000-0x000000000094E000-memory.dmpFilesize
120KB
-
memory/872-78-0x0000000000760000-0x000000000076A000-memory.dmpFilesize
40KB
-
memory/872-79-0x0000000000B20000-0x0000000000B32000-memory.dmpFilesize
72KB
-
memory/872-80-0x0000000000C60000-0x0000000000C7A000-memory.dmpFilesize
104KB
-
memory/872-81-0x0000000000C80000-0x0000000000C8E000-memory.dmpFilesize
56KB
-
memory/872-82-0x00000000045F0000-0x0000000004602000-memory.dmpFilesize
72KB
-
memory/872-60-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/872-84-0x0000000004690000-0x000000000469C000-memory.dmpFilesize
48KB
-
memory/872-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/872-86-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/872-87-0x00000000046C0000-0x00000000046D4000-memory.dmpFilesize
80KB
-
memory/872-88-0x0000000004710000-0x000000000471E000-memory.dmpFilesize
56KB
-
memory/924-73-0x0000000000000000-mapping.dmp
-
memory/1064-75-0x0000000000000000-mapping.dmp