Analysis
-
max time kernel
146s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 15:45
Static task
static1
Behavioral task
behavioral1
Sample
70ffe72e6292909f6abe3dff77e9678e.exe
Resource
win7-20221111-en
General
-
Target
70ffe72e6292909f6abe3dff77e9678e.exe
-
Size
965KB
-
MD5
70ffe72e6292909f6abe3dff77e9678e
-
SHA1
ff0973eda1737d251c6e0ee298c37a6e133b5cbf
-
SHA256
075a3133c28b8d249aa9993fa917059708ae537f3518f61065db553d325c4aa7
-
SHA512
06c4a24d68c5f6aa161018f604babd36543dff53dbb8876a41b9207bcfdceeaec0f4252bbc629eaf1eaa6b60b97f42998dd17f1c112fac34e532c615c253c12f
-
SSDEEP
24576:w0qQgCpPKBn11H636y6kuGx+TiwAAgEEY4:hLhu6367IATQp
Malware Config
Extracted
nanocore
1.2.2.0
tzitziklishop.ddns.net:1665
127.0.0.1:1665
54c43eb3-9a5e-48cf-bbb9-9a65e46643a1
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-09-09T09:23:36.606577636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
NOV282022
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
54c43eb3-9a5e-48cf-bbb9-9a65e46643a1
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tzitziklishop.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Monitor = "C:\\Program Files (x86)\\UPNP Monitor\\upnpmon.exe" 70ffe72e6292909f6abe3dff77e9678e.exe -
Processes:
70ffe72e6292909f6abe3dff77e9678e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 70ffe72e6292909f6abe3dff77e9678e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exedescription pid process target process PID 220 set thread context of 4896 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe -
Drops file in Program Files directory 2 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exedescription ioc process File opened for modification C:\Program Files (x86)\UPNP Monitor\upnpmon.exe 70ffe72e6292909f6abe3dff77e9678e.exe File created C:\Program Files (x86)\UPNP Monitor\upnpmon.exe 70ffe72e6292909f6abe3dff77e9678e.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4868 schtasks.exe 4372 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exe70ffe72e6292909f6abe3dff77e9678e.exepid process 220 70ffe72e6292909f6abe3dff77e9678e.exe 220 70ffe72e6292909f6abe3dff77e9678e.exe 220 70ffe72e6292909f6abe3dff77e9678e.exe 220 70ffe72e6292909f6abe3dff77e9678e.exe 220 70ffe72e6292909f6abe3dff77e9678e.exe 220 70ffe72e6292909f6abe3dff77e9678e.exe 4896 70ffe72e6292909f6abe3dff77e9678e.exe 4896 70ffe72e6292909f6abe3dff77e9678e.exe 4896 70ffe72e6292909f6abe3dff77e9678e.exe 4896 70ffe72e6292909f6abe3dff77e9678e.exe 4896 70ffe72e6292909f6abe3dff77e9678e.exe 4896 70ffe72e6292909f6abe3dff77e9678e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exepid process 4896 70ffe72e6292909f6abe3dff77e9678e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exe70ffe72e6292909f6abe3dff77e9678e.exedescription pid process Token: SeDebugPrivilege 220 70ffe72e6292909f6abe3dff77e9678e.exe Token: SeDebugPrivilege 4896 70ffe72e6292909f6abe3dff77e9678e.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
70ffe72e6292909f6abe3dff77e9678e.exe70ffe72e6292909f6abe3dff77e9678e.exedescription pid process target process PID 220 wrote to memory of 2028 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 2028 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 2028 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 2876 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 2876 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 2876 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 3476 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 3476 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 3476 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 4896 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 4896 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 4896 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 4896 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 4896 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 4896 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 4896 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 220 wrote to memory of 4896 220 70ffe72e6292909f6abe3dff77e9678e.exe 70ffe72e6292909f6abe3dff77e9678e.exe PID 4896 wrote to memory of 4868 4896 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 4896 wrote to memory of 4868 4896 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 4896 wrote to memory of 4868 4896 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 4896 wrote to memory of 4372 4896 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 4896 wrote to memory of 4372 4896 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe PID 4896 wrote to memory of 4372 4896 70ffe72e6292909f6abe3dff77e9678e.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"C:\Users\Admin\AppData\Local\Temp\70ffe72e6292909f6abe3dff77e9678e.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UPNP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp78E4.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UPNP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7D79.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\70ffe72e6292909f6abe3dff77e9678e.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Temp\tmp78E4.tmpFilesize
1KB
MD5ce33bea88ce57f8ee7ba12068a258d29
SHA1bd3f7808813b86cc40a2ad3252788f9b385d3b34
SHA256ffe44624099058d30e876b3061e27cdd7bfcfc8bf444e2d901529f70de3e966f
SHA51235f1776f168d75d1c77bbce9e6de845021f40deac55d4b41a118a30aded20b3d9a5838a5960dfeeb9d669eb9064f188bd9e8882c3e87d24ae7645846ba339e1e
-
C:\Users\Admin\AppData\Local\Temp\tmp7D79.tmpFilesize
1KB
MD5c9a4c783d2e18eea86e071de92f36f02
SHA14cb02db05386ccb70a23fa89dbadfddfc8f7b6af
SHA25621d669a674eb23538f38f6822429d797e69e0685d18c0e6e03ec6801098b240a
SHA512b6d5198d9ca83687fcc491c02ad8b417e02dff0150b514c3d39d13b8de9ffba6f3779ee7bb6350b087474fb6e0d1bd10b8fdd5c8f48a46c9cfd183d9045b80ef
-
memory/220-136-0x0000000000C10000-0x0000000000CAC000-memory.dmpFilesize
624KB
-
memory/220-132-0x0000000000490000-0x0000000000588000-memory.dmpFilesize
992KB
-
memory/220-135-0x0000000004FE0000-0x0000000004FEA000-memory.dmpFilesize
40KB
-
memory/220-134-0x0000000004F20000-0x0000000004FB2000-memory.dmpFilesize
584KB
-
memory/220-133-0x00000000055B0000-0x0000000005B54000-memory.dmpFilesize
5.6MB
-
memory/2028-137-0x0000000000000000-mapping.dmp
-
memory/2876-138-0x0000000000000000-mapping.dmp
-
memory/3476-139-0x0000000000000000-mapping.dmp
-
memory/4372-145-0x0000000000000000-mapping.dmp
-
memory/4868-143-0x0000000000000000-mapping.dmp
-
memory/4896-140-0x0000000000000000-mapping.dmp
-
memory/4896-141-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4896-147-0x0000000007450000-0x00000000074B6000-memory.dmpFilesize
408KB