Analysis
-
max time kernel
143s -
max time network
331s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 10:33
Behavioral task
behavioral1
Sample
nanocore.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
General
-
Target
nanocore.exe
-
Size
202KB
-
MD5
ff6b9b91b9d9f12174cef6a40066778e
-
SHA1
93a519a3c3304540aa2e503a58c43d9534ab1d8d
-
SHA256
98feb1dbdf5ce8029d274a83a22aa86f68da98ce4383c657bedfb360eea2041b
-
SHA512
23f3b1495ce5f8a59a4b2fde04bf086c95dc4818a5745def67608f2ff1a83e7c30c50999af362eb7b519b18a88cdf9c6930030a0a3bdd14642101d3fdde93e12
-
SSDEEP
3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI0+N2B5VEF7D0tyI+AQ10bJp+:gLV6Bta6dtJmakIM5k0BMB6V+AQ1+JA
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
nanocore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" nanocore.exe -
Processes:
nanocore.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nanocore.exe -
Drops file in Program Files directory 2 IoCs
Processes:
nanocore.exedescription ioc process File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe nanocore.exe File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe nanocore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
nanocore.exepid process 1000 nanocore.exe 1000 nanocore.exe 1000 nanocore.exe 1000 nanocore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
nanocore.exepid process 1000 nanocore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nanocore.exedescription pid process Token: SeDebugPrivilege 1000 nanocore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nanocore.exe"C:\Users\Admin\AppData\Local\Temp\nanocore.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken