Analysis
- max time kernel
143s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
24/01/2023, 07:31
General
- Target file.exe
- Size 2.4MB
- Sample230124-jcc9dsbd3y
- SHA256 3c7b63dd4b4b7c4fa899ff1f1130aeee9656d47c430629a71c40cb691e402e85
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "NOLAB" /tr "C:\ProgramData\Maker\NOLAB.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "NOLAB" /tr "C:\ProgramData\Maker\NOLAB.exe"3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3332-148-0x00007FFEA5C90000-0x00007FFEA6751000-memory.dmp
memory/3332-147-0x0000021238F90000-0x0000021238FB2000-memory.dmp
memory/4612-145-0x00007FFEC18C0000-0x00007FFEC18E7000-memory.dmp
memory/4612-135-0x00007FFEBF1F0000-0x00007FFEBF202000-memory.dmp
memory/4612-140-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/4612-139-0x00007FFEA5C90000-0x00007FFEA6751000-memory.dmp
memory/4612-141-0x00007FFEC2DF0000-0x00007FFEC2E1B000-memory.dmp
memory/4612-142-0x00000000007D0000-0x0000000000B1A000-memory.dmp
memory/4612-143-0x00007FFEA7090000-0x00007FFEA71DE000-memory.dmp
memory/4612-144-0x00007FFEA5C90000-0x00007FFEA6751000-memory.dmp
memory/4612-133-0x00007FFEA7330000-0x00007FFEA73DA000-memory.dmp
memory/4612-137-0x00007FFEC2270000-0x00007FFEC2411000-memory.dmp
memory/4612-136-0x00007FFEA71E0000-0x00007FFEA729D000-memory.dmp
memory/4612-138-0x00000000007D0000-0x0000000000B1A000-memory.dmp
memory/4612-149-0x00000000007D0000-0x0000000000B1A000-memory.dmp
memory/4612-150-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/4612-151-0x00007FFEA5C90000-0x00007FFEA6751000-memory.dmp
memory/4612-157-0x00007FFEC06A0000-0x00007FFEC06DB000-memory.dmp
memory/4612-134-0x00007FFEC2990000-0x00007FFEC2A2E000-memory.dmp
memory/4612-154-0x00007FFEA6FD0000-0x00007FFEA7005000-memory.dmp
memory/4612-155-0x00007FFEA14C0000-0x00007FFEA15C2000-memory.dmp
memory/4612-156-0x00007FFEC2480000-0x00007FFEC24EB000-memory.dmp