Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 14:40
Static task
static1
Behavioral task
behavioral1
Sample
72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf.exe
Resource
win7-20230220-en
General
-
Target
72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf.exe
-
Size
1.1MB
-
MD5
c801ddba1e08aee3df1393fc83f1f183
-
SHA1
89266765714a026a7994db0e4d50f85ff33375e0
-
SHA256
72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf
-
SHA512
89992a2693f955fb355390847b045b3684313d3dd0215a8040b1a66164cf12388c78e1b1d8bc738751da3a8df070c9990d05862c2f26f40d84305642264e3aa9
-
SSDEEP
24576:9TbBv5rUeTRpvm6t5r1zQ1lcgNdNd0fuiD5u:XBvRpv/KcgX0GGk
Malware Config
Extracted
nanocore
1.2.2.0
december2n.duckdns.org:40111
december2nd.ddns.net:40111
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
activate_away_mode
false
-
backup_connection_host
december2nd.ddns.net
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-11-26T05:13:34.059050336Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
40111
-
default_group
mama
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
december2n.duckdns.org
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
mafhxrrecs.pifRegSvcs.exepid process 860 mafhxrrecs.pif 1944 RegSvcs.exe -
Loads dropped DLL 2 IoCs
Processes:
wscript.exemafhxrrecs.pifpid process 1488 wscript.exe 860 mafhxrrecs.pif -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
mafhxrrecs.pifRegSvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run mafhxrrecs.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nned\\MAFHXR~1.PIF C:\\Users\\Admin\\AppData\\Local\\Temp\\nned\\idobeex.xls" mafhxrrecs.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nned\\Update.vbs" mafhxrrecs.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisv.exe" RegSvcs.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mafhxrrecs.pifdescription pid process target process PID 860 set thread context of 1944 860 mafhxrrecs.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisv.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1792 schtasks.exe 1672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 1944 RegSvcs.exe 1944 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1944 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1944 RegSvcs.exe Token: SeDebugPrivilege 1944 RegSvcs.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf.exewscript.exemafhxrrecs.pifRegSvcs.exedescription pid process target process PID 2040 wrote to memory of 1488 2040 72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf.exe wscript.exe PID 2040 wrote to memory of 1488 2040 72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf.exe wscript.exe PID 2040 wrote to memory of 1488 2040 72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf.exe wscript.exe PID 2040 wrote to memory of 1488 2040 72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf.exe wscript.exe PID 1488 wrote to memory of 860 1488 wscript.exe mafhxrrecs.pif PID 1488 wrote to memory of 860 1488 wscript.exe mafhxrrecs.pif PID 1488 wrote to memory of 860 1488 wscript.exe mafhxrrecs.pif PID 1488 wrote to memory of 860 1488 wscript.exe mafhxrrecs.pif PID 1488 wrote to memory of 860 1488 wscript.exe mafhxrrecs.pif PID 1488 wrote to memory of 860 1488 wscript.exe mafhxrrecs.pif PID 1488 wrote to memory of 860 1488 wscript.exe mafhxrrecs.pif PID 860 wrote to memory of 1944 860 mafhxrrecs.pif RegSvcs.exe PID 860 wrote to memory of 1944 860 mafhxrrecs.pif RegSvcs.exe PID 860 wrote to memory of 1944 860 mafhxrrecs.pif RegSvcs.exe PID 860 wrote to memory of 1944 860 mafhxrrecs.pif RegSvcs.exe PID 860 wrote to memory of 1944 860 mafhxrrecs.pif RegSvcs.exe PID 860 wrote to memory of 1944 860 mafhxrrecs.pif RegSvcs.exe PID 860 wrote to memory of 1944 860 mafhxrrecs.pif RegSvcs.exe PID 860 wrote to memory of 1944 860 mafhxrrecs.pif RegSvcs.exe PID 860 wrote to memory of 1944 860 mafhxrrecs.pif RegSvcs.exe PID 1944 wrote to memory of 1792 1944 RegSvcs.exe schtasks.exe PID 1944 wrote to memory of 1792 1944 RegSvcs.exe schtasks.exe PID 1944 wrote to memory of 1792 1944 RegSvcs.exe schtasks.exe PID 1944 wrote to memory of 1792 1944 RegSvcs.exe schtasks.exe PID 1944 wrote to memory of 1672 1944 RegSvcs.exe schtasks.exe PID 1944 wrote to memory of 1672 1944 RegSvcs.exe schtasks.exe PID 1944 wrote to memory of 1672 1944 RegSvcs.exe schtasks.exe PID 1944 wrote to memory of 1672 1944 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf.exe"C:\Users\Admin\AppData\Local\Temp\72534019f459f511b0f3b3253214c8450252acc14b49b10477e503f1dac921bf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" Update-uu.v.vbe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nned\mafhxrrecs.pif"C:\Users\Admin\AppData\Local\Temp\nned\mafhxrrecs.pif" idobeex.xls3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4471.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4646.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\nned\idobeex.xlsFilesize
96.5MB
MD5c38dfc03488421c42c46552f0f1644bc
SHA106bf628f8ec1b41ff8b423902f0c44b62a1da0de
SHA256e04d57bdfe4ca63f02f092f40c884139338077874501595f2e7013d96a9ecc1d
SHA512a6adbe80cb011626b35748a7190f31dab9b8f3d696edef6f512c43a690757905b0af6fa9bc358fb3fd04def2b779bc8c992aba7124f118644e0e7292abe41467
-
C:\Users\Admin\AppData\Local\Temp\nned\mafhxrrecs.pifFilesize
1.2MB
MD51666ceb91e7c5f8f2ba035363130ab2e
SHA16d85f5b94d2deb4e62845ed0ce754e40c62b3548
SHA2565400f4f671f68f32758c431656708e7ba3b0d950baa9bea8e6c9c7727426da65
SHA5122c35929fa346f0ebe14131883f4e05db82ec7ddef9eee4269bd15815eebce3ad27ae04a39f47f2f903c5c72f28d079863ea8accfc0eb3f88b110d4ee367e5943
-
C:\Users\Admin\AppData\Local\Temp\nned\mafhxrrecs.pifFilesize
1.2MB
MD51666ceb91e7c5f8f2ba035363130ab2e
SHA16d85f5b94d2deb4e62845ed0ce754e40c62b3548
SHA2565400f4f671f68f32758c431656708e7ba3b0d950baa9bea8e6c9c7727426da65
SHA5122c35929fa346f0ebe14131883f4e05db82ec7ddef9eee4269bd15815eebce3ad27ae04a39f47f2f903c5c72f28d079863ea8accfc0eb3f88b110d4ee367e5943
-
C:\Users\Admin\AppData\Local\Temp\nned\pqtabltirs.txtFilesize
33KB
MD500e3571da73e9cd30f73787202e152ba
SHA1a2a3078f3373b0bfd9021cd6eb0f2614b707d83d
SHA256eb6a085d7ef6c522b349dab8570c1d82bf7188d0ab4ae83a8ab03b89335db486
SHA512aa742ddd7585d96ec2e754927e9fc3c47637d05bad10c804d931dc0172c68bee8d1c737e3dafc87b10b357ca74979bd446fa96ff0c134e5ce85a70d50fa568be
-
C:\Users\Admin\AppData\Local\Temp\nned\tkdktfms.cgwFilesize
397KB
MD547a3760694424f080062061971c9e2ae
SHA1107b8682b9322ee4886ade154c88c3cfebd24ae9
SHA2562a454fbe70bedf8e9df6bb9172fd14b941b675a3465a80bc9b0fe20b499ef4ad
SHA51231d92fc367c857fa71598fbb3346f292da574855d013a7cab0b5715eac80a7e2b37d863c92dcdb3b1ef34fc6e3529630460c9b23ba22e3d41e4553c5f3a3e655
-
C:\Users\Admin\AppData\Local\Temp\tmp4471.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp4646.tmpFilesize
1KB
MD59df610a4811c98cb7fe4ef5e929f4498
SHA1014a42541c7f78cc715b7b4ebf52957334370842
SHA2563e70b8c0039e499fdb46c4630d8178cbb82b49bf09358ebedfeb5a9ccdade175
SHA5125180a43b8f88d33baf0c1634e59b56db5ca46396556d6c7fb11f05ac391a082d766a5693bdaf29d9deaf39733fe4445cc738d77f1df07eea51ec0b8b0084e4cd
-
C:\Users\Admin\AppData\Local\temp\nned\Update-uu.v.vbeFilesize
78KB
MD53ef12cda11b9cdc7b7a27a064b89edcf
SHA17769c38d1ebc6d6d1b2eb929789b3c16245c8ec9
SHA256feb515c11fe4a98b1f26b6fc1d3ea924cb31dfcc903792f15ff1e4ac90f59c25
SHA512b90843ddcdd1f8a7419f37884c1625ccb4fce06f0a40344b015676445fddfe575aab5e6229725a5bf80e30867bf2b5c2f91dd1d957ba952edb7116f1d8f426a2
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\nned\mafhxrrecs.pifFilesize
1.2MB
MD51666ceb91e7c5f8f2ba035363130ab2e
SHA16d85f5b94d2deb4e62845ed0ce754e40c62b3548
SHA2565400f4f671f68f32758c431656708e7ba3b0d950baa9bea8e6c9c7727426da65
SHA5122c35929fa346f0ebe14131883f4e05db82ec7ddef9eee4269bd15815eebce3ad27ae04a39f47f2f903c5c72f28d079863ea8accfc0eb3f88b110d4ee367e5943
-
memory/1944-129-0x00000000003D0000-0x00000000008ED000-memory.dmpFilesize
5.1MB
-
memory/1944-131-0x00000000003D0000-0x00000000008ED000-memory.dmpFilesize
5.1MB
-
memory/1944-126-0x00000000003D0000-0x00000000008ED000-memory.dmpFilesize
5.1MB
-
memory/1944-133-0x00000000003D0000-0x000000000040A000-memory.dmpFilesize
232KB
-
memory/1944-136-0x0000000000C00000-0x0000000000C40000-memory.dmpFilesize
256KB
-
memory/1944-124-0x00000000003D0000-0x00000000008ED000-memory.dmpFilesize
5.1MB
-
memory/1944-125-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1944-142-0x00000000008F0000-0x00000000008FA000-memory.dmpFilesize
40KB
-
memory/1944-143-0x0000000000A00000-0x0000000000A0C000-memory.dmpFilesize
48KB
-
memory/1944-144-0x0000000000A50000-0x0000000000A6E000-memory.dmpFilesize
120KB
-
memory/1944-145-0x0000000000B00000-0x0000000000B0A000-memory.dmpFilesize
40KB
-
memory/1944-146-0x0000000000C00000-0x0000000000C40000-memory.dmpFilesize
256KB