Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 00:52
Behavioral task
behavioral1
Sample
nanocore.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
nanocore.exe
-
Size
202KB
-
MD5
fc6b48e4a26a58d4ac831717ba66c7cc
-
SHA1
d85d002146457a6c2d5c4d574c6f85c7783995b1
-
SHA256
0f1d6aab547ceca6e71ac2e5a54afdaea597318fe7b6ca337f5b92fdff596168
-
SHA512
3aafc7a2d1258a3ba5738fdf97732158f104c9a3eba81fb1715d0033bfda0465e274088d775374ec7e8131c5dc7ceaf4fd03e9d55c2b2fe794420e79a42bb203
-
SSDEEP
3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIIqIE8nA2VErmL4llWrg1933sc:QLV6Bta6dtJmakIM5DEYA2VcmL4lQ0sc
Malware Config
Signatures
-
Processes:
nanocore.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nanocore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
nanocore.exepid process 1476 nanocore.exe 1476 nanocore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
nanocore.exepid process 1476 nanocore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nanocore.exedescription pid process Token: SeDebugPrivilege 1476 nanocore.exe