Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-03-2023 01:39
Static task
static1
Behavioral task
behavioral1
Sample
dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c.exe
Resource
win7-20230220-en
General
-
Target
dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c.exe
-
Size
1.1MB
-
MD5
8903abf7f27153d44bc49dd7875c0eb6
-
SHA1
67919e9c5babca471da12c881809c9d105670fba
-
SHA256
dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c
-
SHA512
d0b7902a79332bcfa64e57fc4bce1c3e76250d78bc05297a528d415470e720e1646824e8fc177547b61840fe0a60496841e71fe6ed744b81c576c2af6bf35b95
-
SSDEEP
24576:lTbBv5rUaUUUUUJUUUUUUJDPpvm6to+dLn1CHm8WZQ6k+5zUMeC:PBLUUUUUJUUUUUUFPpv2+9n1ymdqwFUQ
Malware Config
Extracted
nanocore
1.2.2.0
december2n.duckdns.org:40111
december2nd.ddns.net:40111
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
activate_away_mode
false
-
backup_connection_host
december2nd.ddns.net
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-11-26T05:13:34.059050336Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
40111
-
default_group
mama
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
december2n.duckdns.org
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
uflbpckkn.pifRegSvcs.exepid process 908 uflbpckkn.pif 1636 RegSvcs.exe -
Loads dropped DLL 2 IoCs
Processes:
wscript.exeuflbpckkn.pifpid process 1132 wscript.exe 908 uflbpckkn.pif -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
uflbpckkn.pifRegSvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run uflbpckkn.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulfi\\UFLBPC~1.PIF C:\\Users\\Admin\\AppData\\Local\\Temp\\ulfi\\acac.icm" uflbpckkn.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulfi\\Update.vbs" uflbpckkn.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisv.exe" RegSvcs.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uflbpckkn.pifdescription pid process target process PID 908 set thread context of 1636 908 uflbpckkn.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisv.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1624 schtasks.exe 1112 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 1636 RegSvcs.exe 1636 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1636 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1636 RegSvcs.exe Token: SeDebugPrivilege 1636 RegSvcs.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c.exewscript.exeuflbpckkn.pifRegSvcs.exedescription pid process target process PID 1992 wrote to memory of 1132 1992 dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c.exe wscript.exe PID 1992 wrote to memory of 1132 1992 dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c.exe wscript.exe PID 1992 wrote to memory of 1132 1992 dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c.exe wscript.exe PID 1992 wrote to memory of 1132 1992 dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c.exe wscript.exe PID 1132 wrote to memory of 908 1132 wscript.exe uflbpckkn.pif PID 1132 wrote to memory of 908 1132 wscript.exe uflbpckkn.pif PID 1132 wrote to memory of 908 1132 wscript.exe uflbpckkn.pif PID 1132 wrote to memory of 908 1132 wscript.exe uflbpckkn.pif PID 1132 wrote to memory of 908 1132 wscript.exe uflbpckkn.pif PID 1132 wrote to memory of 908 1132 wscript.exe uflbpckkn.pif PID 1132 wrote to memory of 908 1132 wscript.exe uflbpckkn.pif PID 908 wrote to memory of 1636 908 uflbpckkn.pif RegSvcs.exe PID 908 wrote to memory of 1636 908 uflbpckkn.pif RegSvcs.exe PID 908 wrote to memory of 1636 908 uflbpckkn.pif RegSvcs.exe PID 908 wrote to memory of 1636 908 uflbpckkn.pif RegSvcs.exe PID 908 wrote to memory of 1636 908 uflbpckkn.pif RegSvcs.exe PID 908 wrote to memory of 1636 908 uflbpckkn.pif RegSvcs.exe PID 908 wrote to memory of 1636 908 uflbpckkn.pif RegSvcs.exe PID 908 wrote to memory of 1636 908 uflbpckkn.pif RegSvcs.exe PID 908 wrote to memory of 1636 908 uflbpckkn.pif RegSvcs.exe PID 1636 wrote to memory of 1624 1636 RegSvcs.exe schtasks.exe PID 1636 wrote to memory of 1624 1636 RegSvcs.exe schtasks.exe PID 1636 wrote to memory of 1624 1636 RegSvcs.exe schtasks.exe PID 1636 wrote to memory of 1624 1636 RegSvcs.exe schtasks.exe PID 1636 wrote to memory of 1112 1636 RegSvcs.exe schtasks.exe PID 1636 wrote to memory of 1112 1636 RegSvcs.exe schtasks.exe PID 1636 wrote to memory of 1112 1636 RegSvcs.exe schtasks.exe PID 1636 wrote to memory of 1112 1636 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c.exe"C:\Users\Admin\AppData\Local\Temp\dc632387d0761b880e99669d0351799c9bed07e9bb3f806ad51fec32bfd0bb8c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" Update-ea.i.vbe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ulfi\uflbpckkn.pif"C:\Users\Admin\AppData\Local\Temp\ulfi\uflbpckkn.pif" acac.icm3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4C2E.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4D96.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp4C2E.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp4D96.tmpFilesize
1KB
MD59df610a4811c98cb7fe4ef5e929f4498
SHA1014a42541c7f78cc715b7b4ebf52957334370842
SHA2563e70b8c0039e499fdb46c4630d8178cbb82b49bf09358ebedfeb5a9ccdade175
SHA5125180a43b8f88d33baf0c1634e59b56db5ca46396556d6c7fb11f05ac391a082d766a5693bdaf29d9deaf39733fe4445cc738d77f1df07eea51ec0b8b0084e4cd
-
C:\Users\Admin\AppData\Local\Temp\ulfi\acac.icmFilesize
95.9MB
MD5e8a33aaf79c3f76c630c61c6f5f0b31a
SHA1993bdb82effe95425f90e641109423bdac297877
SHA2568cca194384c2997d1de62de975ba07081fabf02d0b52667c5eaa3f28894e5dcd
SHA51205c4473f62d417686b5f954639c5d7bfe49fbaab3c63188f3085353f3ae40fc0e34dab6ad815d32af535800eaabab74a0c401acc96c345bf5eea74261731f648
-
C:\Users\Admin\AppData\Local\Temp\ulfi\fvwo.khuFilesize
397KB
MD547a3760694424f080062061971c9e2ae
SHA1107b8682b9322ee4886ade154c88c3cfebd24ae9
SHA2562a454fbe70bedf8e9df6bb9172fd14b941b675a3465a80bc9b0fe20b499ef4ad
SHA51231d92fc367c857fa71598fbb3346f292da574855d013a7cab0b5715eac80a7e2b37d863c92dcdb3b1ef34fc6e3529630460c9b23ba22e3d41e4553c5f3a3e655
-
C:\Users\Admin\AppData\Local\Temp\ulfi\lxskid.exeFilesize
36KB
MD52435592ed0b9f8d194c83959963dc3f7
SHA138f7a2ae638a16ba3795a62f14e8dbfafd3773d9
SHA2562810ae0246ac63c47e79965e2873e9e5680e86cadfad49d786a6d9487959503a
SHA512e9fa279c187ddc879df2adb45ffb4d57528737921a6dd6c8b071e5cfa0049987b6a31b05b110c4b33c6123c8a6114d7e6348ffa80f020124f46235a0336f8ef9
-
C:\Users\Admin\AppData\Local\Temp\ulfi\uflbpckkn.pifFilesize
1.1MB
MD5a2e8bd62287be6d626673abaf4a08ee1
SHA1356414442272116ead8fd4cbf846e3764cbb7b43
SHA256cd6fa898bfad0a9f9571b7529c3dfbcbefc2e7bd74cb534920d744a1e7b1c280
SHA51298effa2b34f97ebfa0bd5178868774b9a6b435179bd6a2bca89081121c17b1a073b46bbd983cec0a1dad5f9491a2707649b0c3082d1b012fff4a78fee94262a1
-
C:\Users\Admin\AppData\Local\Temp\ulfi\uflbpckkn.pifFilesize
1.1MB
MD5a2e8bd62287be6d626673abaf4a08ee1
SHA1356414442272116ead8fd4cbf846e3764cbb7b43
SHA256cd6fa898bfad0a9f9571b7529c3dfbcbefc2e7bd74cb534920d744a1e7b1c280
SHA51298effa2b34f97ebfa0bd5178868774b9a6b435179bd6a2bca89081121c17b1a073b46bbd983cec0a1dad5f9491a2707649b0c3082d1b012fff4a78fee94262a1
-
C:\Users\Admin\AppData\Local\temp\ulfi\Update-ea.i.vbeFilesize
90KB
MD53318cb58d4af65922182b7ed858c6ade
SHA1c088cc1d16ee3193e37024469b62dd3aaaf9e6f3
SHA2569343cabbc583472118ef788156f745aba257309f5374c54ec52e4ef04048174a
SHA51200a4505c4d35524a4b2c0a133aabfd30009e0bb3715774dc04c31122bce83d530026178d136e8fdb2903d891e603ae9e74727b3c9441cbe9bd63785f91a9f24f
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\ulfi\uflbpckkn.pifFilesize
1.1MB
MD5a2e8bd62287be6d626673abaf4a08ee1
SHA1356414442272116ead8fd4cbf846e3764cbb7b43
SHA256cd6fa898bfad0a9f9571b7529c3dfbcbefc2e7bd74cb534920d744a1e7b1c280
SHA51298effa2b34f97ebfa0bd5178868774b9a6b435179bd6a2bca89081121c17b1a073b46bbd983cec0a1dad5f9491a2707649b0c3082d1b012fff4a78fee94262a1
-
memory/1636-124-0x00000000004C0000-0x0000000000C1C000-memory.dmpFilesize
7.4MB
-
memory/1636-129-0x00000000004C0000-0x0000000000C1C000-memory.dmpFilesize
7.4MB
-
memory/1636-138-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB
-
memory/1636-123-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1636-122-0x00000000004C0000-0x0000000000C1C000-memory.dmpFilesize
7.4MB
-
memory/1636-127-0x00000000004C0000-0x0000000000C1C000-memory.dmpFilesize
7.4MB
-
memory/1636-131-0x00000000004C0000-0x00000000004FA000-memory.dmpFilesize
232KB
-
memory/1636-140-0x00000000002A0000-0x00000000002AA000-memory.dmpFilesize
40KB
-
memory/1636-141-0x00000000002C0000-0x00000000002CC000-memory.dmpFilesize
48KB
-
memory/1636-142-0x00000000002D0000-0x00000000002EE000-memory.dmpFilesize
120KB
-
memory/1636-143-0x0000000000380000-0x000000000038A000-memory.dmpFilesize
40KB
-
memory/1636-144-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB