Analysis
-
max time kernel
137s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-03-2023 09:01
Static task
static1
Behavioral task
behavioral1
Sample
5bd6af6f395bd4d577b0d3c97bc58195.scr.exe
Resource
win7-20230220-en
General
-
Target
5bd6af6f395bd4d577b0d3c97bc58195.scr.exe
-
Size
1.1MB
-
MD5
b15216131833ae02f4f05d5bb4dfea43
-
SHA1
dc09861f62b55e50be77a1588a997adf9b80e410
-
SHA256
2ef9e0b5a402e96b775bb1701741bb8af269dd6346b96827681da12912a55b8a
-
SHA512
85961d8b04687f7cb70eecce082e82198fcdbb6093a1ef34f8fe12a69b41c3f3cc05e388162d3d89f160fa63e807d62a6a5fefd1587db44d0f27c1bd8a107633
-
SSDEEP
24576:lTbBv5rUaUUUUUJUUUUUUJDDpvm6tTjloM8WZQ6k+5zUMel:PBLUUUUUJUUUUUUFDpvYMdqwFUMM
Malware Config
Extracted
nanocore
1.2.2.0
december2n.duckdns.org:40111
december2nd.ddns.net:40111
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
activate_away_mode
false
-
backup_connection_host
december2nd.ddns.net
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-11-26T05:13:34.059050336Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
40111
-
default_group
mama
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
december2n.duckdns.org
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
shaggugwvk.pifRegSvcs.exepid process 2020 shaggugwvk.pif 872 RegSvcs.exe -
Loads dropped DLL 2 IoCs
Processes:
wscript.exeshaggugwvk.pifpid process 608 wscript.exe 2020 shaggugwvk.pif -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
shaggugwvk.pifRegSvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run shaggugwvk.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ppfr\\SHAGGU~1.PIF C:\\Users\\Admin\\AppData\\Local\\Temp\\ppfr\\jmapn.msc" shaggugwvk.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ppfr\\Update.vbs" shaggugwvk.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe" RegSvcs.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
shaggugwvk.pifdescription pid process target process PID 2020 set thread context of 872 2020 shaggugwvk.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Program Files (x86)\DDP Manager\ddpmgr.exe RegSvcs.exe File created C:\Program Files (x86)\DDP Manager\ddpmgr.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegSvcs.exepid process 872 RegSvcs.exe 872 RegSvcs.exe 872 RegSvcs.exe 872 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 872 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 872 RegSvcs.exe Token: SeDebugPrivilege 872 RegSvcs.exe Token: SeDebugPrivilege 872 RegSvcs.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5bd6af6f395bd4d577b0d3c97bc58195.scr.exewscript.exeshaggugwvk.pifRegSvcs.exedescription pid process target process PID 1684 wrote to memory of 608 1684 5bd6af6f395bd4d577b0d3c97bc58195.scr.exe wscript.exe PID 1684 wrote to memory of 608 1684 5bd6af6f395bd4d577b0d3c97bc58195.scr.exe wscript.exe PID 1684 wrote to memory of 608 1684 5bd6af6f395bd4d577b0d3c97bc58195.scr.exe wscript.exe PID 1684 wrote to memory of 608 1684 5bd6af6f395bd4d577b0d3c97bc58195.scr.exe wscript.exe PID 608 wrote to memory of 2020 608 wscript.exe shaggugwvk.pif PID 608 wrote to memory of 2020 608 wscript.exe shaggugwvk.pif PID 608 wrote to memory of 2020 608 wscript.exe shaggugwvk.pif PID 608 wrote to memory of 2020 608 wscript.exe shaggugwvk.pif PID 608 wrote to memory of 2020 608 wscript.exe shaggugwvk.pif PID 608 wrote to memory of 2020 608 wscript.exe shaggugwvk.pif PID 608 wrote to memory of 2020 608 wscript.exe shaggugwvk.pif PID 2020 wrote to memory of 872 2020 shaggugwvk.pif RegSvcs.exe PID 2020 wrote to memory of 872 2020 shaggugwvk.pif RegSvcs.exe PID 2020 wrote to memory of 872 2020 shaggugwvk.pif RegSvcs.exe PID 2020 wrote to memory of 872 2020 shaggugwvk.pif RegSvcs.exe PID 2020 wrote to memory of 872 2020 shaggugwvk.pif RegSvcs.exe PID 2020 wrote to memory of 872 2020 shaggugwvk.pif RegSvcs.exe PID 2020 wrote to memory of 872 2020 shaggugwvk.pif RegSvcs.exe PID 2020 wrote to memory of 872 2020 shaggugwvk.pif RegSvcs.exe PID 2020 wrote to memory of 872 2020 shaggugwvk.pif RegSvcs.exe PID 872 wrote to memory of 384 872 RegSvcs.exe schtasks.exe PID 872 wrote to memory of 384 872 RegSvcs.exe schtasks.exe PID 872 wrote to memory of 384 872 RegSvcs.exe schtasks.exe PID 872 wrote to memory of 384 872 RegSvcs.exe schtasks.exe PID 872 wrote to memory of 1592 872 RegSvcs.exe schtasks.exe PID 872 wrote to memory of 1592 872 RegSvcs.exe schtasks.exe PID 872 wrote to memory of 1592 872 RegSvcs.exe schtasks.exe PID 872 wrote to memory of 1592 872 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bd6af6f395bd4d577b0d3c97bc58195.scr.exe"C:\Users\Admin\AppData\Local\Temp\5bd6af6f395bd4d577b0d3c97bc58195.scr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" Update-db.q.vbe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif"C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif" jmapn.msc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp49ED.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4C7D.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\ppfr\jmapn.mscFilesize
83.2MB
MD5027fcff6a3d87f462e20830ac8e3514f
SHA1f8ccc5c999f380c02617dd9a342fb4e6f8aa1389
SHA2560ebdc3485e0b7208f43d2cc85fa841f528f74fab9d3fd90ddbee1b4eff2e17d5
SHA512cbc01e13eaf6619264a46b03237f8f84af0df364581252de45d8cee7ee0757afdac23e6a740e87f0817c660bad02163d4ef1ab3f76d10347f52406fe2e8e910d
-
C:\Users\Admin\AppData\Local\Temp\ppfr\mbmuovrk.vmbFilesize
397KB
MD547a3760694424f080062061971c9e2ae
SHA1107b8682b9322ee4886ade154c88c3cfebd24ae9
SHA2562a454fbe70bedf8e9df6bb9172fd14b941b675a3465a80bc9b0fe20b499ef4ad
SHA51231d92fc367c857fa71598fbb3346f292da574855d013a7cab0b5715eac80a7e2b37d863c92dcdb3b1ef34fc6e3529630460c9b23ba22e3d41e4553c5f3a3e655
-
C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pifFilesize
1.1MB
MD5164ad61662d4c1689360b3e088f2152f
SHA1c2a2e463a82845171f746d25932b25880d49f7fe
SHA2561a272f4a2a062cafb72904a1643de13acce81dd1adfc7da7d9873ec88dce431e
SHA512c48c0698bdabc7d7eefa5dc239d9baa43334a64bd4b01b1a0243e873124b01bc5e8d46ef421b888850fe5666e1c4585014254fe32c25463fe71bd2775ae043cc
-
C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pifFilesize
1.1MB
MD5164ad61662d4c1689360b3e088f2152f
SHA1c2a2e463a82845171f746d25932b25880d49f7fe
SHA2561a272f4a2a062cafb72904a1643de13acce81dd1adfc7da7d9873ec88dce431e
SHA512c48c0698bdabc7d7eefa5dc239d9baa43334a64bd4b01b1a0243e873124b01bc5e8d46ef421b888850fe5666e1c4585014254fe32c25463fe71bd2775ae043cc
-
C:\Users\Admin\AppData\Local\Temp\ppfr\vjmptakx.icmFilesize
37KB
MD5ae0c231ca889212f0bad108625ad4514
SHA1a9bce3322991fcf993ad466ea78637eecd624db9
SHA2567c11fef67f06f18a2d5a949029c9ac362f40cd3f1f13e74336473fd65d327a42
SHA5125016270c7493360d8019e074e2e3c8382eea4384b63ea188ecf6a97d45a706f0a3d3621071479b3f15bb0e596dbc376c8d9d8c99d269e063fed046e621be18d6
-
C:\Users\Admin\AppData\Local\Temp\tmp49ED.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp4C7D.tmpFilesize
1KB
MD5677848190631e19222304d1982aa2e1b
SHA1bed6cf97d3458e4ea59ff9823375d915a9b3d682
SHA2568bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d
SHA512f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e
-
C:\Users\Admin\AppData\Local\temp\ppfr\Update-db.q.vbeFilesize
60KB
MD5adf0a90a776e28ce256b5bcef92dc40c
SHA185d5b78d08df5ab38a70ac372dda075424f1a886
SHA256ee53ad078ffa7b36eb1f71f5a4dfdb5e945c4aad6d8af78bf780be19c27c3ee7
SHA512078c3b432854aa9d0bd0673e60e0515e2a9e35e70f826835424ac7da76ba48c8dd3840b5960cfab6149d3739e5c35744f3628a2f08523033c6b0a1addb8ab410
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pifFilesize
1.1MB
MD5164ad61662d4c1689360b3e088f2152f
SHA1c2a2e463a82845171f746d25932b25880d49f7fe
SHA2561a272f4a2a062cafb72904a1643de13acce81dd1adfc7da7d9873ec88dce431e
SHA512c48c0698bdabc7d7eefa5dc239d9baa43334a64bd4b01b1a0243e873124b01bc5e8d46ef421b888850fe5666e1c4585014254fe32c25463fe71bd2775ae043cc
-
memory/872-141-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/872-164-0x00000000010B0000-0x00000000010C2000-memory.dmpFilesize
72KB
-
memory/872-145-0x00000000003B0000-0x0000000000858000-memory.dmpFilesize
4.7MB
-
memory/872-149-0x00000000003B0000-0x00000000003EA000-memory.dmpFilesize
232KB
-
memory/872-151-0x0000000004730000-0x0000000004770000-memory.dmpFilesize
256KB
-
memory/872-142-0x00000000003B0000-0x0000000000858000-memory.dmpFilesize
4.7MB
-
memory/872-140-0x00000000003B0000-0x0000000000858000-memory.dmpFilesize
4.7MB
-
memory/872-158-0x00000000002A0000-0x00000000002AA000-memory.dmpFilesize
40KB
-
memory/872-159-0x00000000009F0000-0x00000000009FC000-memory.dmpFilesize
48KB
-
memory/872-160-0x0000000001050000-0x000000000106E000-memory.dmpFilesize
120KB
-
memory/872-161-0x0000000000E00000-0x0000000000E0A000-memory.dmpFilesize
40KB
-
memory/872-147-0x00000000003B0000-0x0000000000858000-memory.dmpFilesize
4.7MB
-
memory/872-165-0x00000000024E0000-0x00000000024FA000-memory.dmpFilesize
104KB
-
memory/872-166-0x0000000002500000-0x000000000250E000-memory.dmpFilesize
56KB
-
memory/872-167-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/872-168-0x0000000002570000-0x000000000257E000-memory.dmpFilesize
56KB
-
memory/872-169-0x00000000047B0000-0x00000000047BC000-memory.dmpFilesize
48KB
-
memory/872-170-0x0000000004900000-0x0000000004914000-memory.dmpFilesize
80KB
-
memory/872-171-0x0000000004910000-0x0000000004920000-memory.dmpFilesize
64KB
-
memory/872-172-0x0000000004FD0000-0x0000000004FE4000-memory.dmpFilesize
80KB
-
memory/872-173-0x0000000004FF0000-0x0000000004FFE000-memory.dmpFilesize
56KB
-
memory/872-174-0x0000000005160000-0x000000000518E000-memory.dmpFilesize
184KB
-
memory/872-175-0x00000000051D0000-0x00000000051E4000-memory.dmpFilesize
80KB
-
memory/872-177-0x0000000004730000-0x0000000004770000-memory.dmpFilesize
256KB