Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-03-2023 09:01
Static task
static1
Behavioral task
behavioral1
Sample
b6a93bf2bc23112c54ccb654fce93f27.scr.exe
Resource
win7-20230220-en
General
-
Target
b6a93bf2bc23112c54ccb654fce93f27.scr.exe
-
Size
1.1MB
-
MD5
c47bb4cb98316705617288bbe59667f3
-
SHA1
e5b84e94f268a1a45e8e1134b4a4aa1afe07ff09
-
SHA256
a955997c08ed97f83968344c9eff0a4789683fc99ef1872c6bf223990c30cdda
-
SHA512
5c0020f4803d248a8784a29b566dfa413439b3a7653a261e2d64ea556660df0d3e8ea8a6da5376d3184f56e01a15809b9077483964886332ae05453b261338b9
-
SSDEEP
24576:lTbBv5rUaUUUUUJUUUUUUJDgpvm6t2SwCDa8WZQ6k+5zUMexz:PBLUUUUUJUUUUUUFgpvqCDadqwFUM4z
Malware Config
Extracted
nanocore
1.2.2.0
december2n.duckdns.org:40111
december2nd.ddns.net:40111
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
activate_away_mode
false
-
backup_connection_host
december2nd.ddns.net
- backup_dns_server
-
buffer_size
65538
-
build_time
2022-11-26T05:13:34.059050336Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
40111
-
default_group
mama
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
december2n.duckdns.org
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
apti.pifRegSvcs.exepid process 1660 apti.pif 1936 RegSvcs.exe -
Loads dropped DLL 2 IoCs
Processes:
wscript.exeapti.pifpid process 1072 wscript.exe 1660 apti.pif -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
apti.pifRegSvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run apti.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\blfd\\apti.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\blfd\\lxnknfa.xls" apti.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\blfd\\Update.vbs" apti.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Monitor = "C:\\Program Files (x86)\\UDP Monitor\\udpmon.exe" RegSvcs.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
apti.pifdescription pid process target process PID 1660 set thread context of 1936 1660 apti.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\UDP Monitor\udpmon.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\UDP Monitor\udpmon.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1436 schtasks.exe 1028 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegSvcs.exepid process 1936 RegSvcs.exe 1936 RegSvcs.exe 1936 RegSvcs.exe 1936 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1936 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1936 RegSvcs.exe Token: SeDebugPrivilege 1936 RegSvcs.exe Token: SeDebugPrivilege 1936 RegSvcs.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
b6a93bf2bc23112c54ccb654fce93f27.scr.exewscript.exeapti.pifRegSvcs.exedescription pid process target process PID 1696 wrote to memory of 1072 1696 b6a93bf2bc23112c54ccb654fce93f27.scr.exe wscript.exe PID 1696 wrote to memory of 1072 1696 b6a93bf2bc23112c54ccb654fce93f27.scr.exe wscript.exe PID 1696 wrote to memory of 1072 1696 b6a93bf2bc23112c54ccb654fce93f27.scr.exe wscript.exe PID 1696 wrote to memory of 1072 1696 b6a93bf2bc23112c54ccb654fce93f27.scr.exe wscript.exe PID 1072 wrote to memory of 1660 1072 wscript.exe apti.pif PID 1072 wrote to memory of 1660 1072 wscript.exe apti.pif PID 1072 wrote to memory of 1660 1072 wscript.exe apti.pif PID 1072 wrote to memory of 1660 1072 wscript.exe apti.pif PID 1072 wrote to memory of 1660 1072 wscript.exe apti.pif PID 1072 wrote to memory of 1660 1072 wscript.exe apti.pif PID 1072 wrote to memory of 1660 1072 wscript.exe apti.pif PID 1660 wrote to memory of 1936 1660 apti.pif RegSvcs.exe PID 1660 wrote to memory of 1936 1660 apti.pif RegSvcs.exe PID 1660 wrote to memory of 1936 1660 apti.pif RegSvcs.exe PID 1660 wrote to memory of 1936 1660 apti.pif RegSvcs.exe PID 1660 wrote to memory of 1936 1660 apti.pif RegSvcs.exe PID 1660 wrote to memory of 1936 1660 apti.pif RegSvcs.exe PID 1660 wrote to memory of 1936 1660 apti.pif RegSvcs.exe PID 1660 wrote to memory of 1936 1660 apti.pif RegSvcs.exe PID 1660 wrote to memory of 1936 1660 apti.pif RegSvcs.exe PID 1936 wrote to memory of 1436 1936 RegSvcs.exe schtasks.exe PID 1936 wrote to memory of 1436 1936 RegSvcs.exe schtasks.exe PID 1936 wrote to memory of 1436 1936 RegSvcs.exe schtasks.exe PID 1936 wrote to memory of 1436 1936 RegSvcs.exe schtasks.exe PID 1936 wrote to memory of 1028 1936 RegSvcs.exe schtasks.exe PID 1936 wrote to memory of 1028 1936 RegSvcs.exe schtasks.exe PID 1936 wrote to memory of 1028 1936 RegSvcs.exe schtasks.exe PID 1936 wrote to memory of 1028 1936 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6a93bf2bc23112c54ccb654fce93f27.scr.exe"C:\Users\Admin\AppData\Local\Temp\b6a93bf2bc23112c54ccb654fce93f27.scr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" Update-jl.f.vbe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\blfd\apti.pif"C:\Users\Admin\AppData\Local\Temp\blfd\apti.pif" lxnknfa.xls3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7179.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7300.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\blfd\apti.pifFilesize
1.1MB
MD506747aee777a9f5abe5e387f1affc067
SHA1c3c4d29f6bd978f9b4191bfda686934d4f53c0c9
SHA2566b520d92455c1d6f40037dea85bdde472c50ea500b79a0a9db78b7e3e5a346f1
SHA5129972ea56cb64a8cbda5f3226893b5e26a609dc7ab391946f581b6953fa4c1b51d79e74913c899469229afb43cc0caa1378056b29eda79fefdaafcca83e2bbfe5
-
C:\Users\Admin\AppData\Local\Temp\blfd\apti.pifFilesize
1.1MB
MD506747aee777a9f5abe5e387f1affc067
SHA1c3c4d29f6bd978f9b4191bfda686934d4f53c0c9
SHA2566b520d92455c1d6f40037dea85bdde472c50ea500b79a0a9db78b7e3e5a346f1
SHA5129972ea56cb64a8cbda5f3226893b5e26a609dc7ab391946f581b6953fa4c1b51d79e74913c899469229afb43cc0caa1378056b29eda79fefdaafcca83e2bbfe5
-
C:\Users\Admin\AppData\Local\Temp\blfd\lxnknfa.xlsFilesize
87.5MB
MD5220eef6469238dbe3db001b27260ac37
SHA12c722a3987008e3fe1b838995c6d8663fd7cf197
SHA256882cf974b5d908d066b8eb7f0751d8216841cb03334d314f561d663d94fbf331
SHA512cca1f744b9ca4a2f5512ce2b76bd9f6e56db611b7a81d4e3dcb2e52fec19a67d0092e6f9b316017bfe18c00667f6e311049174b8482dbe1e23dd3d34d2c7cb24
-
C:\Users\Admin\AppData\Local\Temp\blfd\omwtgeufq.mp3Filesize
37KB
MD5003b9e3ec540ce878ab97ab8eb4af3c4
SHA1ae7c72b19360db43066f500aa0c1fa64fbfa3912
SHA25617804fd5afd4987b0b81d56cb72c37150d88f1cb2eb0e41086e3160751aba74f
SHA51294aff604a2c1a2b6720d9cb73e3618b008abf56b3ff8ce0b505956630d1c8a2a18d4726372abda591340de823a641c3af7236e9e00a881f4f4049c6ab02ee9f9
-
C:\Users\Admin\AppData\Local\Temp\blfd\vgwpju.sbpFilesize
397KB
MD547a3760694424f080062061971c9e2ae
SHA1107b8682b9322ee4886ade154c88c3cfebd24ae9
SHA2562a454fbe70bedf8e9df6bb9172fd14b941b675a3465a80bc9b0fe20b499ef4ad
SHA51231d92fc367c857fa71598fbb3346f292da574855d013a7cab0b5715eac80a7e2b37d863c92dcdb3b1ef34fc6e3529630460c9b23ba22e3d41e4553c5f3a3e655
-
C:\Users\Admin\AppData\Local\Temp\tmp7179.tmpFilesize
1KB
MD595aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp7300.tmpFilesize
1KB
MD5179f6a368194b3d8490223f22126274b
SHA1cc2997c7fde3cfe0dcf267bf3b6338a7e2ecf2d0
SHA256cdfb59fb9dabcedf57f84d9b3ea596f6ce26f8c559b503b6980a42738cf2f4d8
SHA5128b1c1b2a8db227db2e741171c29e4bfcaad2919665cde77eb5b4058b45fe7c78b46e2ef1bc5b896aa0e172219c4a43b647d68b62db39c8f51ac0ed159e4f042b
-
C:\Users\Admin\AppData\Local\temp\blfd\Update-jl.f.vbeFilesize
64KB
MD52f16024e2e3bc934fb79e94ba356818f
SHA1450d6252826eaa9f6e5ec170ae3fa213261f16ae
SHA256a41afce0198df315a77eaac8a57b84097c5e48cab81438e804b91ddb09819d87
SHA5121e2bfd3d809913b3b5a3ce3b336e759683473dd6db4109200db0edcfe885aa930a99c4f016e2cad7930e1aa181e8ecc89abdec5e1ab8a29d1d5e019e83a41c78
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\blfd\apti.pifFilesize
1.1MB
MD506747aee777a9f5abe5e387f1affc067
SHA1c3c4d29f6bd978f9b4191bfda686934d4f53c0c9
SHA2566b520d92455c1d6f40037dea85bdde472c50ea500b79a0a9db78b7e3e5a346f1
SHA5129972ea56cb64a8cbda5f3226893b5e26a609dc7ab391946f581b6953fa4c1b51d79e74913c899469229afb43cc0caa1378056b29eda79fefdaafcca83e2bbfe5
-
memory/1936-115-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1936-138-0x0000000001110000-0x0000000001122000-memory.dmpFilesize
72KB
-
memory/1936-119-0x00000000002A0000-0x000000000093D000-memory.dmpFilesize
6.6MB
-
memory/1936-123-0x00000000002A0000-0x00000000002DA000-memory.dmpFilesize
232KB
-
memory/1936-116-0x00000000002A0000-0x000000000093D000-memory.dmpFilesize
6.6MB
-
memory/1936-128-0x0000000004DC0000-0x0000000004E00000-memory.dmpFilesize
256KB
-
memory/1936-114-0x00000000002A0000-0x000000000093D000-memory.dmpFilesize
6.6MB
-
memory/1936-132-0x0000000000A40000-0x0000000000A4A000-memory.dmpFilesize
40KB
-
memory/1936-133-0x0000000000A50000-0x0000000000A5C000-memory.dmpFilesize
48KB
-
memory/1936-134-0x0000000000AA0000-0x0000000000ABE000-memory.dmpFilesize
120KB
-
memory/1936-135-0x0000000000C00000-0x0000000000C0A000-memory.dmpFilesize
40KB
-
memory/1936-121-0x00000000002A0000-0x000000000093D000-memory.dmpFilesize
6.6MB
-
memory/1936-139-0x0000000002640000-0x000000000265A000-memory.dmpFilesize
104KB
-
memory/1936-140-0x0000000004DB0000-0x0000000004DBE000-memory.dmpFilesize
56KB
-
memory/1936-141-0x0000000004E50000-0x0000000004E62000-memory.dmpFilesize
72KB
-
memory/1936-142-0x0000000004E60000-0x0000000004E6E000-memory.dmpFilesize
56KB
-
memory/1936-143-0x0000000004EB0000-0x0000000004EBC000-memory.dmpFilesize
48KB
-
memory/1936-144-0x0000000004EC0000-0x0000000004ED4000-memory.dmpFilesize
80KB
-
memory/1936-145-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/1936-146-0x0000000005280000-0x0000000005294000-memory.dmpFilesize
80KB
-
memory/1936-147-0x00000000052A0000-0x00000000052AE000-memory.dmpFilesize
56KB
-
memory/1936-148-0x00000000053D0000-0x00000000053FE000-memory.dmpFilesize
184KB
-
memory/1936-149-0x0000000005400000-0x0000000005414000-memory.dmpFilesize
80KB
-
memory/1936-151-0x0000000004DC0000-0x0000000004E00000-memory.dmpFilesize
256KB