Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-04-2023 13:46
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER LIST .xls.exe
Resource
win7-20230220-en
General
-
Target
NEW ORDER LIST .xls.exe
-
Size
668KB
-
MD5
7033ae8b4afbadb27abbd7b3b5bdb085
-
SHA1
5e15fd3f589d52c0b2c6e0e20e66c6b299646a59
-
SHA256
e92efa61a4ae7376c52f323abae88f5303a217b58966e4a71042fbebd0cba60a
-
SHA512
988da34cfd2cb7c8118d8dbf057bb65c1c895f24872443dca4b985c17dbbcae6efb974d7c76cb6db233cba393ee6e1eea35f0f056a54e6c1bfbf64832edbab97
-
SSDEEP
12288:6BX65Pf63JHFbaDoiJqLyl173SMn0XuEaWvvcCmyL/pheNQq8:6M563Lvyl17iM0Naqc4L7eNe
Malware Config
Extracted
nanocore
1.2.2.0
moonandbebe.ddns.net:6324
127.0.0.1:6324
9df60050-0f19-40b4-870c-3f0f73f35b3b
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
37.235.1.177
-
buffer_size
65535
-
build_time
2023-01-18T15:29:22.483592836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6324
-
default_group
moonandbebe
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9df60050-0f19-40b4-870c-3f0f73f35b3b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
moonandbebe.ddns.net
-
primary_dns_server
37.235.1.174
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 37.235.1.174 Destination IP 37.235.1.177 Destination IP 37.235.1.177 Destination IP 37.235.1.174 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEW ORDER LIST .xls.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisv.exe" NEW ORDER LIST .xls.exe -
Processes:
NEW ORDER LIST .xls.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NEW ORDER LIST .xls.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW ORDER LIST .xls.exedescription pid process target process PID 336 set thread context of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe -
Drops file in Program Files directory 2 IoCs
Processes:
NEW ORDER LIST .xls.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisv.exe NEW ORDER LIST .xls.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisv.exe NEW ORDER LIST .xls.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
NEW ORDER LIST .xls.exepowershell.exeNEW ORDER LIST .xls.exepid process 336 NEW ORDER LIST .xls.exe 336 NEW ORDER LIST .xls.exe 336 NEW ORDER LIST .xls.exe 336 NEW ORDER LIST .xls.exe 336 NEW ORDER LIST .xls.exe 336 NEW ORDER LIST .xls.exe 904 powershell.exe 1352 NEW ORDER LIST .xls.exe 1352 NEW ORDER LIST .xls.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
NEW ORDER LIST .xls.exepid process 1352 NEW ORDER LIST .xls.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
NEW ORDER LIST .xls.exepowershell.exeNEW ORDER LIST .xls.exedescription pid process Token: SeDebugPrivilege 336 NEW ORDER LIST .xls.exe Token: SeDebugPrivilege 904 powershell.exe Token: SeDebugPrivilege 1352 NEW ORDER LIST .xls.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
NEW ORDER LIST .xls.exedescription pid process target process PID 336 wrote to memory of 904 336 NEW ORDER LIST .xls.exe powershell.exe PID 336 wrote to memory of 904 336 NEW ORDER LIST .xls.exe powershell.exe PID 336 wrote to memory of 904 336 NEW ORDER LIST .xls.exe powershell.exe PID 336 wrote to memory of 904 336 NEW ORDER LIST .xls.exe powershell.exe PID 336 wrote to memory of 752 336 NEW ORDER LIST .xls.exe schtasks.exe PID 336 wrote to memory of 752 336 NEW ORDER LIST .xls.exe schtasks.exe PID 336 wrote to memory of 752 336 NEW ORDER LIST .xls.exe schtasks.exe PID 336 wrote to memory of 752 336 NEW ORDER LIST .xls.exe schtasks.exe PID 336 wrote to memory of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 336 wrote to memory of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 336 wrote to memory of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 336 wrote to memory of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 336 wrote to memory of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 336 wrote to memory of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 336 wrote to memory of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 336 wrote to memory of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 336 wrote to memory of 1352 336 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER LIST .xls.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER LIST .xls.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XhqvcLIDz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XhqvcLIDz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE080.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER LIST .xls.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER LIST .xls.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE080.tmpFilesize
1KB
MD5e009f00a992283371eff33380f0462ee
SHA17b65b3e2d3630ab6705d0a12c1a90b8d9e787a24
SHA25642173baf5368b8bb0c224fbb36bb4cb1039b879e04bc8e21921372c57bf4c929
SHA5125cf4cbcfd976d6d07c6f03199e67232f2900de29935222a010c63c833baca72919b5dd1245781c5489fbea802b88a914bbd97107b588fa57a10bd8206c1747cf
-
memory/336-54-0x0000000000BE0000-0x0000000000C8E000-memory.dmpFilesize
696KB
-
memory/336-55-0x0000000004CE0000-0x0000000004D20000-memory.dmpFilesize
256KB
-
memory/336-56-0x0000000000290000-0x000000000029C000-memory.dmpFilesize
48KB
-
memory/336-57-0x0000000004CE0000-0x0000000004D20000-memory.dmpFilesize
256KB
-
memory/336-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/336-59-0x0000000005150000-0x00000000051C4000-memory.dmpFilesize
464KB
-
memory/336-67-0x0000000004B60000-0x0000000004B9C000-memory.dmpFilesize
240KB
-
memory/904-85-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/904-78-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/1352-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1352-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1352-73-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1352-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1352-75-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1352-77-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1352-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1352-81-0x0000000000500000-0x000000000050A000-memory.dmpFilesize
40KB
-
memory/1352-82-0x0000000000510000-0x000000000052E000-memory.dmpFilesize
120KB
-
memory/1352-83-0x0000000000530000-0x000000000053A000-memory.dmpFilesize
40KB
-
memory/1352-84-0x0000000004E60000-0x0000000004EA0000-memory.dmpFilesize
256KB
-
memory/1352-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB