d1aa66a0994cf6071f9558b1a466f3122fc39a6cd1548c79702374c9d931a0c3 | Triage

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

nos.exe
Size

18KB
MD5

c763bf0b7d716116ba64fb78aef4af77
SHA1

f388dd5bb3007b93702c2c94187cca13d29535f1
SHA256

d1aa66a0994cf6071f9558b1a466f3122fc39a6cd1548c79702374c9d931a0c3
SHA512

1f7e44e8f9ee1616db65ac2cdfb881fb58ab63038dec208228436e7e09ed3bfe8e9dcb7bc8e699b9c051d641c7e5f67738f6daac5e3f9bdbec6c68f2e4456cab
SSDEEP

384:p3ZaAxPydXQHUGHJEV3ZH6IHsxCXAZIb3:pIWPvH1pIpHTHsxCQZU3

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2832 created 1372	2832	nos.exe	22

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2832	nos.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1884	2832	nos.exe	29
PID 2832 wrote to memory of 1884	2832	nos.exe	29
PID 2832 wrote to memory of 1884	2832	nos.exe	29
PID 2832 wrote to memory of 3056	2832	nos.exe	30
PID 2832 wrote to memory of 3056	2832	nos.exe	30
PID 2832 wrote to memory of 3056	2832	nos.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1372
- C:\Users\Admin\AppData\Local\Temp\nos.exe
  "C:\Users\Admin\AppData\Local\Temp\nos.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2832 -s 52
    3⤵
    PID:3056
- C:\Windows\system32\calc.exe
  calc.exe
  2⤵
  PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads