Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
14/11/2023, 17:31
231114-v3qg7acf42 1014/11/2023, 17:21
231114-vxdw7sdg61 1028/10/2023, 19:29
231028-x7cs1age56 1024/10/2023, 13:29
231024-qrn3rsdb6z 1018/10/2023, 12:04
231018-n8ybnaeb31 1007/09/2023, 12:10
230907-pce1wahe2x 10Analysis
-
max time kernel
604s -
max time network
611s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
24/10/2023, 13:29
General
-
Target
784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112.exe
-
Size
1.7MB
-
MD5
61b26f24a7c056f8224f89d90204b3f7
-
SHA1
b2ea41a5457b1d0b7528288aa586449e448db235
-
SHA256
784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112
-
SHA512
99d9690741f0543e44f6acd26574d67e54139af92179e7455b4d3f0d1a0a75ff2205b6a8c512a1048eaacd65403cbbb742b59e0611acc11a9085b67b73be2e24
-
SSDEEP
49152:ih+ZkldoPKi2aFYv89an4TJ/jG3R8xve/RG0n:72cPKiSk97bG3R8xWR
Malware Config
Extracted
nanocore
1.2.2.0
185.244.30.114:2404
822e1333-5c33-4c42-9d46-9e51dfe00457
-
activate_away_mode
true
-
backup_connection_host
185.244.30.114
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-12-17T02:26:47.689583036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2404
-
default_group
1234
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
822e1333-5c33-4c42-9d46-9e51dfe00457
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.244.30.114
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112.exe"C:\Users\Admin\AppData\Local\Temp\784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
408KB