Analysis

  • max time kernel
    148s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 10:21

General

  • Target

    abb84f7bbcc5585765153cd445c8c07d.exe

  • Size

    1.1MB

  • MD5

    abb84f7bbcc5585765153cd445c8c07d

  • SHA1

    69707e556ebd88aec6414c0c5a481b235ad2eead

  • SHA256

    149e9d049c83abff4843e0fab7f6cde552aef61e32a53d61e76f6c5adc3db25f

  • SHA512

    12752cdde51c29b3fb4afc16405881681f06e3f4abc8b4912c35f366af6d2bc84ae321110a6ee11f1b8d0ab557975c9892ca0977b149c59f24735c0076d33a38

  • SSDEEP

    12288:TGPoV34JStlA/afwCtrduIyCuUy21lbyOuJOmBws5o8pewY3:T0uqipuIySjQes5oSel

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe
    "C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe
      "C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe"
      2⤵
      • Executes dropped EXE
      PID:1244
    • C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /create /f /tn "DHCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8812.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:4860
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /create /f /tn "DHCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8F56.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:4108

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe

          Filesize

          533KB

          MD5

          a632a39ffdce2f2de984c6992d188986

          SHA1

          7a1bb8fea06c819b7e575f9ef431af09151837eb

          SHA256

          6800905847788c228e211fd1086dad6a20aa745d1351c0bd43d5f89aa58b1c9e

          SHA512

          a7a6f0bc2448f3222652882893c9b14e21f073dce0dc0509c534bd0e1219a8860278be485a1b41333f7b9dc969431aacd54701f4ca7eb9d615ffdf192452244b

        • C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe

          Filesize

          567KB

          MD5

          8a172477569fd0f1b554ecaa42a59d9d

          SHA1

          58adf1c1f27215d13e280364c15008df293d90fb

          SHA256

          391915fb3b7aa3df83c7d95c0867e3d24ee8906e657344666bbd87ea4e61a82a

          SHA512

          8aae52a6af70795cc938a7ad107bfa2ab383ea2f8f86777ac2084eba0bbac6175bbe432569a8706541122b9dc417748f5fe54e829ddd77be0b7a6b5c26999a85

        • C:\Users\Admin\AppData\Local\Temp\tmp8812.tmp

          Filesize

          1KB

          MD5

          03622b0c91662ec4ada74d25f655232f

          SHA1

          7272a7d3acd8726fa58987ad322fa06ce7a23208

          SHA256

          68a618959190a38c260d20dde35209ed7c8f8ef336c8f6af4abdf416ea2e8b67

          SHA512

          6d6ddb25cf1a0793bcea2ce25e866db318400eef864c1608441c529ab094be604c9e98264219c933a2187ec63abc77124edddeb324744999872d150ce7e73dd2

        • C:\Users\Admin\AppData\Local\Temp\tmp8F56.tmp

          Filesize

          1KB

          MD5

          a1e72d32044df2250a28d62375b19f15

          SHA1

          f82e0131f1a1fcbf825544cd2cc25e28174c47ee

          SHA256

          b3e2fff6289e337bc83c056904dad620e5edc7f28ac3690ab4900f3ec90df799

          SHA512

          df04c1f421c3d2ed3c928e388aa068be0c3b1bd16348f2692a63c641ec6cd3b103525a8e39298566a395f863fc23a3e29cf2ae50f3e68b5ffba981241587a88b

        • memory/1244-21-0x00007FF75B220000-0x00007FF75B2C3000-memory.dmp

          Filesize

          652KB

        • memory/1244-10-0x00007FF75B220000-0x00007FF75B2C3000-memory.dmp

          Filesize

          652KB

        • memory/3832-39-0x000000001C190000-0x000000001C1A2000-memory.dmp

          Filesize

          72KB

        • memory/3832-42-0x000000001CC70000-0x000000001CC7E000-memory.dmp

          Filesize

          56KB

        • memory/3832-22-0x000000001BD90000-0x000000001BE2C000-memory.dmp

          Filesize

          624KB

        • memory/3832-23-0x000000001BFE0000-0x000000001C086000-memory.dmp

          Filesize

          664KB

        • memory/3832-24-0x00007FF9B62C0000-0x00007FF9B6C61000-memory.dmp

          Filesize

          9.6MB

        • memory/3832-25-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

          Filesize

          32KB

        • memory/3832-26-0x00007FF9B62C0000-0x00007FF9B6C61000-memory.dmp

          Filesize

          9.6MB

        • memory/3832-27-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

          Filesize

          64KB

        • memory/3832-28-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

          Filesize

          64KB

        • memory/3832-19-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

          Filesize

          64KB

        • memory/3832-18-0x00007FF9B62C0000-0x00007FF9B6C61000-memory.dmp

          Filesize

          9.6MB

        • memory/3832-36-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

          Filesize

          64KB

        • memory/3832-37-0x000000001C260000-0x000000001C360000-memory.dmp

          Filesize

          1024KB

        • memory/3832-38-0x000000001C940000-0x000000001C94A000-memory.dmp

          Filesize

          40KB

        • memory/3832-17-0x00007FF9B62C0000-0x00007FF9B6C61000-memory.dmp

          Filesize

          9.6MB

        • memory/3832-40-0x000000001CC50000-0x000000001CC6A000-memory.dmp

          Filesize

          104KB

        • memory/3832-41-0x000000001C8D0000-0x000000001C8DE000-memory.dmp

          Filesize

          56KB

        • memory/3832-20-0x000000001B8C0000-0x000000001BD8E000-memory.dmp

          Filesize

          4.8MB

        • memory/3832-43-0x000000001CC80000-0x000000001CC8C000-memory.dmp

          Filesize

          48KB

        • memory/3832-44-0x000000001CC90000-0x000000001CCA4000-memory.dmp

          Filesize

          80KB

        • memory/3832-45-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

          Filesize

          64KB

        • memory/3832-46-0x0000000000DD0000-0x0000000000DE4000-memory.dmp

          Filesize

          80KB

        • memory/3832-47-0x000000001B3D0000-0x000000001B3DE000-memory.dmp

          Filesize

          56KB

        • memory/3832-48-0x000000001CCA0000-0x000000001CCBE000-memory.dmp

          Filesize

          120KB

        • memory/3832-49-0x000000001CCF0000-0x000000001CCFA000-memory.dmp

          Filesize

          40KB

        • memory/3832-50-0x000000001CD00000-0x000000001CD2E000-memory.dmp

          Filesize

          184KB

        • memory/3832-52-0x000000001CCE0000-0x000000001CCF4000-memory.dmp

          Filesize

          80KB

        • memory/3832-51-0x000000001C260000-0x000000001C360000-memory.dmp

          Filesize

          1024KB

        • memory/3832-53-0x000000001C260000-0x000000001C360000-memory.dmp

          Filesize

          1024KB

        • memory/3832-54-0x000000001C260000-0x000000001C360000-memory.dmp

          Filesize

          1024KB

        • memory/3832-56-0x000000001DC10000-0x000000001DC72000-memory.dmp

          Filesize

          392KB

        • memory/3832-57-0x000000001C260000-0x000000001C360000-memory.dmp

          Filesize

          1024KB

        • memory/3832-59-0x000000001C260000-0x000000001C360000-memory.dmp

          Filesize

          1024KB

        • memory/3832-60-0x000000001C260000-0x000000001C360000-memory.dmp

          Filesize

          1024KB

        • memory/3832-61-0x000000001C260000-0x000000001C360000-memory.dmp

          Filesize

          1024KB