Analysis

  • max time kernel
    119s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 10:23

General

  • Target

    abb84f7bbcc5585765153cd445c8c07d.exe

  • Size

    1.1MB

  • MD5

    abb84f7bbcc5585765153cd445c8c07d

  • SHA1

    69707e556ebd88aec6414c0c5a481b235ad2eead

  • SHA256

    149e9d049c83abff4843e0fab7f6cde552aef61e32a53d61e76f6c5adc3db25f

  • SHA512

    12752cdde51c29b3fb4afc16405881681f06e3f4abc8b4912c35f366af6d2bc84ae321110a6ee11f1b8d0ab557975c9892ca0977b149c59f24735c0076d33a38

  • SSDEEP

    12288:TGPoV34JStlA/afwCtrduIyCuUy21lbyOuJOmBws5o8pewY3:T0uqipuIySjQes5oSel

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe
    "C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe
      "C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe"
      2⤵
      • Executes dropped EXE
      PID:2452
    • C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\system32\schtasks.exe
        "schtasks.exe" /create /f /tn "LAN Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9425.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2584
      • C:\Windows\system32\schtasks.exe
        "schtasks.exe" /create /f /tn "LAN Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9628.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2940

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe

          Filesize

          533KB

          MD5

          a632a39ffdce2f2de984c6992d188986

          SHA1

          7a1bb8fea06c819b7e575f9ef431af09151837eb

          SHA256

          6800905847788c228e211fd1086dad6a20aa745d1351c0bd43d5f89aa58b1c9e

          SHA512

          a7a6f0bc2448f3222652882893c9b14e21f073dce0dc0509c534bd0e1219a8860278be485a1b41333f7b9dc969431aacd54701f4ca7eb9d615ffdf192452244b

        • C:\Users\Admin\AppData\Local\Temp\tmp9425.tmp

          Filesize

          1KB

          MD5

          03622b0c91662ec4ada74d25f655232f

          SHA1

          7272a7d3acd8726fa58987ad322fa06ce7a23208

          SHA256

          68a618959190a38c260d20dde35209ed7c8f8ef336c8f6af4abdf416ea2e8b67

          SHA512

          6d6ddb25cf1a0793bcea2ce25e866db318400eef864c1608441c529ab094be604c9e98264219c933a2187ec63abc77124edddeb324744999872d150ce7e73dd2

        • C:\Users\Admin\AppData\Local\Temp\tmp9628.tmp

          Filesize

          1KB

          MD5

          5ed3301e36e3359905df2c1d8fee55f9

          SHA1

          87f3dd865a35a183a95b70670837aff59acab4c1

          SHA256

          b6b1ccf23addd989edab37c3c63997814126559be20653e5b219bfcb0afef0f8

          SHA512

          5b2eaa5ad2f0cedb509b459407e0260bee6760cca7ca04f62afad6d5b2ae7dbdd19a443012e7d71476f5f6433a72d6c4b111580b7b592010c1e966155cd828a4

        • \Users\Admin\AppData\Local\Temp\Tayz Woofer.exe

          Filesize

          567KB

          MD5

          8a172477569fd0f1b554ecaa42a59d9d

          SHA1

          58adf1c1f27215d13e280364c15008df293d90fb

          SHA256

          391915fb3b7aa3df83c7d95c0867e3d24ee8906e657344666bbd87ea4e61a82a

          SHA512

          8aae52a6af70795cc938a7ad107bfa2ab383ea2f8f86777ac2084eba0bbac6175bbe432569a8706541122b9dc417748f5fe54e829ddd77be0b7a6b5c26999a85

        • memory/2100-5-0x00000000027E0000-0x0000000002883000-memory.dmp

          Filesize

          652KB

        • memory/2452-7-0x000000013F220000-0x000000013F2C3000-memory.dmp

          Filesize

          652KB

        • memory/2452-46-0x000000013F220000-0x000000013F2C3000-memory.dmp

          Filesize

          652KB

        • memory/2684-34-0x00000000007B0000-0x00000000007BE000-memory.dmp

          Filesize

          56KB

        • memory/2684-38-0x0000000002280000-0x0000000002294000-memory.dmp

          Filesize

          80KB

        • memory/2684-19-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2684-29-0x00000000004C0000-0x0000000000540000-memory.dmp

          Filesize

          512KB

        • memory/2684-28-0x00000000005A0000-0x00000000005AA000-memory.dmp

          Filesize

          40KB

        • memory/2684-30-0x00000000004C0000-0x0000000000540000-memory.dmp

          Filesize

          512KB

        • memory/2684-31-0x00000000003A0000-0x00000000003B2000-memory.dmp

          Filesize

          72KB

        • memory/2684-32-0x0000000000790000-0x00000000007AA000-memory.dmp

          Filesize

          104KB

        • memory/2684-33-0x0000000000490000-0x000000000049E000-memory.dmp

          Filesize

          56KB

        • memory/2684-18-0x00000000004C0000-0x0000000000540000-memory.dmp

          Filesize

          512KB

        • memory/2684-35-0x00000000007C0000-0x00000000007CC000-memory.dmp

          Filesize

          48KB

        • memory/2684-36-0x00000000007D0000-0x00000000007E4000-memory.dmp

          Filesize

          80KB

        • memory/2684-37-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

          Filesize

          64KB

        • memory/2684-20-0x00000000004C0000-0x0000000000540000-memory.dmp

          Filesize

          512KB

        • memory/2684-39-0x0000000002290000-0x000000000229E000-memory.dmp

          Filesize

          56KB

        • memory/2684-40-0x00000000022A0000-0x00000000022BE000-memory.dmp

          Filesize

          120KB

        • memory/2684-41-0x00000000003B0000-0x00000000003BA000-memory.dmp

          Filesize

          40KB

        • memory/2684-43-0x000000001C1A0000-0x000000001C2A0000-memory.dmp

          Filesize

          1024KB

        • memory/2684-42-0x00000000022C0000-0x00000000022EE000-memory.dmp

          Filesize

          184KB

        • memory/2684-44-0x00000000022F0000-0x0000000002304000-memory.dmp

          Filesize

          80KB

        • memory/2684-17-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2684-48-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2684-49-0x00000000004C0000-0x0000000000540000-memory.dmp

          Filesize

          512KB

        • memory/2684-50-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2684-51-0x000000001C1A0000-0x000000001C2A0000-memory.dmp

          Filesize

          1024KB

        • memory/2684-52-0x000000001C1A0000-0x000000001C2A0000-memory.dmp

          Filesize

          1024KB