ac9fb718a06f5ea046a5ce765f84c202c08c45814bcd10c9e74de3dfc8301878

Analysis

max time kernel
155s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NostalgiaPaste.rar
Size

570KB
MD5

580fb25abdc9708233367ed8e44cca3a
SHA1

3928152088541452edde87b688e1955c6c4ef100
SHA256

ac9fb718a06f5ea046a5ce765f84c202c08c45814bcd10c9e74de3dfc8301878
SHA512

2bb828bc6b0cf883730d2ce87bcfe3763c8c374c74d0db6d11020315bcc37322c377d514dbe1ee0755885e1d4fbbb71001c80cd3ff1025edf75a4c1cecf55331
SSDEEP

12288:RpQYd+rE48vynhsyQuPLB55BeBM3dFO7Wbs2kQaBfunQZ:RpQYww48CrbFBey3cWw21aUnQZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2472	NostalgiaPaste.exe

Loads dropped DLL 2 IoCs

pid	Process
2472	NostalgiaPaste.exe
2472	NostalgiaPaste.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2472	NostalgiaPaste.exe
2472	NostalgiaPaste.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4896	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4896	7zFM.exe
Token: 35	4896	7zFM.exe
Token: SeSecurityPrivilege	4896	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4896	7zFM.exe
4896	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 4896	2300	cmd.exe	86
PID 2300 wrote to memory of 4896	2300	cmd.exe	86

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NostalgiaPaste.rar
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NostalgiaPaste.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4896

C:\Users\Admin\Desktop\NostalgiaPaste.exe
"C:\Users\Admin\Desktop\NostalgiaPaste.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\InjectionLibrary.dll

Filesize
78KB

MD5
64ef546a5a013f36524507e7dfc70d09

SHA1
d6d0aabdc88b7a875fd666a65194e250cd9ef3e5

SHA256
7919342e61f58303b1efe7bc3f2a612b717d64069c45eb53f0193218821d0016

SHA512
b409aaaf770bf0ca436e66279a324158845cba04ad892bbe98c0e32e96faacf83108d5e5b2b51efb59c8a3fccb4476303af47408f1a26bd79b18008ceaa7cc6b

Download Submit
C:\Users\Admin\Desktop\NostalgiaPaste.exe

Filesize
614KB

MD5
863ccaa8f5615fd603e3df9e08d433c6

SHA1
58e5ac27b4c8ce04b705fbd4fc267c7c96ae8438

SHA256
b502a581b8b5f291508791631fbd40853edc952572eaa214086f6a91694a284a

SHA512
715dccca665ffc88da761fc2ae0a9a01a477c3546b86fc0922ca033b4826f44b42c2c718b1adec2c26e9736e3e81c144ef5f5161706daa3acbabe8b0f952a906

Download Submit
memory/2472-6-0x0000000000BF0000-0x0000000000D40000-memory.dmp

Filesize
1.3MB

Download
memory/2472-7-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/2472-8-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/2472-9-0x00000000079E0000-0x00000000079F0000-memory.dmp

Filesize
64KB

Download
memory/2472-10-0x0000000008220000-0x00000000087C4000-memory.dmp

Filesize
5.6MB

Download
memory/2472-11-0x0000000007D50000-0x0000000007DE2000-memory.dmp

Filesize
584KB

Download
memory/2472-15-0x0000000007CE0000-0x0000000007CFC000-memory.dmp

Filesize
112KB

Download