Analysis
-
max time kernel
98s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2024 04:04
Static task
static1
Behavioral task
behavioral1
Sample
76563f561fd009f9ec176320657feafa.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
76563f561fd009f9ec176320657feafa.exe
Resource
win10v2004-20231222-en
General
-
Target
76563f561fd009f9ec176320657feafa.exe
-
Size
1.5MB
-
MD5
76563f561fd009f9ec176320657feafa
-
SHA1
2f962b8a65165945c3582a49d9a410537abbc964
-
SHA256
92fc50fbd75a13621c3d64e1ded8617c4c9f92072010f0735d050c06ba73d995
-
SHA512
91f6dbf03f60382bdb6e3a2acb9d9b3e985abd23e2d74b1dff1b4a4c487791e7d7c068a85804e92eb67cfaecb4c33da8dbcf953c7f39204e819f1a71e9e3072e
-
SSDEEP
24576:PKaLfALjE7E29i/dB2MJwdLN+93CyfFrwb3RtD5VwlngfdqcKn:jLfALjufc/6yIh2SyfNwbhtD5+lnW6n
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
76563f561fd009f9ec176320657feafa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 76563f561fd009f9ec176320657feafa.exe -
Processes:
resource yara_rule behavioral2/memory/2760-6-0x0000000001360000-0x0000000001744000-memory.dmp upx behavioral2/memory/2760-7-0x0000000001360000-0x0000000001744000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
76563f561fd009f9ec176320657feafa.exedescription pid process target process PID 2184 set thread context of 2760 2184 76563f561fd009f9ec176320657feafa.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2132 2760 WerFault.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
76563f561fd009f9ec176320657feafa.exedescription pid process Token: SeDebugPrivilege 2184 76563f561fd009f9ec176320657feafa.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
76563f561fd009f9ec176320657feafa.execmd.exedescription pid process target process PID 2184 wrote to memory of 4076 2184 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2184 wrote to memory of 4076 2184 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2184 wrote to memory of 4076 2184 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2184 wrote to memory of 2760 2184 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2184 wrote to memory of 2760 2184 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2184 wrote to memory of 2760 2184 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2184 wrote to memory of 2760 2184 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2184 wrote to memory of 2760 2184 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2184 wrote to memory of 2760 2184 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2184 wrote to memory of 2760 2184 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2184 wrote to memory of 4624 2184 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2184 wrote to memory of 4624 2184 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2184 wrote to memory of 4624 2184 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2184 wrote to memory of 1840 2184 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2184 wrote to memory of 1840 2184 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2184 wrote to memory of 1840 2184 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 4624 wrote to memory of 2588 4624 cmd.exe schtasks.exe PID 4624 wrote to memory of 2588 4624 cmd.exe schtasks.exe PID 4624 wrote to memory of 2588 4624 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76563f561fd009f9ec176320657feafa.exe"C:\Users\Admin\AppData\Local\Temp\76563f561fd009f9ec176320657feafa.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\as/poi\as/poi.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\as/poi\as/poi.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\76563f561fd009f9ec176320657feafa.exe" "C:\Users\Admin\AppData\Roaming\as/poi\as/poi.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2760 -ip 27601⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2184-1-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2184-0-0x00000000005C0000-0x0000000000748000-memory.dmpFilesize
1.5MB
-
memory/2184-2-0x00000000056B0000-0x0000000005C54000-memory.dmpFilesize
5.6MB
-
memory/2184-3-0x00000000051A0000-0x0000000005232000-memory.dmpFilesize
584KB
-
memory/2184-4-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2184-5-0x0000000005580000-0x000000000558A000-memory.dmpFilesize
40KB
-
memory/2184-8-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2184-9-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2184-11-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2760-6-0x0000000001360000-0x0000000001744000-memory.dmpFilesize
3.9MB
-
memory/2760-7-0x0000000001360000-0x0000000001744000-memory.dmpFilesize
3.9MB