Analysis
-
max time kernel
146s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 02:31
Static task
static1
Behavioral task
behavioral1
Sample
790b9e9961e4b8ca5171d422239e0541.exe
Resource
win7-20231215-en
General
-
Target
790b9e9961e4b8ca5171d422239e0541.exe
-
Size
1.0MB
-
MD5
790b9e9961e4b8ca5171d422239e0541
-
SHA1
28b6a1a0f3d823c2626d35607a58f19520f48df8
-
SHA256
b1eeeb094d51c8f5f2931b00533cb5a0dfb98cf310ea06580c7967976d215b3b
-
SHA512
bdb23c43c65dbaad81426ffb00abbe71b4e2e9ca57219f16c83724e490e2abd5c860d78536b68735f882b861f0ee7b7943dacf0308c69a60f90a33cb51809012
-
SSDEEP
24576:08pod6qMyQ7RLRUlL/HbDL0PoJH4T2fXBxV:flAL/7DQSH4T2/BT
Malware Config
Extracted
nanocore
1.2.2.0
194.5.98.28:3040
127.0.0.1:3040
eed6a097-a4d3-4ab0-9875-46a22fdaf6ba
-
activate_away_mode
false
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-05-18T10:55:38.959783136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3040
-
default_group
AUGUST 08/06/2021
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
eed6a097-a4d3-4ab0-9875-46a22fdaf6ba
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
194.5.98.28
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 790b9e9961e4b8ca5171d422239e0541.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2500 set thread context of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2588 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2500 790b9e9961e4b8ca5171d422239e0541.exe 2500 790b9e9961e4b8ca5171d422239e0541.exe 2160 790b9e9961e4b8ca5171d422239e0541.exe 2160 790b9e9961e4b8ca5171d422239e0541.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2160 790b9e9961e4b8ca5171d422239e0541.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2500 790b9e9961e4b8ca5171d422239e0541.exe Token: SeDebugPrivilege 2160 790b9e9961e4b8ca5171d422239e0541.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2588 2500 790b9e9961e4b8ca5171d422239e0541.exe 30 PID 2500 wrote to memory of 2588 2500 790b9e9961e4b8ca5171d422239e0541.exe 30 PID 2500 wrote to memory of 2588 2500 790b9e9961e4b8ca5171d422239e0541.exe 30 PID 2500 wrote to memory of 2588 2500 790b9e9961e4b8ca5171d422239e0541.exe 30 PID 2500 wrote to memory of 2664 2500 790b9e9961e4b8ca5171d422239e0541.exe 32 PID 2500 wrote to memory of 2664 2500 790b9e9961e4b8ca5171d422239e0541.exe 32 PID 2500 wrote to memory of 2664 2500 790b9e9961e4b8ca5171d422239e0541.exe 32 PID 2500 wrote to memory of 2664 2500 790b9e9961e4b8ca5171d422239e0541.exe 32 PID 2500 wrote to memory of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33 PID 2500 wrote to memory of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33 PID 2500 wrote to memory of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33 PID 2500 wrote to memory of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33 PID 2500 wrote to memory of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33 PID 2500 wrote to memory of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33 PID 2500 wrote to memory of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33 PID 2500 wrote to memory of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33 PID 2500 wrote to memory of 2160 2500 790b9e9961e4b8ca5171d422239e0541.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\790b9e9961e4b8ca5171d422239e0541.exe"C:\Users\Admin\AppData\Local\Temp\790b9e9961e4b8ca5171d422239e0541.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sRwOrsHsaniq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEE26.tmp"2⤵
- Creates scheduled task(s)
PID:2588
-
-
C:\Users\Admin\AppData\Local\Temp\790b9e9961e4b8ca5171d422239e0541.exe"C:\Users\Admin\AppData\Local\Temp\790b9e9961e4b8ca5171d422239e0541.exe"2⤵PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\790b9e9961e4b8ca5171d422239e0541.exe"C:\Users\Admin\AppData\Local\Temp\790b9e9961e4b8ca5171d422239e0541.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50f2408529a379d4126cc0c6bf4e637cc
SHA1e5b872e57cdafb8ae664544c37956c8032d97ad5
SHA2564335c2a04042be06de88eacc9a7a8b055d404b20e51444c44e212564cc2b687c
SHA512355a2173a3f65ec81b25cab89dd75700defaf1ab794fd405eab3f07ef3b2bc77d61b7ad8863dd79d8387d68846eceeef05d114dbf24e809a2bfe57f8bca4ba2e