Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
7a40d67c8a78ef63bda595ab16f5ac0f.exe
Resource
win7-20231215-en
General
-
Target
7a40d67c8a78ef63bda595ab16f5ac0f.exe
-
Size
1.5MB
-
MD5
7a40d67c8a78ef63bda595ab16f5ac0f
-
SHA1
3a4636fdee0797e1dfa0c5075cb0466c9ea00f84
-
SHA256
e2baf0f5b01a92323fa0f46207e5b9ae09ec8945ef722b912d3559d43c6e907c
-
SHA512
c448e227eb2244a62e7457823ad471da15a42ceb49e47f9cf148dceaafea95f7d2edca544dc900c4bf53411c94e4a59d393e861767a2fe569a04de707c2fe6bb
-
SSDEEP
12288:KsJG6kBgpx60IbcNk+uVD7TgUdnfQu5X7Q6H+Uy1Susr8MmH3j2:M6k2n64EPVY1ZZS5R0
Malware Config
Extracted
nanocore
1.2.2.0
fablousy.kozow.com:4050
127.0.0.1:4050
58d1d627-4bc2-40ea-9ed5-7063fbcc1866
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-05-17T05:23:14.334950536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4050
-
default_group
ike
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
58d1d627-4bc2-40ea-9ed5-7063fbcc1866
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
fablousy.kozow.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 7a40d67c8a78ef63bda595ab16f5ac0f.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7a40d67c8a78ef63bda595ab16f5ac0f.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4944 set thread context of 3988 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2020 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 3988 7a40d67c8a78ef63bda595ab16f5ac0f.exe 3988 7a40d67c8a78ef63bda595ab16f5ac0f.exe 3988 7a40d67c8a78ef63bda595ab16f5ac0f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3988 7a40d67c8a78ef63bda595ab16f5ac0f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe Token: SeDebugPrivilege 3988 7a40d67c8a78ef63bda595ab16f5ac0f.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4944 wrote to memory of 2020 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 97 PID 4944 wrote to memory of 2020 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 97 PID 4944 wrote to memory of 2020 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 97 PID 4944 wrote to memory of 4668 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 99 PID 4944 wrote to memory of 4668 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 99 PID 4944 wrote to memory of 4668 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 99 PID 4944 wrote to memory of 3380 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 100 PID 4944 wrote to memory of 3380 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 100 PID 4944 wrote to memory of 3380 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 100 PID 4944 wrote to memory of 3988 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 101 PID 4944 wrote to memory of 3988 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 101 PID 4944 wrote to memory of 3988 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 101 PID 4944 wrote to memory of 3988 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 101 PID 4944 wrote to memory of 3988 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 101 PID 4944 wrote to memory of 3988 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 101 PID 4944 wrote to memory of 3988 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 101 PID 4944 wrote to memory of 3988 4944 7a40d67c8a78ef63bda595ab16f5ac0f.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a40d67c8a78ef63bda595ab16f5ac0f.exe"C:\Users\Admin\AppData\Local\Temp\7a40d67c8a78ef63bda595ab16f5ac0f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uTptUfOsJI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3BDB.tmp"2⤵
- Creates scheduled task(s)
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\7a40d67c8a78ef63bda595ab16f5ac0f.exe"C:\Users\Admin\AppData\Local\Temp\7a40d67c8a78ef63bda595ab16f5ac0f.exe"2⤵PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\7a40d67c8a78ef63bda595ab16f5ac0f.exe"C:\Users\Admin\AppData\Local\Temp\7a40d67c8a78ef63bda595ab16f5ac0f.exe"2⤵PID:3380
-
-
C:\Users\Admin\AppData\Local\Temp\7a40d67c8a78ef63bda595ab16f5ac0f.exe"C:\Users\Admin\AppData\Local\Temp\7a40d67c8a78ef63bda595ab16f5ac0f.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7a40d67c8a78ef63bda595ab16f5ac0f.exe.log
Filesize1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
1KB
MD5a8312b3e81ba60ee5a4987159b88c157
SHA14bcefaa659645a2b92c7d5c23a81b9120090fc9c
SHA256eb59fd50309022602a46f5c798a49ae6fbc88935e639bc91b6f5bb479ab4be2f
SHA51274b5c4d8dc1bdeb33e9323794f92b366204efbdd9f9110cdffa022f4600a3e7cfa87102fda87cd836c3c09b4b7272d0ae9ea0d63cb58842970b597def6a4f547