Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
7b1ad881708336e5b8153c12cc70de8f.exe
Resource
win7-20231215-en
General
-
Target
7b1ad881708336e5b8153c12cc70de8f.exe
-
Size
1.3MB
-
MD5
7b1ad881708336e5b8153c12cc70de8f
-
SHA1
b38424a8ab18b7b48aa028aa58b2a4c35306d76c
-
SHA256
01fdef2521090cced120589336b3c76f3129dc9498ae78c9daa180b586b6eef6
-
SHA512
16e256a1c6e2ec0daf14f4984e6813249f622203f93208863ed3ba54cf7bd411739fecda06be785c77eb4e476a94f46a4604591a8e9767c9fdc496179c924c59
-
SSDEEP
24576:QAzJ4xgYMNKipRUo0LTqvB0lkznUzz04GXq3/Vs892rm2nfk/0mA+S0d:LWxgRNKwbB0lkzSaXqPVsa2vfk/jZ
Malware Config
Extracted
nanocore
1.2.2.0
tzitziklishop.ddns.net:1665
76131181-f427-4fea-9060-b76d3b69a321
-
activate_away_mode
true
-
backup_connection_host
tzitziklishop.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-05-29T02:49:42.057419436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
AUGUST
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
76131181-f427-4fea-9060-b76d3b69a321
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tzitziklishop.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsvc.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1864 set thread context of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\TCP Service\tcpsvc.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\TCP Service\tcpsvc.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2388 schtasks.exe 2604 schtasks.exe 2900 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3004 RegSvcs.exe 3004 RegSvcs.exe 3004 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3004 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3004 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1864 wrote to memory of 2604 1864 7b1ad881708336e5b8153c12cc70de8f.exe 30 PID 1864 wrote to memory of 2604 1864 7b1ad881708336e5b8153c12cc70de8f.exe 30 PID 1864 wrote to memory of 2604 1864 7b1ad881708336e5b8153c12cc70de8f.exe 30 PID 1864 wrote to memory of 2604 1864 7b1ad881708336e5b8153c12cc70de8f.exe 30 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 1864 wrote to memory of 3004 1864 7b1ad881708336e5b8153c12cc70de8f.exe 32 PID 3004 wrote to memory of 2900 3004 RegSvcs.exe 33 PID 3004 wrote to memory of 2900 3004 RegSvcs.exe 33 PID 3004 wrote to memory of 2900 3004 RegSvcs.exe 33 PID 3004 wrote to memory of 2900 3004 RegSvcs.exe 33 PID 3004 wrote to memory of 2388 3004 RegSvcs.exe 35 PID 3004 wrote to memory of 2388 3004 RegSvcs.exe 35 PID 3004 wrote to memory of 2388 3004 RegSvcs.exe 35 PID 3004 wrote to memory of 2388 3004 RegSvcs.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b1ad881708336e5b8153c12cc70de8f.exe"C:\Users\Admin\AppData\Local\Temp\7b1ad881708336e5b8153c12cc70de8f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYSkDCU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp85A.tmp"2⤵
- Creates scheduled task(s)
PID:2604
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE62.tmp"3⤵
- Creates scheduled task(s)
PID:2900
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF4D.tmp"3⤵
- Creates scheduled task(s)
PID:2388
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD538e8dc2ce488f4f4f4a7402a5acf49e6
SHA157db86988e0ceb2691963dec3310fcb2d61e03d5
SHA256efc00ff0f3081e6cded28f5a19313cdb1c6f894a7132bc9bca65a549b85e8dbf
SHA5126c71449fd75ffc44584bb19dee8890338ed09dd26a02f347f4aaeb7040bda27693922c4a7e69c1d2b2ad4672e56b267d003eeb531670ce758107425d3a48945a
-
Filesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
Filesize
1KB
MD59db6095f31f8b4ae8173fe11424a8dfe
SHA14b0655ae95def24a41710ca137649d93bfa49407
SHA2569911b4513e44521c90c020ddcddea1ddc58095055a72ec638b593bf9ee23aa72
SHA5125bee977264545a30a2d53e674f54a4066d4529dc9162d46911b9cac957052cdc1ea7c8d60f9c57d3f33db6cb964b1e6bb2347d0e0e2af0a32ac98938c02ffc1c