Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
7b1ad881708336e5b8153c12cc70de8f.exe
Resource
win7-20231215-en
General
-
Target
7b1ad881708336e5b8153c12cc70de8f.exe
-
Size
1.3MB
-
MD5
7b1ad881708336e5b8153c12cc70de8f
-
SHA1
b38424a8ab18b7b48aa028aa58b2a4c35306d76c
-
SHA256
01fdef2521090cced120589336b3c76f3129dc9498ae78c9daa180b586b6eef6
-
SHA512
16e256a1c6e2ec0daf14f4984e6813249f622203f93208863ed3ba54cf7bd411739fecda06be785c77eb4e476a94f46a4604591a8e9767c9fdc496179c924c59
-
SSDEEP
24576:QAzJ4xgYMNKipRUo0LTqvB0lkznUzz04GXq3/Vs892rm2nfk/0mA+S0d:LWxgRNKwbB0lkzSaXqPVsa2vfk/jZ
Malware Config
Extracted
nanocore
1.2.2.0
tzitziklishop.ddns.net:1665
76131181-f427-4fea-9060-b76d3b69a321
-
activate_away_mode
true
-
backup_connection_host
tzitziklishop.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-05-29T02:49:42.057419436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
AUGUST
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
76131181-f427-4fea-9060-b76d3b69a321
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tzitziklishop.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 7b1ad881708336e5b8153c12cc70de8f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4908 set thread context of 1300 4908 7b1ad881708336e5b8153c12cc70de8f.exe 101 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\DDP Service\ddpsv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3792 schtasks.exe 656 schtasks.exe 496 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4908 7b1ad881708336e5b8153c12cc70de8f.exe 4908 7b1ad881708336e5b8153c12cc70de8f.exe 4908 7b1ad881708336e5b8153c12cc70de8f.exe 4908 7b1ad881708336e5b8153c12cc70de8f.exe 4908 7b1ad881708336e5b8153c12cc70de8f.exe 1300 RegSvcs.exe 1300 RegSvcs.exe 1300 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1300 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4908 7b1ad881708336e5b8153c12cc70de8f.exe Token: SeDebugPrivilege 1300 RegSvcs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4908 wrote to memory of 3792 4908 7b1ad881708336e5b8153c12cc70de8f.exe 97 PID 4908 wrote to memory of 3792 4908 7b1ad881708336e5b8153c12cc70de8f.exe 97 PID 4908 wrote to memory of 3792 4908 7b1ad881708336e5b8153c12cc70de8f.exe 97 PID 4908 wrote to memory of 1508 4908 7b1ad881708336e5b8153c12cc70de8f.exe 99 PID 4908 wrote to memory of 1508 4908 7b1ad881708336e5b8153c12cc70de8f.exe 99 PID 4908 wrote to memory of 1508 4908 7b1ad881708336e5b8153c12cc70de8f.exe 99 PID 4908 wrote to memory of 4568 4908 7b1ad881708336e5b8153c12cc70de8f.exe 100 PID 4908 wrote to memory of 4568 4908 7b1ad881708336e5b8153c12cc70de8f.exe 100 PID 4908 wrote to memory of 4568 4908 7b1ad881708336e5b8153c12cc70de8f.exe 100 PID 4908 wrote to memory of 1300 4908 7b1ad881708336e5b8153c12cc70de8f.exe 101 PID 4908 wrote to memory of 1300 4908 7b1ad881708336e5b8153c12cc70de8f.exe 101 PID 4908 wrote to memory of 1300 4908 7b1ad881708336e5b8153c12cc70de8f.exe 101 PID 4908 wrote to memory of 1300 4908 7b1ad881708336e5b8153c12cc70de8f.exe 101 PID 4908 wrote to memory of 1300 4908 7b1ad881708336e5b8153c12cc70de8f.exe 101 PID 4908 wrote to memory of 1300 4908 7b1ad881708336e5b8153c12cc70de8f.exe 101 PID 4908 wrote to memory of 1300 4908 7b1ad881708336e5b8153c12cc70de8f.exe 101 PID 4908 wrote to memory of 1300 4908 7b1ad881708336e5b8153c12cc70de8f.exe 101 PID 1300 wrote to memory of 656 1300 RegSvcs.exe 102 PID 1300 wrote to memory of 656 1300 RegSvcs.exe 102 PID 1300 wrote to memory of 656 1300 RegSvcs.exe 102 PID 1300 wrote to memory of 496 1300 RegSvcs.exe 105 PID 1300 wrote to memory of 496 1300 RegSvcs.exe 105 PID 1300 wrote to memory of 496 1300 RegSvcs.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b1ad881708336e5b8153c12cc70de8f.exe"C:\Users\Admin\AppData\Local\Temp\7b1ad881708336e5b8153c12cc70de8f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYSkDCU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp644.tmp"2⤵
- Creates scheduled task(s)
PID:3792
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵PID:1508
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵PID:4568
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD59.tmp"3⤵
- Creates scheduled task(s)
PID:656
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDB8.tmp"3⤵
- Creates scheduled task(s)
PID:496
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5dbd958af4cb910c9fe25c0484583d991
SHA1378cbdf661adbf868019eb36601216b1177933eb
SHA25694512af63bb7e2a9580faafba2778fe6ee29bdd8db63e6cc27fc9414eb9ffb17
SHA512ef918d633c90683b0447f8f00a061ed175ae7a82d7f9a6447538434a94a7d4561637d37f8a788c6209aed0d80395b465e106db2b97dff1fe05e2040266a29396
-
Filesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
Filesize
1KB
MD593d357e6194c8eb8d0616a9f592cc4bf
SHA15cc3a3d95d82cb88f65cb6dc6c188595fa272808
SHA256a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713
SHA5124df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f