Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 23:50
Static task
static1
Behavioral task
behavioral1
Sample
1216242020.exe
Resource
win7-20240220-en
General
-
Target
1216242020.exe
-
Size
368KB
-
MD5
b26e02708c3c9af220b62324c7dfd051
-
SHA1
b0e11425eab3a005fca2e595f2ce80d39aaeb58a
-
SHA256
8f88c71422c2790790dd50c3ff89fe3a5add4e1d55a83e50d6b445779d813796
-
SHA512
ac9c710e493fba14056a9042f160e178dd7940c922d336109efe4f8aadc42a58da6f316a2e4ddd627852b750d52d25d2329962fdff16ff39099eabcd00a8f674
-
SSDEEP
6144:A43+hdkseMXAtY96fHVo3XMmtWIkXb1QRosnE76JH9Ew9l0BqmLzAvq9z:fhMXAtY96/9HIkXmRdE76JH9Xl0BqBvM
Malware Config
Extracted
nanocore
1.2.2.0
wazzy.ddns.net:1716
194.5.99.24:1716
c1ffd46d-254d-4433-8da6-7277dec7b59a
-
activate_away_mode
true
-
backup_connection_host
194.5.99.24
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-28T11:57:28.371938436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1716
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c1ffd46d-254d-4433-8da6-7277dec7b59a
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
wazzy.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
1216242020.exedescription pid process target process PID 2360 set thread context of 2456 2360 1216242020.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2496 schtasks.exe 2720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 2456 MSBuild.exe 2456 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 2456 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 2456 MSBuild.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
1216242020.exeMSBuild.exedescription pid process target process PID 2360 wrote to memory of 2720 2360 1216242020.exe schtasks.exe PID 2360 wrote to memory of 2720 2360 1216242020.exe schtasks.exe PID 2360 wrote to memory of 2720 2360 1216242020.exe schtasks.exe PID 2360 wrote to memory of 2720 2360 1216242020.exe schtasks.exe PID 2360 wrote to memory of 2456 2360 1216242020.exe MSBuild.exe PID 2360 wrote to memory of 2456 2360 1216242020.exe MSBuild.exe PID 2360 wrote to memory of 2456 2360 1216242020.exe MSBuild.exe PID 2360 wrote to memory of 2456 2360 1216242020.exe MSBuild.exe PID 2360 wrote to memory of 2456 2360 1216242020.exe MSBuild.exe PID 2360 wrote to memory of 2456 2360 1216242020.exe MSBuild.exe PID 2360 wrote to memory of 2456 2360 1216242020.exe MSBuild.exe PID 2360 wrote to memory of 2456 2360 1216242020.exe MSBuild.exe PID 2360 wrote to memory of 2456 2360 1216242020.exe MSBuild.exe PID 2456 wrote to memory of 2496 2456 MSBuild.exe schtasks.exe PID 2456 wrote to memory of 2496 2456 MSBuild.exe schtasks.exe PID 2456 wrote to memory of 2496 2456 MSBuild.exe schtasks.exe PID 2456 wrote to memory of 2496 2456 MSBuild.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1216242020.exe"C:\Users\Admin\AppData\Local\Temp\1216242020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BTGAGCgDGBVI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp92AE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp93D7.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp92AE.tmpFilesize
1KB
MD51d9ee294ae96a8bb7ee21c894bae7161
SHA1a8f68cdf6e19244c4198a204e484b3523237ec3c
SHA2562264507833a30e26409e1bf27ede4655c83313508191c614d535385c5c84524f
SHA512306dc36da5e92709928ec21a893ff597dff8bceb81bb1865de310256838a4bce188caaefe3e86925cbdd090138c56495a0a5833b3199aebaf8e4b9bc5e1bda21
-
C:\Users\Admin\AppData\Local\Temp\tmp93D7.tmpFilesize
1KB
MD5ae766004c0d8792953bafffe8f6a2e3b
SHA114b12f27543a401e2fe0af8052e116cab0032426
SHA2561abdd9b6a6b84e4ba1af1282dc84ce276c59ba253f4c4af05fea498a4fd99540
SHA512e530da4a5d4336fc37838d0e93b5eb3804b9c489c71f6954a47fc81a4c655bb72ec493e109cf96e6e3617d7623ac80697ad3bbd5ffc6281bafc8b34dca5e6567
-
memory/2360-25-0x0000000074BE0000-0x000000007518B000-memory.dmpFilesize
5.7MB
-
memory/2360-0-0x0000000074BE1000-0x0000000074BE2000-memory.dmpFilesize
4KB
-
memory/2360-4-0x0000000074BE0000-0x000000007518B000-memory.dmpFilesize
5.7MB
-
memory/2360-2-0x0000000074BE0000-0x000000007518B000-memory.dmpFilesize
5.7MB
-
memory/2360-3-0x0000000074BE0000-0x000000007518B000-memory.dmpFilesize
5.7MB
-
memory/2360-1-0x0000000074BE0000-0x000000007518B000-memory.dmpFilesize
5.7MB
-
memory/2456-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2456-24-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB