Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
22-05-2024 20:00
Static task
static1
Behavioral task
behavioral1
Sample
Nihon.exe
Resource
win10-20240404-en
General
-
Target
Nihon.exe
-
Size
12.7MB
-
MD5
26b058dde37aedb08da5bb55fb38570e
-
SHA1
d3bd14485f02571243540c6df24fa8fb5ac00d00
-
SHA256
5c2575405d4d2c904ae43fa36a5787999f334f531b7f1d1a43028369ba9368c6
-
SHA512
32c6c21401241b024a912c47790a716f580796822e97a2842b61067d5b0b7f916314be3a721b5901d1184cd49a608ad63bb26fdeea682d8c81e820b562d9980b
-
SSDEEP
196608:kuMJHRhINicdkxGnOICwuY+5F4XUJGPrjMxQZEPdlO+si:kRHVcdkx3ICw8IEUj5klt
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
Processes:
taskmgr.exedescription pid process target process PID 1676 created 376 1676 taskmgr.exe Nihon.exe PID 1676 created 376 1676 taskmgr.exe Nihon.exe PID 1676 created 376 1676 taskmgr.exe Nihon.exe PID 1676 created 376 1676 taskmgr.exe Nihon.exe -
Loads dropped DLL 3 IoCs
Processes:
Nihon.exeNihon.exeNihon.exepid process 1504 Nihon.exe 376 Nihon.exe 4104 Nihon.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 2 raw.githubusercontent.com 3 raw.githubusercontent.com 11 raw.githubusercontent.com -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Nihon.exeNihon.exetaskmgr.exeNihon.exepid process 1504 Nihon.exe 1504 Nihon.exe 376 Nihon.exe 376 Nihon.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 4104 Nihon.exe 4104 Nihon.exe 4104 Nihon.exe 4104 Nihon.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Nihon.exeNihon.exetaskmgr.exeNihon.exedescription pid process Token: SeDebugPrivilege 1504 Nihon.exe Token: SeDebugPrivilege 376 Nihon.exe Token: SeDebugPrivilege 1676 taskmgr.exe Token: SeSystemProfilePrivilege 1676 taskmgr.exe Token: SeCreateGlobalPrivilege 1676 taskmgr.exe Token: 33 1676 taskmgr.exe Token: SeIncBasePriorityPrivilege 1676 taskmgr.exe Token: SeDebugPrivilege 4104 Nihon.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
Processes:
Nihon.exetaskmgr.exepid process 376 Nihon.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
Processes:
taskmgr.exepid process 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe 1676 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nihon.exe"C:\Users\Admin\AppData\Local\Temp\Nihon.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Nihon.exe"C:\Users\Admin\Desktop\Nihon.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\a52458eb29d443fda1976a1e9a30fd44 /t 1880 /p 3761⤵
-
C:\Users\Admin\Desktop\poop\Nihon.exe"C:\Users\Admin\Desktop\poop\Nihon.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\614ef9629bca408ab32fafb4bb8cadff\WebView2Loader.dllFilesize
133KB
MD5a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1dd109ac34beb8289030e4ec0a026297b793f64a3
SHA25679d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
SHA5122a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
-
memory/376-16-0x00000175EDB10000-0x00000175EDBC2000-memory.dmpFilesize
712KB
-
memory/376-17-0x00000175EDCF0000-0x00000175EDD12000-memory.dmpFilesize
136KB
-
memory/1504-7-0x000001D93F370000-0x000001D93F38A000-memory.dmpFilesize
104KB
-
memory/1504-13-0x00007FFC02D80000-0x00007FFC0376C000-memory.dmpFilesize
9.9MB
-
memory/1504-8-0x000001D957E60000-0x000001D9587F0000-memory.dmpFilesize
9.6MB
-
memory/1504-9-0x000001D95C210000-0x000001D95C218000-memory.dmpFilesize
32KB
-
memory/1504-10-0x000001D95C700000-0x000001D95C738000-memory.dmpFilesize
224KB
-
memory/1504-11-0x00007FFC02D80000-0x00007FFC0376C000-memory.dmpFilesize
9.9MB
-
memory/1504-12-0x00007FFC02D80000-0x00007FFC0376C000-memory.dmpFilesize
9.9MB
-
memory/1504-0-0x00007FFC02D83000-0x00007FFC02D84000-memory.dmpFilesize
4KB
-
memory/1504-6-0x00007FFC02D80000-0x00007FFC0376C000-memory.dmpFilesize
9.9MB
-
memory/1504-1-0x000001D93CAA0000-0x000001D93D752000-memory.dmpFilesize
12.7MB
-
memory/4104-24-0x000002476D6C0000-0x000002476D736000-memory.dmpFilesize
472KB
-
memory/4104-25-0x000002476D680000-0x000002476D69E000-memory.dmpFilesize
120KB
-
memory/4104-28-0x000002476C980000-0x000002476C988000-memory.dmpFilesize
32KB
-
memory/4104-29-0x0000024767CC0000-0x0000024767D04000-memory.dmpFilesize
272KB
-
memory/4104-30-0x0000024767D20000-0x0000024767D2C000-memory.dmpFilesize
48KB
-
memory/4104-31-0x0000024767E90000-0x0000024767EC0000-memory.dmpFilesize
192KB