Analysis
-
max time kernel
118s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 01:04
Static task
static1
Behavioral task
behavioral1
Sample
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe
Resource
win7-20240508-en
General
-
Target
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe
-
Size
626KB
-
MD5
14239732dbddfe922c297fdeac56a062
-
SHA1
3f4f6454c4a2c1c5d1e10d5f841ce14eef00a785
-
SHA256
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00
-
SHA512
87125027fe82df355f6461e540afbedc68372ff2b29ee1531d3c6f42144d993ee044b68488c8b0144cecd6c74cbd964f5445fee19954167e2301ff19e9e3e628
-
SSDEEP
12288:glYifTsdxUde52iuVHaARloUgtGuFxmwk2BUY0Yk/a7LG1N7DpA:PiYd5uVHaAlhgtfvBUYuqLG1JDW
Malware Config
Extracted
nanocore
1.2.2.0
newsddawork.3utilities.com:1620
maxlogs.webhop.me:1620
1fa46b72-10f9-4da3-bc15-84dde165706d
-
activate_away_mode
true
-
backup_connection_host
maxlogs.webhop.me
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-02-17T03:41:10.727034736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1620
-
default_group
NewBin
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
1fa46b72-10f9-4da3-bc15-84dde165706d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
newsddawork.3utilities.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe" MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exedescription pid process target process PID 2860 set thread context of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe -
Drops file in Program Files directory 2 IoCs
Processes:
MSBuild.exedescription ioc process File created C:\Program Files (x86)\ARP Host\arphost.exe MSBuild.exe File opened for modification C:\Program Files (x86)\ARP Host\arphost.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exeMSBuild.exepowershell.exepid process 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe 2640 MSBuild.exe 2640 MSBuild.exe 2640 MSBuild.exe 2124 powershell.exe 2640 MSBuild.exe 2640 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 2640 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exeMSBuild.exepowershell.exedescription pid process Token: SeDebugPrivilege 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe Token: SeDebugPrivilege 2640 MSBuild.exe Token: SeDebugPrivilege 2124 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exedescription pid process target process PID 2860 wrote to memory of 2124 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe powershell.exe PID 2860 wrote to memory of 2124 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe powershell.exe PID 2860 wrote to memory of 2124 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe powershell.exe PID 2860 wrote to memory of 2124 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe powershell.exe PID 2860 wrote to memory of 2632 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe schtasks.exe PID 2860 wrote to memory of 2632 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe schtasks.exe PID 2860 wrote to memory of 2632 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe schtasks.exe PID 2860 wrote to memory of 2632 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe schtasks.exe PID 2860 wrote to memory of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe PID 2860 wrote to memory of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe PID 2860 wrote to memory of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe PID 2860 wrote to memory of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe PID 2860 wrote to memory of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe PID 2860 wrote to memory of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe PID 2860 wrote to memory of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe PID 2860 wrote to memory of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe PID 2860 wrote to memory of 2640 2860 1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe"C:\Users\Admin\AppData\Local\Temp\1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dgKDUvhlvCiVpa.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46B1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp46B1.tmpFilesize
1KB
MD50a5578049d513ef51f95c208c879c10f
SHA1b9d9ca7c68c0203d6972ae6bc48f834fb729c8ad
SHA256265db2e9ed8f0f7aba6c344e7027f06f690bc7b418703994303a06671ff2402c
SHA51289b9204744fc5fc41edc0fdc1aca7dc0dba36146faa003e28a1c33441f232eca05cc3a29eacc0ede534d9829923ab5067b343f4e4cc43050873405f6bef20f0a
-
memory/2640-19-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2640-38-0x0000000000B20000-0x0000000000B2E000-memory.dmpFilesize
56KB
-
memory/2640-28-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/2640-43-0x0000000004850000-0x000000000487E000-memory.dmpFilesize
184KB
-
memory/2640-42-0x00000000020C0000-0x00000000020CE000-memory.dmpFilesize
56KB
-
memory/2640-41-0x0000000000C70000-0x0000000000C84000-memory.dmpFilesize
80KB
-
memory/2640-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2640-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2640-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2640-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2640-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2640-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2640-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2640-39-0x0000000000B30000-0x0000000000B44000-memory.dmpFilesize
80KB
-
memory/2640-44-0x00000000020E0000-0x00000000020F4000-memory.dmpFilesize
80KB
-
memory/2640-40-0x0000000000C60000-0x0000000000C70000-memory.dmpFilesize
64KB
-
memory/2640-29-0x0000000000490000-0x00000000004AE000-memory.dmpFilesize
120KB
-
memory/2640-30-0x00000000003F0000-0x00000000003FA000-memory.dmpFilesize
40KB
-
memory/2640-33-0x00000000006B0000-0x00000000006C2000-memory.dmpFilesize
72KB
-
memory/2640-34-0x0000000000700000-0x000000000071A000-memory.dmpFilesize
104KB
-
memory/2640-35-0x00000000007B0000-0x00000000007BE000-memory.dmpFilesize
56KB
-
memory/2640-36-0x00000000007D0000-0x00000000007E2000-memory.dmpFilesize
72KB
-
memory/2640-37-0x00000000007E0000-0x00000000007EC000-memory.dmpFilesize
48KB
-
memory/2860-2-0x0000000074620000-0x0000000074D0E000-memory.dmpFilesize
6.9MB
-
memory/2860-3-0x0000000000530000-0x000000000054A000-memory.dmpFilesize
104KB
-
memory/2860-0-0x000000007462E000-0x000000007462F000-memory.dmpFilesize
4KB
-
memory/2860-1-0x00000000001F0000-0x0000000000292000-memory.dmpFilesize
648KB
-
memory/2860-5-0x0000000004870000-0x00000000048EA000-memory.dmpFilesize
488KB
-
memory/2860-4-0x0000000000460000-0x0000000000470000-memory.dmpFilesize
64KB
-
memory/2860-23-0x0000000074620000-0x0000000074D0E000-memory.dmpFilesize
6.9MB