Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
Scan00223.exe
Resource
win7-20240221-en
General
-
Target
Scan00223.exe
-
Size
1.2MB
-
MD5
5cdc2ba3ecb6b8b18d2ee2abacaa1eec
-
SHA1
af6e083f4bc6ea922ea86d2e5809945c2444d561
-
SHA256
e1cbe1e9e86779580e6a3b92e68d38d3fbeb40dc3b6f10e5bcdd1078ec87023e
-
SHA512
d7d67fcf0fbd2c5738c0c2a6e9771c8c8e53cb4ec265e4c0cbcfdd0474e758b11675589c4ff09124d1f104b8266aff062fab23d05055d2916eb1ed8865699f6b
-
SSDEEP
24576:OAHnh+eWsN3skA4RV1Hom2KXMmHasw4aCntfV0I5:5h+ZkldoPK8Yas3L
Malware Config
Extracted
nanocore
1.2.2.0
185.244.31.187:3000
85b72eaa-435b-4ed4-afb0-2dc6909a8443
-
activate_away_mode
true
-
backup_connection_host
185.244.31.187
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-11-25T09:02:14.508155636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3000
-
default_group
FEB
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
85b72eaa-435b-4ed4-afb0-2dc6909a8443
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.244.31.187
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
BrowserSettingSync.exeBrowserSettingSync.exepid process 1488 BrowserSettingSync.exe 592 BrowserSettingSync.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\cleanmgr\BrowserSettingSync.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Scan00223.exeBrowserSettingSync.exedescription pid process target process PID 2312 set thread context of 2360 2312 Scan00223.exe RegAsm.exe PID 1488 set thread context of 944 1488 BrowserSettingSync.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe RegAsm.exe File created C:\Program Files (x86)\DDP Service\ddpsv.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2520 schtasks.exe 2408 schtasks.exe 1300 schtasks.exe 2852 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegAsm.exepid process 2360 RegAsm.exe 2360 RegAsm.exe 2360 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 2360 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2360 RegAsm.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
Scan00223.exeRegAsm.exetaskeng.exeBrowserSettingSync.exedescription pid process target process PID 2312 wrote to memory of 2360 2312 Scan00223.exe RegAsm.exe PID 2312 wrote to memory of 2360 2312 Scan00223.exe RegAsm.exe PID 2312 wrote to memory of 2360 2312 Scan00223.exe RegAsm.exe PID 2312 wrote to memory of 2360 2312 Scan00223.exe RegAsm.exe PID 2312 wrote to memory of 2360 2312 Scan00223.exe RegAsm.exe PID 2312 wrote to memory of 2360 2312 Scan00223.exe RegAsm.exe PID 2312 wrote to memory of 2360 2312 Scan00223.exe RegAsm.exe PID 2312 wrote to memory of 2360 2312 Scan00223.exe RegAsm.exe PID 2312 wrote to memory of 2360 2312 Scan00223.exe RegAsm.exe PID 2360 wrote to memory of 2520 2360 RegAsm.exe schtasks.exe PID 2360 wrote to memory of 2520 2360 RegAsm.exe schtasks.exe PID 2360 wrote to memory of 2520 2360 RegAsm.exe schtasks.exe PID 2360 wrote to memory of 2520 2360 RegAsm.exe schtasks.exe PID 2360 wrote to memory of 2408 2360 RegAsm.exe schtasks.exe PID 2360 wrote to memory of 2408 2360 RegAsm.exe schtasks.exe PID 2360 wrote to memory of 2408 2360 RegAsm.exe schtasks.exe PID 2360 wrote to memory of 2408 2360 RegAsm.exe schtasks.exe PID 2312 wrote to memory of 1300 2312 Scan00223.exe schtasks.exe PID 2312 wrote to memory of 1300 2312 Scan00223.exe schtasks.exe PID 2312 wrote to memory of 1300 2312 Scan00223.exe schtasks.exe PID 2312 wrote to memory of 1300 2312 Scan00223.exe schtasks.exe PID 2600 wrote to memory of 1488 2600 taskeng.exe BrowserSettingSync.exe PID 2600 wrote to memory of 1488 2600 taskeng.exe BrowserSettingSync.exe PID 2600 wrote to memory of 1488 2600 taskeng.exe BrowserSettingSync.exe PID 2600 wrote to memory of 1488 2600 taskeng.exe BrowserSettingSync.exe PID 1488 wrote to memory of 944 1488 BrowserSettingSync.exe RegAsm.exe PID 1488 wrote to memory of 944 1488 BrowserSettingSync.exe RegAsm.exe PID 1488 wrote to memory of 944 1488 BrowserSettingSync.exe RegAsm.exe PID 1488 wrote to memory of 944 1488 BrowserSettingSync.exe RegAsm.exe PID 1488 wrote to memory of 944 1488 BrowserSettingSync.exe RegAsm.exe PID 1488 wrote to memory of 944 1488 BrowserSettingSync.exe RegAsm.exe PID 1488 wrote to memory of 944 1488 BrowserSettingSync.exe RegAsm.exe PID 1488 wrote to memory of 944 1488 BrowserSettingSync.exe RegAsm.exe PID 1488 wrote to memory of 944 1488 BrowserSettingSync.exe RegAsm.exe PID 1488 wrote to memory of 2852 1488 BrowserSettingSync.exe schtasks.exe PID 1488 wrote to memory of 2852 1488 BrowserSettingSync.exe schtasks.exe PID 1488 wrote to memory of 2852 1488 BrowserSettingSync.exe schtasks.exe PID 1488 wrote to memory of 2852 1488 BrowserSettingSync.exe schtasks.exe PID 2600 wrote to memory of 592 2600 taskeng.exe BrowserSettingSync.exe PID 2600 wrote to memory of 592 2600 taskeng.exe BrowserSettingSync.exe PID 2600 wrote to memory of 592 2600 taskeng.exe BrowserSettingSync.exe PID 2600 wrote to memory of 592 2600 taskeng.exe BrowserSettingSync.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan00223.exe"C:\Users\Admin\AppData\Local\Temp\Scan00223.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1B1F.tmp"3⤵
- Creates scheduled task(s)
PID:2520 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1CD5.tmp"3⤵
- Creates scheduled task(s)
PID:2408 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn BluetoothDesktopHandlers /tr "C:\Users\Admin\AppData\Roaming\cleanmgr\BrowserSettingSync.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1300
-
C:\Windows\system32\taskeng.exetaskeng.exe {CDEBB6C7-A897-47F4-B4E2-A54256557102} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Roaming\cleanmgr\BrowserSettingSync.exeC:\Users\Admin\AppData\Roaming\cleanmgr\BrowserSettingSync.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:944
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn BluetoothDesktopHandlers /tr "C:\Users\Admin\AppData\Roaming\cleanmgr\BrowserSettingSync.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2852 -
C:\Users\Admin\AppData\Roaming\cleanmgr\BrowserSettingSync.exeC:\Users\Admin\AppData\Roaming\cleanmgr\BrowserSettingSync.exe2⤵
- Executes dropped EXE
PID:592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1B1F.tmpFilesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
C:\Users\Admin\AppData\Local\Temp\tmp1CD5.tmpFilesize
1KB
MD593d357e6194c8eb8d0616a9f592cc4bf
SHA15cc3a3d95d82cb88f65cb6dc6c188595fa272808
SHA256a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713
SHA5124df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f
-
C:\Users\Admin\AppData\Roaming\cleanmgr\BrowserSettingSync.exeFilesize
1.2MB
MD52d8240cb5dab77a8eb22dfa6cbb76902
SHA156ba9bea4d132fe435d2150394838cdf1da0159f
SHA256d9dd2e26fedcd96cfd17222ffedd5bda869150c6f8d43cfafe7beae53f1223b7
SHA512ffb34a282ee2586bbc6d18b186fa78ef0d02e156d69b623609c6dd9a86c961dbebb74dbffc985af108b00f3aaf0ba7fa2f4821edd71a8bdd62e16f8eabcd0199
-
memory/944-31-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/944-32-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/944-25-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/2312-0-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2360-10-0x0000000074882000-0x0000000074884000-memory.dmpFilesize
8KB
-
memory/2360-1-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2360-20-0x0000000074882000-0x0000000074884000-memory.dmpFilesize
8KB
-
memory/2360-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2360-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2360-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2360-2-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB