Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 16:21
Static task
static1
Behavioral task
behavioral1
Sample
a22d0177e9d6943719508b77ed4ac91f.exe
Resource
win7-20240508-en
General
-
Target
a22d0177e9d6943719508b77ed4ac91f.exe
-
Size
601KB
-
MD5
a22d0177e9d6943719508b77ed4ac91f
-
SHA1
a9fac95535d4ef69a6f7b0550ed6bba65f96dbc3
-
SHA256
e28f241aecdb850910f2e2dea30dcbc23d31578ea3b7a74c9fa30460669f7c83
-
SHA512
ce7de781add996902983ca70edb86219a947347dc3990da542cbbdd33a869b92a1ec537974f154230df82ab64ef3474a8d20c9167c2434ca9b1013c4522fb949
-
SSDEEP
12288:H+jJ7GB/lLTXVzTpmGlWK74RTeQUj5VJ1MwzMRs5ax7W:H+dKB/lnVHMGMK74VfUjXTMEMRCa8
Malware Config
Extracted
nanocore
1.2.2.0
staywicked99.ddns.net:63882
127.0.0.1:63882
6f75db72-72d4-402c-b879-6fc19c6f2e39
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
37.235.1.177
-
buffer_size
65535
-
build_time
2024-03-05T14:12:07.229634536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
63882
-
default_group
FINGERS
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
6f75db72-72d4-402c-b879-6fc19c6f2e39
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
staywicked99.ddns.net
-
primary_dns_server
37.235.1.174
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a22d0177e9d6943719508b77ed4ac91f.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Unexpected DNS network traffic destination 7 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 37.235.1.177 Destination IP 37.235.1.177 Destination IP 37.235.1.174 Destination IP 37.235.1.174 Destination IP 37.235.1.177 Destination IP 37.235.1.174 Destination IP 37.235.1.174 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
installutil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Service = "C:\\Program Files (x86)\\LAN Service\\lansv.exe" installutil.exe -
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a22d0177e9d6943719508b77ed4ac91f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a22d0177e9d6943719508b77ed4ac91f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription pid process target process PID 2020 set thread context of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
installutil.exedescription ioc process File created C:\Program Files (x86)\LAN Service\lansv.exe installutil.exe File opened for modification C:\Program Files (x86)\LAN Service\lansv.exe installutil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exeinstallutil.exepid process 2168 powershell.exe 2352 installutil.exe 2352 installutil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
installutil.exepid process 2352 installutil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a22d0177e9d6943719508b77ed4ac91f.exepowershell.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 2020 a22d0177e9d6943719508b77ed4ac91f.exe Token: SeDebugPrivilege 2168 powershell.exe Token: SeDebugPrivilege 2352 installutil.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription pid process target process PID 2020 wrote to memory of 2168 2020 a22d0177e9d6943719508b77ed4ac91f.exe powershell.exe PID 2020 wrote to memory of 2168 2020 a22d0177e9d6943719508b77ed4ac91f.exe powershell.exe PID 2020 wrote to memory of 2168 2020 a22d0177e9d6943719508b77ed4ac91f.exe powershell.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2352 2020 a22d0177e9d6943719508b77ed4ac91f.exe installutil.exe PID 2020 wrote to memory of 2672 2020 a22d0177e9d6943719508b77ed4ac91f.exe WerFault.exe PID 2020 wrote to memory of 2672 2020 a22d0177e9d6943719508b77ed4ac91f.exe WerFault.exe PID 2020 wrote to memory of 2672 2020 a22d0177e9d6943719508b77ed4ac91f.exe WerFault.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a22d0177e9d6943719508b77ed4ac91f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22d0177e9d6943719508b77ed4ac91f.exe"C:\Users\Admin\AppData\Local\Temp\a22d0177e9d6943719508b77ed4ac91f.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a22d0177e9d6943719508b77ed4ac91f.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2020 -s 8922⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2020-0-0x000007FEF5373000-0x000007FEF5374000-memory.dmpFilesize
4KB
-
memory/2020-1-0x00000000013B0000-0x00000000013C4000-memory.dmpFilesize
80KB
-
memory/2020-2-0x000007FEF5370000-0x000007FEF5D5C000-memory.dmpFilesize
9.9MB
-
memory/2020-3-0x0000000000650000-0x0000000000656000-memory.dmpFilesize
24KB
-
memory/2020-4-0x000000001AD80000-0x000000001AE0C000-memory.dmpFilesize
560KB
-
memory/2020-31-0x000007FEF5370000-0x000007FEF5D5C000-memory.dmpFilesize
9.9MB
-
memory/2020-30-0x000007FEF5373000-0x000007FEF5374000-memory.dmpFilesize
4KB
-
memory/2168-24-0x0000000001E10000-0x0000000001E18000-memory.dmpFilesize
32KB
-
memory/2168-23-0x000000001B600000-0x000000001B8E2000-memory.dmpFilesize
2.9MB
-
memory/2352-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2352-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2352-7-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2352-5-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2352-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2352-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2352-27-0x0000000000500000-0x000000000050A000-memory.dmpFilesize
40KB
-
memory/2352-28-0x0000000000610000-0x000000000062E000-memory.dmpFilesize
120KB
-
memory/2352-29-0x0000000000670000-0x000000000067A000-memory.dmpFilesize
40KB
-
memory/2352-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2352-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB