Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 16:21
Static task
static1
Behavioral task
behavioral1
Sample
a22d0177e9d6943719508b77ed4ac91f.exe
Resource
win7-20240508-en
General
-
Target
a22d0177e9d6943719508b77ed4ac91f.exe
-
Size
601KB
-
MD5
a22d0177e9d6943719508b77ed4ac91f
-
SHA1
a9fac95535d4ef69a6f7b0550ed6bba65f96dbc3
-
SHA256
e28f241aecdb850910f2e2dea30dcbc23d31578ea3b7a74c9fa30460669f7c83
-
SHA512
ce7de781add996902983ca70edb86219a947347dc3990da542cbbdd33a869b92a1ec537974f154230df82ab64ef3474a8d20c9167c2434ca9b1013c4522fb949
-
SSDEEP
12288:H+jJ7GB/lLTXVzTpmGlWK74RTeQUj5VJ1MwzMRs5ax7W:H+dKB/lnVHMGMK74VfUjXTMEMRCa8
Malware Config
Extracted
nanocore
1.2.2.0
staywicked99.ddns.net:63882
127.0.0.1:63882
6f75db72-72d4-402c-b879-6fc19c6f2e39
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
37.235.1.177
-
buffer_size
65535
-
build_time
2024-03-05T14:12:07.229634536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
63882
-
default_group
FINGERS
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
6f75db72-72d4-402c-b879-6fc19c6f2e39
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
staywicked99.ddns.net
-
primary_dns_server
37.235.1.174
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a22d0177e9d6943719508b77ed4ac91f.exe -
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths a22d0177e9d6943719508b77ed4ac91f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\a22d0177e9d6943719508b77ed4ac91f.exe = "0" a22d0177e9d6943719508b77ed4ac91f.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation a22d0177e9d6943719508b77ed4ac91f.exe -
Unexpected DNS network traffic destination 7 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 37.235.1.177 Destination IP 37.235.1.177 Destination IP 37.235.1.174 Destination IP 37.235.1.174 Destination IP 37.235.1.174 Destination IP 37.235.1.174 Destination IP 37.235.1.177 -
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths a22d0177e9d6943719508b77ed4ac91f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions a22d0177e9d6943719508b77ed4ac91f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\a22d0177e9d6943719508b77ed4ac91f.exe = "0" a22d0177e9d6943719508b77ed4ac91f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" AddInProcess32.exe -
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a22d0177e9d6943719508b77ed4ac91f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a22d0177e9d6943719508b77ed4ac91f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription pid process target process PID 2976 set thread context of 4024 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe -
Drops file in Program Files directory 2 IoCs
Processes:
AddInProcess32.exedescription ioc process File created C:\Program Files (x86)\DDP Host\ddphost.exe AddInProcess32.exe File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeAddInProcess32.exepid process 1772 powershell.exe 1772 powershell.exe 4024 AddInProcess32.exe 4024 AddInProcess32.exe 4024 AddInProcess32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AddInProcess32.exepid process 4024 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a22d0177e9d6943719508b77ed4ac91f.exepowershell.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 2976 a22d0177e9d6943719508b77ed4ac91f.exe Token: SeDebugPrivilege 1772 powershell.exe Token: SeDebugPrivilege 4024 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription pid process target process PID 2976 wrote to memory of 1772 2976 a22d0177e9d6943719508b77ed4ac91f.exe powershell.exe PID 2976 wrote to memory of 1772 2976 a22d0177e9d6943719508b77ed4ac91f.exe powershell.exe PID 2976 wrote to memory of 4024 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 4024 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 4024 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 4024 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 4024 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 4024 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 4024 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 4024 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 1796 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 1796 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe PID 2976 wrote to memory of 1796 2976 a22d0177e9d6943719508b77ed4ac91f.exe AddInProcess32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
a22d0177e9d6943719508b77ed4ac91f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a22d0177e9d6943719508b77ed4ac91f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22d0177e9d6943719508b77ed4ac91f.exe"C:\Users\Admin\AppData\Local\Temp\a22d0177e9d6943719508b77ed4ac91f.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a22d0177e9d6943719508b77ed4ac91f.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i2iiuvxd.nx3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1772-27-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmpFilesize
10.8MB
-
memory/1772-8-0x0000014795DB0000-0x0000014795DC0000-memory.dmpFilesize
64KB
-
memory/1772-14-0x0000014795E20000-0x0000014795E42000-memory.dmpFilesize
136KB
-
memory/1772-6-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmpFilesize
10.8MB
-
memory/2976-30-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmpFilesize
10.8MB
-
memory/2976-4-0x000001C3E9260000-0x000001C3E92EC000-memory.dmpFilesize
560KB
-
memory/2976-1-0x000001C3CEC80000-0x000001C3CEC94000-memory.dmpFilesize
80KB
-
memory/2976-3-0x000001C3E90B0000-0x000001C3E90B6000-memory.dmpFilesize
24KB
-
memory/2976-0-0x00007FFCBB043000-0x00007FFCBB045000-memory.dmpFilesize
8KB
-
memory/2976-2-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmpFilesize
10.8MB
-
memory/4024-32-0x0000000074E3E000-0x0000000074E3F000-memory.dmpFilesize
4KB
-
memory/4024-20-0x0000000005510000-0x00000000055A2000-memory.dmpFilesize
584KB
-
memory/4024-21-0x00000000055B0000-0x000000000564C000-memory.dmpFilesize
624KB
-
memory/4024-22-0x00000000054F0000-0x00000000054FA000-memory.dmpFilesize
40KB
-
memory/4024-5-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4024-28-0x00000000056C0000-0x00000000056CA000-memory.dmpFilesize
40KB
-
memory/4024-29-0x00000000056D0000-0x00000000056EE000-memory.dmpFilesize
120KB
-
memory/4024-19-0x0000000005AC0000-0x0000000006064000-memory.dmpFilesize
5.6MB
-
memory/4024-31-0x00000000064B0000-0x00000000064BA000-memory.dmpFilesize
40KB
-
memory/4024-7-0x0000000074E3E000-0x0000000074E3F000-memory.dmpFilesize
4KB