Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 17:04
Static task
static1
Behavioral task
behavioral1
Sample
9a08c8a2b49d6348f2ef35f85a1c6351.exe
Resource
win7-20240220-en
General
-
Target
9a08c8a2b49d6348f2ef35f85a1c6351.exe
-
Size
613KB
-
MD5
9a166a4ebfc7463904546bfa7daea8f1
-
SHA1
ee7c6418232b61389827a4a1c9a92990c2bf2838
-
SHA256
a8bcefc2310761d35f797a3d74edf9bbd5e3b144453f26e71924dca43d1966f0
-
SHA512
64216e945be7ca3d2025ec97f8055a3c67e425e45bd60fbb06cc1d345f4e8fe499a2b05fe9bd7a726ef88060b2c40a7efceccf96ba31d98eabd9bed606118ead
-
SSDEEP
12288:IhEn44D6ADx6lUnzaFqWd2viTsWGIHCMyDskak3CFJTYrEkjUvV:K14DfxRzEdAioAiVDskaqCFJTFkj
Malware Config
Extracted
nanocore
1.2.2.0
cloudhost.myfirewall.org:5654
4ae8a172-6da2-4779-a2b0-d9cfdcd47451
-
activate_away_mode
true
-
backup_connection_host
cloudhost.myfirewall.org
-
backup_dns_server
cloudhost.myfirewall.org
-
buffer_size
65535
-
build_time
2020-11-27T18:37:03.574425236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5654
-
default_group
UU008TH
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4ae8a172-6da2-4779-a2b0-d9cfdcd47451
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
cloudhost.myfirewall.org
-
primary_dns_server
cloudhost.myfirewall.org
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9a08c8a2b49d6348f2ef35f85a1c6351.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe" 9a08c8a2b49d6348f2ef35f85a1c6351.exe -
Processes:
9a08c8a2b49d6348f2ef35f85a1c6351.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9a08c8a2b49d6348f2ef35f85a1c6351.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9a08c8a2b49d6348f2ef35f85a1c6351.exedescription pid process target process PID 2768 set thread context of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe -
Drops file in Program Files directory 2 IoCs
Processes:
9a08c8a2b49d6348f2ef35f85a1c6351.exedescription ioc process File created C:\Program Files (x86)\TCP Subsystem\tcpss.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe File opened for modification C:\Program Files (x86)\TCP Subsystem\tcpss.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2412 schtasks.exe 2388 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9a08c8a2b49d6348f2ef35f85a1c6351.exepid process 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
9a08c8a2b49d6348f2ef35f85a1c6351.exepid process 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9a08c8a2b49d6348f2ef35f85a1c6351.exedescription pid process Token: SeDebugPrivilege 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
9a08c8a2b49d6348f2ef35f85a1c6351.exe9a08c8a2b49d6348f2ef35f85a1c6351.exedescription pid process target process PID 2768 wrote to memory of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe PID 2768 wrote to memory of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe PID 2768 wrote to memory of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe PID 2768 wrote to memory of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe PID 2768 wrote to memory of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe PID 2768 wrote to memory of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe PID 2768 wrote to memory of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe PID 2768 wrote to memory of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe PID 2768 wrote to memory of 2584 2768 9a08c8a2b49d6348f2ef35f85a1c6351.exe 9a08c8a2b49d6348f2ef35f85a1c6351.exe PID 2584 wrote to memory of 2412 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe schtasks.exe PID 2584 wrote to memory of 2412 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe schtasks.exe PID 2584 wrote to memory of 2412 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe schtasks.exe PID 2584 wrote to memory of 2412 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe schtasks.exe PID 2584 wrote to memory of 2388 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe schtasks.exe PID 2584 wrote to memory of 2388 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe schtasks.exe PID 2584 wrote to memory of 2388 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe schtasks.exe PID 2584 wrote to memory of 2388 2584 9a08c8a2b49d6348f2ef35f85a1c6351.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a08c8a2b49d6348f2ef35f85a1c6351.exe"C:\Users\Admin\AppData\Local\Temp\9a08c8a2b49d6348f2ef35f85a1c6351.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9a08c8a2b49d6348f2ef35f85a1c6351.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp90BB.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp92EE.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp90BB.tmpFilesize
1KB
MD5d6e1c55275559fdb593997a8dcfa56b7
SHA196dfd9d867de153d1211f8ae715c649a11e25c23
SHA256f7eab8d4d985896201ceb028cd858ec26ec7797ef9935b4ee8fadb9908111427
SHA5120c3df98a55e994578783c9e00e53a67f0ba25f034671f6546dec9747b549a0bd2dcf335a0258855c908d6cbf3c9bafae2a16d0e574ea05595536a0f0982c95e6
-
C:\Users\Admin\AppData\Local\Temp\tmp92EE.tmpFilesize
1KB
MD54b7ef560289c0f62d0baf6f14f48a57a
SHA18331acb90dde588aa3196919f6e847f398fd06d1
SHA256062844155306130d6fafc4fe10ac9e5ddd2ed462532b729c50cdc979c0d83207
SHA512ecaa27c4b703d95f9f9b37d8c339982970482e7dab968c2010e0aa644bbfa31973111aafb827565af30c423d1d14e4ff997ec149614e713ff7ef3456894d02d8
-
memory/2584-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2584-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2584-30-0x00000000749C0000-0x0000000074F6B000-memory.dmpFilesize
5.7MB
-
memory/2584-7-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2584-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2584-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2584-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2584-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2584-23-0x00000000749C0000-0x0000000074F6B000-memory.dmpFilesize
5.7MB
-
memory/2584-25-0x00000000749C0000-0x0000000074F6B000-memory.dmpFilesize
5.7MB
-
memory/2584-5-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2584-20-0x00000000749C0000-0x0000000074F6B000-memory.dmpFilesize
5.7MB
-
memory/2768-19-0x00000000749C0000-0x0000000074F6B000-memory.dmpFilesize
5.7MB
-
memory/2768-3-0x00000000749C0000-0x0000000074F6B000-memory.dmpFilesize
5.7MB
-
memory/2768-0-0x00000000749C1000-0x00000000749C2000-memory.dmpFilesize
4KB
-
memory/2768-2-0x00000000749C0000-0x0000000074F6B000-memory.dmpFilesize
5.7MB
-
memory/2768-1-0x00000000749C0000-0x0000000074F6B000-memory.dmpFilesize
5.7MB
-
memory/2768-4-0x00000000749C0000-0x0000000074F6B000-memory.dmpFilesize
5.7MB