af872e954905dbfeb165da42d722889a7dfc4b84e88b52c9abc9de18a1a9d74f

General

Target

Nova Mod Pack.exe
Size

121KB
MD5

5c76d15a7d3f57f26edc494bd9db318b
SHA1

cfa089d8d7e9fde67b6cb85827d33431b2d80066
SHA256

af872e954905dbfeb165da42d722889a7dfc4b84e88b52c9abc9de18a1a9d74f
SHA512

3d7a621dcb56a8d8ded08e49c34c77071bcb8e8f408acd2ec9c00ff887342d1e3be935f3ad56b33ef7a96d0d85e1e36b6cccc9498a2b0fe96dab7b5d5747c1fb
SSDEEP

3072:0ojAQkj90n5EIrHshi+LFUWHnGWdw8OkG2Li0HbovOm:YjWnSeGisFXnJw8Ziib

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4256	powershell.exe
4580	powershell.exe
2896	powershell.exe
464	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	Nova Mod Pack.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.lnk	Nova Mod Pack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.lnk	Nova Mod Pack.exe

Executes dropped EXE 1 IoCs

pid	Process
5080	System32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\System32.exe"	Nova Mod Pack.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4776	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4256	powershell.exe
4256	powershell.exe
4580	powershell.exe
4580	powershell.exe
2896	powershell.exe
2896	powershell.exe
464	powershell.exe
464	powershell.exe
2484	Nova Mod Pack.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	Nova Mod Pack.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	2484	Nova Mod Pack.exe
Token: SeDebugPrivilege	5080	System32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2484	Nova Mod Pack.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 4256	2484	Nova Mod Pack.exe	90
PID 2484 wrote to memory of 4256	2484	Nova Mod Pack.exe	90
PID 2484 wrote to memory of 4580	2484	Nova Mod Pack.exe	93
PID 2484 wrote to memory of 4580	2484	Nova Mod Pack.exe	93
PID 2484 wrote to memory of 2896	2484	Nova Mod Pack.exe	95
PID 2484 wrote to memory of 2896	2484	Nova Mod Pack.exe	95
PID 2484 wrote to memory of 464	2484	Nova Mod Pack.exe	97
PID 2484 wrote to memory of 464	2484	Nova Mod Pack.exe	97
PID 2484 wrote to memory of 3168	2484	Nova Mod Pack.exe	99
PID 2484 wrote to memory of 3168	2484	Nova Mod Pack.exe	99
PID 2484 wrote to memory of 2572	2484	Nova Mod Pack.exe	104
PID 2484 wrote to memory of 2572	2484	Nova Mod Pack.exe	104
PID 2484 wrote to memory of 2204	2484	Nova Mod Pack.exe	106
PID 2484 wrote to memory of 2204	2484	Nova Mod Pack.exe	106
PID 2204 wrote to memory of 4776	2204	cmd.exe	108
PID 2204 wrote to memory of 4776	2204	cmd.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nova Mod Pack.exe
"C:\Users\Admin\AppData\Local\Temp\Nova Mod Pack.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nova Mod Pack.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nova Mod Pack.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\System32.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System32.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System32" /tr "C:\Users\Admin\System32.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3168
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "System32"
  2⤵
  PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7B41.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4048,i,15168044379859864039,3380316340477469860,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:2000

C:\Users\Admin\System32.exe
C:\Users\Admin\System32.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1076d13c33069781e0c96a74b2b64d1f

SHA1
56b274c368728fd987a2ccc582bdd32ccf3c4738

SHA256
83a029666efcdbcfd04f4e77a015ae5c88416507ec75cc0e71979048f4566a95

SHA512
401439f09d69c831ff43775632b532a55fb1ea86a30fea767376792c23704ff61965ce9215fa90684d84da7f64d697a13ef9f814efa8bd3734733a58f089931f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4c60463b0551abf52d31bc311e50c789

SHA1
59c839439e2b520bf1dc6c9872c03fef8eb85aa0

SHA256
31a2eaf3b166c43b57b902ed91ef7ac522724a679b82a31f8bdb5a6a35f76a4f

SHA512
b6b7b22f70f930f8ccf619b06f2e31903034774beee22fac8fb507e44352f74fba7ee03380a94ff988d7697ce467216e5ab7f9791c85628fe4afaa4871770676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5cfe303e798d1cc6c1dab341e7265c15

SHA1
cd2834e05191a24e28a100f3f8114d5a7708dc7c

SHA256
c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab

SHA512
ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2v2ex55l.x4u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7B41.tmp.bat

Filesize
165B

MD5
75cbaedee091eb96a25e8b755f2a1e5a

SHA1
15ac537f563fdcb7fb32a6b417c1a4baa2ba57dc

SHA256
32b4f5a0249ac2434439b94ba2e2f0367d8938d868b8d2838368615aa2f94835

SHA512
b3df4e981b568a32dba7187138bd520d1192f296015e814182584c402772756d466ce292ff24e77d87309e2083c80a39ec75514d20243b55d7df95428bb58b63

Download Submit
C:\Users\Admin\System32.exe

Filesize
121KB

MD5
5c76d15a7d3f57f26edc494bd9db318b

SHA1
cfa089d8d7e9fde67b6cb85827d33431b2d80066

SHA256
af872e954905dbfeb165da42d722889a7dfc4b84e88b52c9abc9de18a1a9d74f

SHA512
3d7a621dcb56a8d8ded08e49c34c77071bcb8e8f408acd2ec9c00ff887342d1e3be935f3ad56b33ef7a96d0d85e1e36b6cccc9498a2b0fe96dab7b5d5747c1fb

Download Submit
memory/2484-0-0x00007FFCD1DA3000-0x00007FFCD1DA5000-memory.dmp

Filesize
8KB

Download
memory/2484-1-0x0000000000F20000-0x0000000000F48000-memory.dmp

Filesize
160KB

Download
memory/2484-51-0x00007FFCD1DA0000-0x00007FFCD2861000-memory.dmp

Filesize
10.8MB

Download
memory/2484-52-0x00007FFCD1DA3000-0x00007FFCD1DA5000-memory.dmp

Filesize
8KB

Download
memory/2484-54-0x00007FFCD1DA0000-0x00007FFCD2861000-memory.dmp

Filesize
10.8MB

Download
memory/2484-64-0x00007FFCD1DA0000-0x00007FFCD2861000-memory.dmp

Filesize
10.8MB

Download
memory/4256-13-0x00007FFCD1DA0000-0x00007FFCD2861000-memory.dmp

Filesize
10.8MB

Download
memory/4256-2-0x000001EE99850000-0x000001EE99872000-memory.dmp

Filesize
136KB

Download
memory/4256-53-0x00007FFCD1DA0000-0x00007FFCD2861000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads