Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 01:17
Static task
static1
Behavioral task
behavioral1
Sample
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe
Resource
win7-20240705-en
General
-
Target
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe
-
Size
1.0MB
-
MD5
8b6071a9344b21469ca5a4b62a0a855b
-
SHA1
d255b5fd2b01cca939ce9c2020461afbfe098c18
-
SHA256
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598
-
SHA512
a3508e067982550c8575ca768797720456b5e290fa74e62c777ab190b6c9bf35b5255e071cc054fec9dbfea5b43eac9959db77eaca71bf286d05dfd1a8191a18
-
SSDEEP
12288:SWw6Htx8pRqpu+Ur5ge/S//f3V5SpsW4rmCac10lPAUELfJGERT0/CSVe:PzoD+BeOf2psW4rmFc1TLfb0/CSVe
Malware Config
Extracted
nanocore
1.2.2.0
3654.ddns.net:3654
10.9.0.118:3654
08b979e3-5178-4508-8fee-8691cecb4a52
-
activate_away_mode
true
-
backup_connection_host
10.9.0.118
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-04-20T00:01:40.250540136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3654
-
default_group
Nan
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
08b979e3-5178-4508-8fee-8691cecb4a52
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
3654.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe -
Processes:
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe = "0" 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe -
Processes:
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe = "0" 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
regasm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAT Subsystem = "C:\\Program Files (x86)\\NAT Subsystem\\natss.exe" regasm.exe -
Processes:
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exeregasm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA regasm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exedescription pid process target process PID 3100 set thread context of 208 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
regasm.exedescription ioc process File created C:\Program Files (x86)\NAT Subsystem\natss.exe regasm.exe File opened for modification C:\Program Files (x86)\NAT Subsystem\natss.exe regasm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1040 schtasks.exe 4620 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeregasm.exepid process 3076 powershell.exe 3076 powershell.exe 208 regasm.exe 208 regasm.exe 208 regasm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
regasm.exepid process 208 regasm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeregasm.exedescription pid process Token: SeDebugPrivilege 3076 powershell.exe Token: SeDebugPrivilege 208 regasm.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exeregasm.exedescription pid process target process PID 3100 wrote to memory of 3076 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe powershell.exe PID 3100 wrote to memory of 3076 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe powershell.exe PID 3100 wrote to memory of 840 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe msbuild.exe PID 3100 wrote to memory of 840 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe msbuild.exe PID 3100 wrote to memory of 840 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe msbuild.exe PID 3100 wrote to memory of 3916 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe installutil.exe PID 3100 wrote to memory of 3916 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe installutil.exe PID 3100 wrote to memory of 3916 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe installutil.exe PID 3100 wrote to memory of 208 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 208 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 208 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 208 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 208 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 208 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 208 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 208 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 3012 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 3012 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 3100 wrote to memory of 3012 3100 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe regasm.exe PID 208 wrote to memory of 1040 208 regasm.exe schtasks.exe PID 208 wrote to memory of 1040 208 regasm.exe schtasks.exe PID 208 wrote to memory of 1040 208 regasm.exe schtasks.exe PID 208 wrote to memory of 4620 208 regasm.exe schtasks.exe PID 208 wrote to memory of 4620 208 regasm.exe schtasks.exe PID 208 wrote to memory of 4620 208 regasm.exe schtasks.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe"C:\Users\Admin\AppData\Local\Temp\2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NAT Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE3A9.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NAT Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE485.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ginvv0cl.j4v.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpE3A9.tmpFilesize
1KB
MD59f7ed98e81d0fe949e838d96a3082d9d
SHA151f2641ef388b4d7124299a8fe67dd28b97d7c2b
SHA256c8e060a2fe9fbb9ab914cff8c292fedb3d6181626765216168fbe6894ad2f76d
SHA5123d3333b5cc5acef6d5ec8add76be23c028c167c09e50310f2972380871c730541d6500249f6d1b140b1e2c962d22b5c8d5a1ed034ef9f856b2dd1d73107dabcc
-
C:\Users\Admin\AppData\Local\Temp\tmpE485.tmpFilesize
1KB
MD5c58d37cb49c18f1d7cece3c78ac2f407
SHA1769ed0ea9d5269e1cec7234eaac77da129cc0463
SHA25652cdb418384a912c5b7071c92d7761f0d12250f07dbbb31876eb2e8d65acbae7
SHA5122efcb3eaf050d56ad3d483112303a1543f9fc457119fbca7d81b45d5619c0f1ba706ce96644d4e2055c1b5ada7af13f071495287a775ce234d9125633bf02775
-
memory/208-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/208-21-0x0000000005950000-0x0000000005EF4000-memory.dmpFilesize
5.6MB
-
memory/208-35-0x0000000005940000-0x000000000594A000-memory.dmpFilesize
40KB
-
memory/208-34-0x0000000006430000-0x000000000644E000-memory.dmpFilesize
120KB
-
memory/208-33-0x0000000005430000-0x000000000543A000-memory.dmpFilesize
40KB
-
memory/208-24-0x0000000005360000-0x000000000536A000-memory.dmpFilesize
40KB
-
memory/208-23-0x0000000005440000-0x00000000054DC000-memory.dmpFilesize
624KB
-
memory/208-22-0x00000000052B0000-0x0000000005342000-memory.dmpFilesize
584KB
-
memory/3076-16-0x00007FFABB220000-0x00007FFABBCE1000-memory.dmpFilesize
10.8MB
-
memory/3076-20-0x00007FFABB220000-0x00007FFABBCE1000-memory.dmpFilesize
10.8MB
-
memory/3076-17-0x00007FFABB220000-0x00007FFABBCE1000-memory.dmpFilesize
10.8MB
-
memory/3076-15-0x00000224FAE50000-0x00000224FAE72000-memory.dmpFilesize
136KB
-
memory/3076-7-0x00007FFABB220000-0x00007FFABBCE1000-memory.dmpFilesize
10.8MB
-
memory/3100-1-0x000001AE52F60000-0x000001AE52F98000-memory.dmpFilesize
224KB
-
memory/3100-4-0x000001AE6E070000-0x000001AE6E0FC000-memory.dmpFilesize
560KB
-
memory/3100-2-0x00007FFABB220000-0x00007FFABBCE1000-memory.dmpFilesize
10.8MB
-
memory/3100-29-0x00007FFABB220000-0x00007FFABBCE1000-memory.dmpFilesize
10.8MB
-
memory/3100-0-0x00007FFABB223000-0x00007FFABB225000-memory.dmpFilesize
8KB
-
memory/3100-3-0x000001AE6E230000-0x000001AE6E268000-memory.dmpFilesize
224KB