Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 15:38
Static task
static1
Behavioral task
behavioral1
Sample
HDXC~9337636PO-EXT-P88.exe
Resource
win7-20240704-en
General
-
Target
HDXC~9337636PO-EXT-P88.exe
-
Size
1.0MB
-
MD5
8b6071a9344b21469ca5a4b62a0a855b
-
SHA1
d255b5fd2b01cca939ce9c2020461afbfe098c18
-
SHA256
2b4d871271fbc3f9487d370b9315bca0b9ca44ee81ecce6b89a57b31f7cf4598
-
SHA512
a3508e067982550c8575ca768797720456b5e290fa74e62c777ab190b6c9bf35b5255e071cc054fec9dbfea5b43eac9959db77eaca71bf286d05dfd1a8191a18
-
SSDEEP
12288:SWw6Htx8pRqpu+Ur5ge/S//f3V5SpsW4rmCac10lPAUELfJGERT0/CSVe:PzoD+BeOf2psW4rmFc1TLfb0/CSVe
Malware Config
Extracted
nanocore
1.2.2.0
3654.ddns.net:3654
10.9.0.118:3654
08b979e3-5178-4508-8fee-8691cecb4a52
-
activate_away_mode
true
-
backup_connection_host
10.9.0.118
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-04-20T00:01:40.250540136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3654
-
default_group
Nan
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
08b979e3-5178-4508-8fee-8691cecb4a52
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
3654.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
HDXC~9337636PO-EXT-P88.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HDXC~9337636PO-EXT-P88.exe -
Processes:
HDXC~9337636PO-EXT-P88.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths HDXC~9337636PO-EXT-P88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\HDXC~9337636PO-EXT-P88.exe = "0" HDXC~9337636PO-EXT-P88.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HDXC~9337636PO-EXT-P88.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation HDXC~9337636PO-EXT-P88.exe -
Processes:
HDXC~9337636PO-EXT-P88.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths HDXC~9337636PO-EXT-P88.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions HDXC~9337636PO-EXT-P88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\HDXC~9337636PO-EXT-P88.exe = "0" HDXC~9337636PO-EXT-P88.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msbuild.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Host = "C:\\Program Files (x86)\\AGP Host\\agphost.exe" msbuild.exe -
Processes:
HDXC~9337636PO-EXT-P88.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA HDXC~9337636PO-EXT-P88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HDXC~9337636PO-EXT-P88.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HDXC~9337636PO-EXT-P88.exedescription pid process target process PID 4900 set thread context of 1588 4900 HDXC~9337636PO-EXT-P88.exe msbuild.exe -
Drops file in Program Files directory 2 IoCs
Processes:
msbuild.exedescription ioc process File created C:\Program Files (x86)\AGP Host\agphost.exe msbuild.exe File opened for modification C:\Program Files (x86)\AGP Host\agphost.exe msbuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4952 schtasks.exe 4748 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exemsbuild.exepid process 468 powershell.exe 468 powershell.exe 1588 msbuild.exe 1588 msbuild.exe 1588 msbuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msbuild.exepid process 1588 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exemsbuild.exedescription pid process Token: SeDebugPrivilege 468 powershell.exe Token: SeDebugPrivilege 1588 msbuild.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
HDXC~9337636PO-EXT-P88.exemsbuild.exedescription pid process target process PID 4900 wrote to memory of 468 4900 HDXC~9337636PO-EXT-P88.exe powershell.exe PID 4900 wrote to memory of 468 4900 HDXC~9337636PO-EXT-P88.exe powershell.exe PID 4900 wrote to memory of 1588 4900 HDXC~9337636PO-EXT-P88.exe msbuild.exe PID 4900 wrote to memory of 1588 4900 HDXC~9337636PO-EXT-P88.exe msbuild.exe PID 4900 wrote to memory of 1588 4900 HDXC~9337636PO-EXT-P88.exe msbuild.exe PID 4900 wrote to memory of 1588 4900 HDXC~9337636PO-EXT-P88.exe msbuild.exe PID 4900 wrote to memory of 1588 4900 HDXC~9337636PO-EXT-P88.exe msbuild.exe PID 4900 wrote to memory of 1588 4900 HDXC~9337636PO-EXT-P88.exe msbuild.exe PID 4900 wrote to memory of 1588 4900 HDXC~9337636PO-EXT-P88.exe msbuild.exe PID 4900 wrote to memory of 1588 4900 HDXC~9337636PO-EXT-P88.exe msbuild.exe PID 1588 wrote to memory of 4952 1588 msbuild.exe schtasks.exe PID 1588 wrote to memory of 4952 1588 msbuild.exe schtasks.exe PID 1588 wrote to memory of 4952 1588 msbuild.exe schtasks.exe PID 1588 wrote to memory of 4748 1588 msbuild.exe schtasks.exe PID 1588 wrote to memory of 4748 1588 msbuild.exe schtasks.exe PID 1588 wrote to memory of 4748 1588 msbuild.exe schtasks.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
HDXC~9337636PO-EXT-P88.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HDXC~9337636PO-EXT-P88.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HDXC~9337636PO-EXT-P88.exe"C:\Users\Admin\AppData\Local\Temp\HDXC~9337636PO-EXT-P88.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HDXC~9337636PO-EXT-P88.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "AGP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE02E.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "AGP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE08D.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cnjkl05i.xzm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpE02E.tmpFilesize
1KB
MD5d40335ac15d7d3f9e1a244a0b71b426e
SHA1d2db734de1565e002f7f5608958b561b2df41a06
SHA25693ea6f82e81fc0bd5a0d76b557a155107caf229aed877af2d4b00c16b913e114
SHA5127671722e8adef4305dc5fee84d2ebb05e39170c1c216a57416e8e3535cb376aa4aa48de9d93a18e7df379a2760e6917eee73a3331f6301165d06f7154bcf7901
-
C:\Users\Admin\AppData\Local\Temp\tmpE08D.tmpFilesize
1KB
MD59ee8a112d759a453dd36b7d534442383
SHA1a049165da394ad40e27421234ada8e0d5fd55251
SHA256f92ace6e6b0a87b76737a2e43ef69b5d1499d7065791a917016e238f9f44f165
SHA512ac6006488df3c558ff3bcbb9ec63fb4db83cd5ec38d6c90627d3f8e85941ac46b5cc8d392c60f62b021ee0a39b67ed085d1da7d072546becae50f7a575abec15
-
memory/468-16-0x000002D2FD4D0000-0x000002D2FD4F2000-memory.dmpFilesize
136KB
-
memory/468-20-0x00007FFB84A40000-0x00007FFB85501000-memory.dmpFilesize
10.8MB
-
memory/468-26-0x00007FFB84A40000-0x00007FFB85501000-memory.dmpFilesize
10.8MB
-
memory/468-17-0x00007FFB84A40000-0x00007FFB85501000-memory.dmpFilesize
10.8MB
-
memory/468-11-0x00007FFB84A40000-0x00007FFB85501000-memory.dmpFilesize
10.8MB
-
memory/1588-38-0x0000000074EEE000-0x0000000074EEF000-memory.dmpFilesize
4KB
-
memory/1588-36-0x0000000006800000-0x000000000681E000-memory.dmpFilesize
120KB
-
memory/1588-19-0x0000000005670000-0x0000000005702000-memory.dmpFilesize
584KB
-
memory/1588-21-0x0000000074EEE000-0x0000000074EEF000-memory.dmpFilesize
4KB
-
memory/1588-37-0x0000000005C10000-0x0000000005C1A000-memory.dmpFilesize
40KB
-
memory/1588-18-0x0000000005C20000-0x00000000061C4000-memory.dmpFilesize
5.6MB
-
memory/1588-22-0x00000000057B0000-0x000000000584C000-memory.dmpFilesize
624KB
-
memory/1588-23-0x0000000005730000-0x000000000573A000-memory.dmpFilesize
40KB
-
memory/1588-5-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1588-35-0x0000000005A10000-0x0000000005A1A000-memory.dmpFilesize
40KB
-
memory/4900-2-0x00007FFB84A40000-0x00007FFB85501000-memory.dmpFilesize
10.8MB
-
memory/4900-3-0x0000019950780000-0x00000199507B8000-memory.dmpFilesize
224KB
-
memory/4900-0-0x00007FFB84A43000-0x00007FFB84A45000-memory.dmpFilesize
8KB
-
memory/4900-30-0x00007FFB84A40000-0x00007FFB85501000-memory.dmpFilesize
10.8MB
-
memory/4900-1-0x00000199351D0000-0x0000019935208000-memory.dmpFilesize
224KB
-
memory/4900-4-0x000001994F7E0000-0x000001994F86C000-memory.dmpFilesize
560KB