Analysis
- max time kernel
143s - max time network
121s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
22/07/2024, 22:31
General
- Target NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar
- Size 5.8MB
- Sample240722-2fbtvaserl
- SHA256 ceb348dfa61b34bebce021fa783b0afdb874ea7205f75e7fb42b01898439be75
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
vlc-qt-interface.ini
vlc-qt-interface.ini.lock
memory/2960-71-0x000007FEFA700000-0x000007FEFA734000-memory.dmp
memory/2960-70-0x000000013FED0000-0x000000013FFC8000-memory.dmp
memory/2960-73-0x000007FEFA6E0000-0x000007FEFA6F8000-memory.dmp
memory/2960-74-0x000007FEFA6C0000-0x000007FEFA6D7000-memory.dmp
memory/2960-75-0x000007FEFA6A0000-0x000007FEFA6B1000-memory.dmp
memory/2960-76-0x000007FEFA680000-0x000007FEFA697000-memory.dmp
memory/2960-77-0x000007FEF7200000-0x000007FEF7211000-memory.dmp
memory/2960-78-0x000007FEF6FF0000-0x000007FEF700D000-memory.dmp
memory/2960-79-0x000007FEF6FD0000-0x000007FEF6FE1000-memory.dmp
memory/2960-72-0x000007FEF5C70000-0x000007FEF5F26000-memory.dmp
memory/2960-83-0x000007FEF6F50000-0x000007FEF6F71000-memory.dmp
memory/2960-84-0x000007FEF6F30000-0x000007FEF6F48000-memory.dmp
memory/2960-88-0x000007FEF63A0000-0x000007FEF63BB000-memory.dmp
memory/2960-92-0x000007FEF5980000-0x000007FEF59E7000-memory.dmp
memory/2960-96-0x000007FEF5850000-0x000007FEF5878000-memory.dmp
memory/2960-82-0x000007FEF6F80000-0x000007FEF6FC1000-memory.dmp
memory/2960-81-0x000007FEF5A60000-0x000007FEF5C6B000-memory.dmp
memory/2960-86-0x000007FEF63E0000-0x000007FEF63F1000-memory.dmp
memory/2960-87-0x000007FEF63C0000-0x000007FEF63D1000-memory.dmp
memory/2960-91-0x000007FEF59F0000-0x000007FEF5A20000-memory.dmp
memory/2960-90-0x000007FEF5A20000-0x000007FEF5A38000-memory.dmp
memory/2960-95-0x000007FEF5880000-0x000007FEF58D7000-memory.dmp
memory/2960-111-0x000007FEF2940000-0x000007FEF2997000-memory.dmp
memory/2960-114-0x000007FEF28D0000-0x000007FEF28E1000-memory.dmp
memory/2960-80-0x000007FEF4410000-0x000007FEF54C0000-memory.dmp
memory/2960-110-0x000007FEF29A0000-0x000007FEF29B1000-memory.dmp
memory/2960-109-0x000007FEF2800000-0x000007FEF2811000-memory.dmp
memory/2960-108-0x000007FEF2A20000-0x000007FEF2A32000-memory.dmp
memory/2960-116-0x000007FEF28B0000-0x000007FEF28C3000-memory.dmp
memory/2960-118-0x000007FEF2870000-0x000007FEF2884000-memory.dmp
memory/2960-119-0x000007FEF2850000-0x000007FEF2862000-memory.dmp
memory/2960-120-0x000007FEF2830000-0x000007FEF2844000-memory.dmp
memory/2960-121-0x000007FEF2710000-0x000007FEF272E000-memory.dmp
memory/2960-122-0x000007FEF26F0000-0x000007FEF2707000-memory.dmp
memory/2960-117-0x000007FEF2890000-0x000007FEF28A1000-memory.dmp
memory/2960-123-0x000007FEF26D0000-0x000007FEF26E5000-memory.dmp
memory/2960-124-0x000007FEF26B0000-0x000007FEF26C4000-memory.dmp
memory/2960-115-0x000007FEF2730000-0x000007FEF27F5000-memory.dmp
memory/2960-125-0x000007FEF2680000-0x000007FEF26AC000-memory.dmp
memory/2960-107-0x000007FEF2A40000-0x000007FEF2A6A000-memory.dmp
memory/2960-126-0x000007FEF2660000-0x000007FEF2673000-memory.dmp
memory/2960-106-0x000007FEF2A70000-0x000007FEF2A86000-memory.dmp
memory/2960-105-0x000007FEF2A90000-0x000007FEF2AA8000-memory.dmp
memory/2960-127-0x000007FEF2620000-0x000007FEF2651000-memory.dmp
memory/2960-104-0x000007FEF2AB0000-0x000007FEF2AC2000-memory.dmp
memory/2960-103-0x000007FEF2AD0000-0x000007FEF2AE1000-memory.dmp
memory/2960-102-0x000007FEF2AF0000-0x000007FEF2B01000-memory.dmp
memory/2960-101-0x000007FEF5790000-0x000007FEF57A2000-memory.dmp
memory/2960-128-0x000007FEF2600000-0x000007FEF2616000-memory.dmp
memory/2960-100-0x000007FEF57B0000-0x000007FEF57C1000-memory.dmp
memory/2960-131-0x000007FEFA670000-0x000007FEFA680000-memory.dmp
memory/2960-130-0x000007FEF25C0000-0x000007FEF25D2000-memory.dmp
memory/2960-129-0x000007FEF25E0000-0x000007FEF25F1000-memory.dmp
memory/2960-99-0x000007FEF57D0000-0x000007FEF57F3000-memory.dmp
memory/2960-98-0x000007FEF5800000-0x000007FEF5818000-memory.dmp
memory/2960-132-0x000007FEF25A0000-0x000007FEF25B6000-memory.dmp
memory/2960-133-0x000007FEF2550000-0x000007FEF2592000-memory.dmp
memory/2960-97-0x000007FEF5820000-0x000007FEF5844000-memory.dmp
memory/2960-113-0x000007FEF28F0000-0x000007FEF2903000-memory.dmp
memory/2960-112-0x000007FEF2910000-0x000007FEF293F000-memory.dmp
memory/2960-94-0x000007FEF58E0000-0x000007FEF58F1000-memory.dmp
memory/2960-93-0x000007FEF5900000-0x000007FEF597C000-memory.dmp
memory/2960-89-0x000007FEF5A40000-0x000007FEF5A51000-memory.dmp
memory/2960-85-0x000007FEF6400000-0x000007FEF6411000-memory.dmp