Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23-07-2024 11:42
General
-
Target
ddpsvc.exe
-
Size
256KB
-
MD5
d2b160bf5dbcd67bf70abcbf750cb343
-
SHA1
64c1cbb8c1ba03d3ed9fc543353761d82011d005
-
SHA256
e3780c56125cc734e1aa099762909dca33ccb17be0a6c510733b762c1092fe7b
-
SHA512
315cfee7a997016152d41d3016cfa05215581d08972dd9c226a5dd5e740217d9524787eaf4810e9c48c28624776d775d2ded476ca0491ff3a49d239aadfee816
-
SSDEEP
6144:jYtUoG/WtqLTr9bNMizsaq6cu8ygDkmvpEH9J0Z/a:j0U9Tj0YH8ygDkuEJ0Zy
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddpsvc.exe"C:\Users\Admin\AppData\Local\Temp\ddpsvc.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB