Analysis
-
max time kernel
162s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 11:54
Static task
static1
Behavioral task
behavioral1
Sample
Nursultan_Nextgen.zip
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nursultan_Nextgen.zip
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
Nursultan_Nextgen.zip
-
Size
97.9MB
-
MD5
9eff264f3d9a7ca42764c9f94d7dd055
-
SHA1
6b1f4d465908eedf63592f699c6bea8a0075f72b
-
SHA256
99b3fa12a8ef18b29156fb8e604cd7a2b11db9f82486ba024ab8c18e1bff997e
-
SHA512
a8a3d256ca210eede32a86bf53fa07e7a14009962826c9b09b511a38f9023a4bec20a810a472eb76c6eab291383913d212826b4dc3e579f82de4e78f54eef5de
-
SSDEEP
3145728:2/pM+wahZ4nNjMtFpB5TW3oAphPJ+R2PIhxru:2/zlZGYHpB1W3oAphPA2Puu
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 4736 powershell.exe 2232 powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1936 mspaint.exe 1936 mspaint.exe 4736 powershell.exe 4736 powershell.exe 4736 powershell.exe 4736 powershell.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 2232 powershell.exe 2232 powershell.exe 1620 taskmgr.exe 1620 taskmgr.exe 2232 powershell.exe 2232 powershell.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1620 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 4736 powershell.exe Token: SeIncreaseQuotaPrivilege 4736 powershell.exe Token: SeSecurityPrivilege 4736 powershell.exe Token: SeTakeOwnershipPrivilege 4736 powershell.exe Token: SeLoadDriverPrivilege 4736 powershell.exe Token: SeSystemProfilePrivilege 4736 powershell.exe Token: SeSystemtimePrivilege 4736 powershell.exe Token: SeProfSingleProcessPrivilege 4736 powershell.exe Token: SeIncBasePriorityPrivilege 4736 powershell.exe Token: SeCreatePagefilePrivilege 4736 powershell.exe Token: SeBackupPrivilege 4736 powershell.exe Token: SeRestorePrivilege 4736 powershell.exe Token: SeShutdownPrivilege 4736 powershell.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeSystemEnvironmentPrivilege 4736 powershell.exe Token: SeRemoteShutdownPrivilege 4736 powershell.exe Token: SeUndockPrivilege 4736 powershell.exe Token: SeManageVolumePrivilege 4736 powershell.exe Token: 33 4736 powershell.exe Token: 34 4736 powershell.exe Token: 35 4736 powershell.exe Token: 36 4736 powershell.exe Token: SeDebugPrivilege 1620 taskmgr.exe Token: SeSystemProfilePrivilege 1620 taskmgr.exe Token: SeCreateGlobalPrivilege 1620 taskmgr.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeIncreaseQuotaPrivilege 2232 powershell.exe Token: SeSecurityPrivilege 2232 powershell.exe Token: SeTakeOwnershipPrivilege 2232 powershell.exe Token: SeLoadDriverPrivilege 2232 powershell.exe Token: SeSystemProfilePrivilege 2232 powershell.exe Token: SeSystemtimePrivilege 2232 powershell.exe Token: SeProfSingleProcessPrivilege 2232 powershell.exe Token: SeIncBasePriorityPrivilege 2232 powershell.exe Token: SeCreatePagefilePrivilege 2232 powershell.exe Token: SeBackupPrivilege 2232 powershell.exe Token: SeRestorePrivilege 2232 powershell.exe Token: SeShutdownPrivilege 2232 powershell.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeSystemEnvironmentPrivilege 2232 powershell.exe Token: SeRemoteShutdownPrivilege 2232 powershell.exe Token: SeUndockPrivilege 2232 powershell.exe Token: SeManageVolumePrivilege 2232 powershell.exe Token: 33 2232 powershell.exe Token: 34 2232 powershell.exe Token: 35 2232 powershell.exe Token: 36 2232 powershell.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1936 mspaint.exe 1936 mspaint.exe 1936 mspaint.exe 1936 mspaint.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2084 2720 cmd.exe 124 PID 2720 wrote to memory of 2084 2720 cmd.exe 124 PID 2720 wrote to memory of 3084 2720 cmd.exe 125 PID 2720 wrote to memory of 3084 2720 cmd.exe 125 PID 2720 wrote to memory of 3700 2720 cmd.exe 126 PID 2720 wrote to memory of 3700 2720 cmd.exe 126 PID 2720 wrote to memory of 4340 2720 cmd.exe 127 PID 2720 wrote to memory of 4340 2720 cmd.exe 127 PID 2720 wrote to memory of 3820 2720 cmd.exe 128 PID 2720 wrote to memory of 3820 2720 cmd.exe 128 PID 2720 wrote to memory of 4736 2720 cmd.exe 129 PID 2720 wrote to memory of 4736 2720 cmd.exe 129 PID 4572 wrote to memory of 2800 4572 cmd.exe 137 PID 4572 wrote to memory of 2800 4572 cmd.exe 137 PID 4572 wrote to memory of 2184 4572 cmd.exe 138 PID 4572 wrote to memory of 2184 4572 cmd.exe 138 PID 4572 wrote to memory of 732 4572 cmd.exe 139 PID 4572 wrote to memory of 732 4572 cmd.exe 139 PID 4572 wrote to memory of 3316 4572 cmd.exe 140 PID 4572 wrote to memory of 3316 4572 cmd.exe 140 PID 4572 wrote to memory of 3068 4572 cmd.exe 141 PID 4572 wrote to memory of 3068 4572 cmd.exe 141 PID 4572 wrote to memory of 2232 4572 cmd.exe 142 PID 4572 wrote to memory of 2232 4572 cmd.exe 142
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Nursultan_Nextgen.zip1⤵PID:1680
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4264
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4236
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat" "1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:2084
-
-
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:3084
-
-
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:3700
-
-
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:4340
-
-
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:3820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1620
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat" "1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:2800
-
-
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:2184
-
-
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:732
-
-
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:3316
-
-
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\Desktop\Nursultan Nextgen\start.bat"2⤵PID:3068
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50a0b9741cb338c26f1594fb7f83df461
SHA1b2fc8014a8629249995bdcc1733e0792260f10c8
SHA25614b3616e9b73bbbd70d1cf8032825a1e5d22550590f08c218b7301a44c1d7bd9
SHA512cc8cf13f94e23596b7a7ef5f551dd7a7c0ff34122ab4ef95c419460505a3cf07c2e0f843674418ff3a728dfbad842a55f810d3f09fcf11ff5155760a22c7e039
-
Filesize
1KB
MD5ac81f5c6e92439551e3282f0ed742456
SHA1df6a6e7bd146ea72bd14d825009c8c376d15a255
SHA256437b9739696f38235a1c3b7b3ff0c2b5ba358847eb2eebdfb415d4849207de19
SHA5128c749399fe5aac0dbcfcc9def2de78937d8c360e45780600000f910b63e278b5be394d2f81b8272e6574b6d64243379857ccf3c6ff95e73263303514c6570329
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
179B
MD57102eac9d4a43f01519ced10a85fabfe
SHA14a194aab982ee18f6489913d642e6db9206be107
SHA2569e6da0d60270007e846a3e29351ea2f83cc6a3546c059e57f9eacf9e6fa2951d
SHA512f19b8c35aa2a672741afa6c858078e849c194b90c4bd7f0560920cf98b6b24625773ee240e7db907889814772d159bc54f396caf37f2cc82ccc6dff16355c1c2
-
Filesize
13B
MD5337065424ed27284c55b80741f912713
SHA10e99e1b388ae66a51a8ffeee3448c3509a694db8
SHA2564ef6f5f73f87cd552bf0dceb245365c44996f94eb72aeb2ccefe440fe055043b
SHA512d9290f0aa33e11da2ec88165b8133623e3f1633a9df8f477dfab395f655dc9a1d2dc82e8eae1d8eeae950ea2dd1e08054e1b258a0f2a0b4d4ca124db08e42e5a
-
Filesize
88B
MD5280326e0ebc76fd9f809343a611a3621
SHA1dce0bee9b26c2359eef7ab82c8a3d43304d7f194
SHA256f0bce1970851ce310574dc9903fe19570ae1a199007e7fb5955395b7500f03f5
SHA5121096734ef225e575b5c81d0d6c993a049791afd60ae24abc7934f4224408b6f2d1918b23e2f90e39fea6afa147cc90e62abb9d2471822cb80b9e1f2ffab331c5