Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    05-08-2024 03:28

General

  • Target

    NanoCore 1.2.2.0_Fixed_Cracked By Alcatraz3222/Plugins/NanoNana.ncp

  • Size

    157KB

  • MD5

    c5d40b767bd6b97f88ccce13956d0ad8

  • SHA1

    ef7f7fdd9d5ea0b55ffbb17c171ee6a46b347100

  • SHA256

    a3c39444ac74bb91f14f3f2ae6918d9b1d368268e137aca310450fefbc8983aa

  • SHA512

    3fcb5a6afdc7de59bac645d8b4dc6368b0405a51985ff86c95fc8cd579bd59bc423cab940dc0ab3de9a0cd0d9e04dad82e380ef18030330d72b2e72936a95ee1

  • SSDEEP

    3072:LAZbhTaGeC1gufrNv6UDKBK2vUULaC5XnEYW4tb:LAZtjxp97yH8UW2Ew5

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Fixed_Cracked By Alcatraz3222\Plugins\NanoNana.ncp"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Fixed_Cracked By Alcatraz3222\Plugins\NanoNana.ncp
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Fixed_Cracked By Alcatraz3222\Plugins\NanoNana.ncp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    bd6cde7cca81d4f2dd9b480357f74ad5

    SHA1

    2dadefcb926e5e95334fdd813578b4eac753a86b

    SHA256

    8cfbd9b35907c36256751f95ff48d4183df20a8a810404acdfdffafd748d5d6c

    SHA512

    4dc8f96726cd4c75b78277807835215a2d68fc27240c6945bf225aa1cf0d98396e07d2ffa1a11745425e058e2f1c801b85f5ddf343e70a50b6379498872ece45