nanocore | 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d

Analysis

max time kernel
267s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
15-08-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
Size

384KB
MD5

27aa8ad8930fa0d076510cfb6573ce74
SHA1

26da6ec9efcd8b95c2d744373532afd12d26bf8f
SHA256

91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d
SHA512

bb1af7c9caf9d05e6bf2ebf3ff8fbada74c0e4fbac04759428da3766110b66a8966081b22c0ffc4dc3a141a0914e552a6fc0a766c037c438546e8d4124f5922f
SSDEEP

6144:6JHf/OboJwboxHcE2Heo6e+qFCKs7cDZGrBKdt7cWZGbpYByPT7lyvIcbSIvF68U:c3VwboxHc8o6epUVKd9cWvByPHly5WIl

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

blackangel.hopto.org:54984

Mutex

f71cda30-fa3d-4402-acaf-cf2c8c816f12

Attributes

activate_away_mode
true
backup_connection_host
blackangel.hopto.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-04-20T19:45:18.703376436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f71cda30-fa3d-4402-acaf-cf2c8c816f12
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
blackangel.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 10 IoCs

pid	Process
3080	microsoft.exe
3844	microsoft.exe
1872	microsoft.exe
4772	microsoft.exe
2064	microsoft.exe
648	microsoft.exe
1936	microsoft.exe
3400	microsoft.exe
4504	microsoft.exe
2184	microsoft.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisvc.exe"	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3400 set thread context of 2168	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	73
PID 3080 set thread context of 3844	3080	microsoft.exe	82
PID 1872 set thread context of 4772	1872	microsoft.exe	91
PID 2064 set thread context of 648	2064	microsoft.exe	100
PID 1936 set thread context of 3400	1936	microsoft.exe	109
PID 4504 set thread context of 2184	4504	microsoft.exe	118

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DPI Service\dpisvc.exe	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
File opened for modification	C:\Program Files (x86)\DPI Service\dpisvc.exe	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1372	schtasks.exe
4652	schtasks.exe
2320	schtasks.exe
4224	schtasks.exe
1692	schtasks.exe
656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2168	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
2168	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
2168	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
2168	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
2168	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
2168	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2168	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 2168	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	73
PID 3400 wrote to memory of 2168	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	73
PID 3400 wrote to memory of 2168	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	73
PID 3400 wrote to memory of 2168	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	73
PID 3400 wrote to memory of 2168	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	73
PID 3400 wrote to memory of 2168	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	73
PID 3400 wrote to memory of 2168	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	73
PID 3400 wrote to memory of 2168	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	73
PID 3400 wrote to memory of 208	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	74
PID 3400 wrote to memory of 208	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	74
PID 3400 wrote to memory of 208	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	74
PID 3400 wrote to memory of 1092	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	76
PID 3400 wrote to memory of 1092	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	76
PID 3400 wrote to memory of 1092	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	76
PID 1092 wrote to memory of 1372	1092	cmd.exe	78
PID 1092 wrote to memory of 1372	1092	cmd.exe	78
PID 1092 wrote to memory of 1372	1092	cmd.exe	78
PID 3400 wrote to memory of 3076	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	79
PID 3400 wrote to memory of 3076	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	79
PID 3400 wrote to memory of 3076	3400	91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe	79
PID 3080 wrote to memory of 3844	3080	microsoft.exe	82
PID 3080 wrote to memory of 3844	3080	microsoft.exe	82
PID 3080 wrote to memory of 3844	3080	microsoft.exe	82
PID 3080 wrote to memory of 3844	3080	microsoft.exe	82
PID 3080 wrote to memory of 3844	3080	microsoft.exe	82
PID 3080 wrote to memory of 3844	3080	microsoft.exe	82
PID 3080 wrote to memory of 3844	3080	microsoft.exe	82
PID 3080 wrote to memory of 3844	3080	microsoft.exe	82
PID 3080 wrote to memory of 2000	3080	microsoft.exe	83
PID 3080 wrote to memory of 2000	3080	microsoft.exe	83
PID 3080 wrote to memory of 2000	3080	microsoft.exe	83
PID 3080 wrote to memory of 2880	3080	microsoft.exe	85
PID 3080 wrote to memory of 2880	3080	microsoft.exe	85
PID 3080 wrote to memory of 2880	3080	microsoft.exe	85
PID 2880 wrote to memory of 4652	2880	cmd.exe	87
PID 2880 wrote to memory of 4652	2880	cmd.exe	87
PID 2880 wrote to memory of 4652	2880	cmd.exe	87
PID 3080 wrote to memory of 2980	3080	microsoft.exe	88
PID 3080 wrote to memory of 2980	3080	microsoft.exe	88
PID 3080 wrote to memory of 2980	3080	microsoft.exe	88
PID 1872 wrote to memory of 4772	1872	microsoft.exe	91
PID 1872 wrote to memory of 4772	1872	microsoft.exe	91
PID 1872 wrote to memory of 4772	1872	microsoft.exe	91
PID 1872 wrote to memory of 4772	1872	microsoft.exe	91
PID 1872 wrote to memory of 4772	1872	microsoft.exe	91
PID 1872 wrote to memory of 4772	1872	microsoft.exe	91
PID 1872 wrote to memory of 4772	1872	microsoft.exe	91
PID 1872 wrote to memory of 4772	1872	microsoft.exe	91
PID 1872 wrote to memory of 4760	1872	microsoft.exe	92
PID 1872 wrote to memory of 4760	1872	microsoft.exe	92
PID 1872 wrote to memory of 4760	1872	microsoft.exe	92
PID 1872 wrote to memory of 2164	1872	microsoft.exe	94
PID 1872 wrote to memory of 2164	1872	microsoft.exe	94
PID 1872 wrote to memory of 2164	1872	microsoft.exe	94
PID 2164 wrote to memory of 2320	2164	cmd.exe	96
PID 2164 wrote to memory of 2320	2164	cmd.exe	96
PID 2164 wrote to memory of 2320	2164	cmd.exe	96
PID 1872 wrote to memory of 4688	1872	microsoft.exe	97
PID 1872 wrote to memory of 4688	1872	microsoft.exe	97
PID 1872 wrote to memory of 4688	1872	microsoft.exe	97
PID 2064 wrote to memory of 648	2064	microsoft.exe	100
PID 2064 wrote to memory of 648	2064	microsoft.exe	100
PID 2064 wrote to memory of 648	2064	microsoft.exe	100
PID 2064 wrote to memory of 648	2064	microsoft.exe	100

C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
"C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
  "C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3076

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2980

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4688

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4244

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1936
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4932

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4504
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\microsoft.exe.log

Filesize
520B

MD5
807cb75397a3a9fc38e9fb5f8566eb2d

SHA1
367e151fab5a5a80e60202d287ae522ea53e2563

SHA256
3e5056b73303b361e6b7b52f5edb2ed1a7e9dc2c762bb91d18046f42bc2ffcf3

SHA512
49efef0401ba0e0dc0b30bdff5d414da5494e4194c6269da2cb40b1ab7dc53e7858d29d2b9982bf3ee60ebc9638b5ed2b5ddcbb536bcc57729e79fc81f59f13d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\microsoft.exe

Filesize
384KB

MD5
27aa8ad8930fa0d076510cfb6573ce74

SHA1
26da6ec9efcd8b95c2d744373532afd12d26bf8f

SHA256
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d

SHA512
bb1af7c9caf9d05e6bf2ebf3ff8fbada74c0e4fbac04759428da3766110b66a8966081b22c0ffc4dc3a141a0914e552a6fc0a766c037c438546e8d4124f5922f

Download Submit
memory/2168-19-0x00000000736D0000-0x0000000073DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-44-0x00000000070B0000-0x00000000070DE000-memory.dmp

Filesize
184KB

Download
memory/2168-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2168-5-0x00000000736D0000-0x0000000073DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-6-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/2168-7-0x0000000005800000-0x000000000589C000-memory.dmp

Filesize
624KB

Download
memory/2168-8-0x00000000736D0000-0x0000000073DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-12-0x0000000005720000-0x000000000572A000-memory.dmp

Filesize
40KB

Download
memory/2168-45-0x00000000070F0000-0x0000000007104000-memory.dmp

Filesize
80KB

Download
memory/2168-16-0x0000000005990000-0x000000000599A000-memory.dmp

Filesize
40KB

Download
memory/2168-17-0x00000000063E0000-0x00000000063FE000-memory.dmp

Filesize
120KB

Download
memory/2168-18-0x0000000006510000-0x000000000651A000-memory.dmp

Filesize
40KB

Download
memory/2168-46-0x00000000072F0000-0x0000000007356000-memory.dmp

Filesize
408KB

Download
memory/2168-20-0x00000000736D0000-0x0000000073DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-37-0x0000000007030000-0x000000000703E000-memory.dmp

Filesize
56KB

Download
memory/2168-43-0x0000000007090000-0x000000000709E000-memory.dmp

Filesize
56KB

Download
memory/2168-35-0x0000000006520000-0x0000000006532000-memory.dmp

Filesize
72KB

Download
memory/2168-36-0x0000000006FF0000-0x000000000700A000-memory.dmp

Filesize
104KB

Download
memory/2168-42-0x0000000007080000-0x0000000007094000-memory.dmp

Filesize
80KB

Download
memory/2168-38-0x0000000007040000-0x000000000704E000-memory.dmp

Filesize
56KB

Download
memory/2168-39-0x0000000007050000-0x000000000705C000-memory.dmp

Filesize
48KB

Download
memory/2168-40-0x0000000007060000-0x0000000007074000-memory.dmp

Filesize
80KB

Download
memory/2168-41-0x0000000007070000-0x0000000007080000-memory.dmp

Filesize
64KB

Download
memory/3400-2-0x00000000052C0000-0x00000000057BE000-memory.dmp

Filesize
5.0MB

Download
memory/3400-1-0x0000000000560000-0x00000000005C6000-memory.dmp

Filesize
408KB

Download
memory/3400-3-0x00000000736D0000-0x0000000073DBE000-memory.dmp

Filesize
6.9MB

Download
memory/3400-13-0x00000000736D0000-0x0000000073DBE000-memory.dmp

Filesize
6.9MB

Download
memory/3400-0-0x00000000736DE000-0x00000000736DF000-memory.dmp

Filesize
4KB

Download