Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:07
Behavioral task
behavioral1
Sample
noce.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
noce.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
noce.exe
-
Size
163KB
-
MD5
6ebf9a196cafa58b75b782ece987d8f3
-
SHA1
f3d5fc4ae7de15375421d06e6d79371a6f1253b9
-
SHA256
0a942e6321f9781ac5e1cbbdb2f2f9dd63fc4d6242d126a2b4dc9616ebdf2f8b
-
SHA512
8a82a64c8d9809b23fb6287cbc3ac62ea51e31426e2a1c13c99452761722757b9f7590acf931122673d31a548a1fd42b47e9c0e007817ab83b31c487ad5c83b2
-
SSDEEP
3072:6m8QyMWSVCqwT1h+popOOfaPOx5P+m/pNdhZ1QYUdq:WqwJh+6pAkGm/pH1gdq
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1268 noce.exe 1868 WindowsService.exe 324 WindowsService.exe 1184 WindowsService.exe -
Loads dropped DLL 6 IoCs
pid Process 2728 noce.exe 1268 noce.exe 1268 noce.exe 1268 noce.exe 1268 noce.exe 1268 noce.exe -
resource yara_rule behavioral1/memory/2728-0-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/memory/2728-3-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/memory/2728-138-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/files/0x0010000000015d64-178.dat upx behavioral1/memory/1268-195-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2728-194-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/files/0x0032000000015d5c-232.dat upx behavioral1/memory/1868-238-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/memory/1268-241-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1868-451-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/memory/1268-454-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/324-442-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1868-441-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/memory/324-457-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2728 set thread context of 1268 2728 noce.exe 30 PID 1868 set thread context of 324 1868 WindowsService.exe 35 PID 1868 set thread context of 1184 1868 WindowsService.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language noce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language noce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe Token: SeDebugPrivilege 324 WindowsService.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2728 noce.exe 1268 noce.exe 1868 WindowsService.exe 324 WindowsService.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2728 wrote to memory of 1268 2728 noce.exe 30 PID 2728 wrote to memory of 1268 2728 noce.exe 30 PID 2728 wrote to memory of 1268 2728 noce.exe 30 PID 2728 wrote to memory of 1268 2728 noce.exe 30 PID 2728 wrote to memory of 1268 2728 noce.exe 30 PID 2728 wrote to memory of 1268 2728 noce.exe 30 PID 2728 wrote to memory of 1268 2728 noce.exe 30 PID 2728 wrote to memory of 1268 2728 noce.exe 30 PID 1268 wrote to memory of 2440 1268 noce.exe 31 PID 1268 wrote to memory of 2440 1268 noce.exe 31 PID 1268 wrote to memory of 2440 1268 noce.exe 31 PID 1268 wrote to memory of 2440 1268 noce.exe 31 PID 2440 wrote to memory of 2316 2440 cmd.exe 33 PID 2440 wrote to memory of 2316 2440 cmd.exe 33 PID 2440 wrote to memory of 2316 2440 cmd.exe 33 PID 2440 wrote to memory of 2316 2440 cmd.exe 33 PID 1268 wrote to memory of 1868 1268 noce.exe 34 PID 1268 wrote to memory of 1868 1268 noce.exe 34 PID 1268 wrote to memory of 1868 1268 noce.exe 34 PID 1268 wrote to memory of 1868 1268 noce.exe 34 PID 1868 wrote to memory of 324 1868 WindowsService.exe 35 PID 1868 wrote to memory of 324 1868 WindowsService.exe 35 PID 1868 wrote to memory of 324 1868 WindowsService.exe 35 PID 1868 wrote to memory of 324 1868 WindowsService.exe 35 PID 1868 wrote to memory of 324 1868 WindowsService.exe 35 PID 1868 wrote to memory of 324 1868 WindowsService.exe 35 PID 1868 wrote to memory of 324 1868 WindowsService.exe 35 PID 1868 wrote to memory of 324 1868 WindowsService.exe 35 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36 PID 1868 wrote to memory of 1184 1868 WindowsService.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\noce.exe"C:\Users\Admin\AppData\Local\Temp\noce.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\noce.exe"C:\Users\Admin\AppData\Local\Temp\noce.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BWAXL.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2316
-
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:324
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
PID:1184
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5f6a90c20834f271a907a4e2bc28184c2
SHA136c9d1602b74f622346fbb22693597d7889df48d
SHA25673f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA51239cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804
-
Filesize
163KB
MD56ebf9a196cafa58b75b782ece987d8f3
SHA1f3d5fc4ae7de15375421d06e6d79371a6f1253b9
SHA2560a942e6321f9781ac5e1cbbdb2f2f9dd63fc4d6242d126a2b4dc9616ebdf2f8b
SHA5128a82a64c8d9809b23fb6287cbc3ac62ea51e31426e2a1c13c99452761722757b9f7590acf931122673d31a548a1fd42b47e9c0e007817ab83b31c487ad5c83b2
-
Filesize
163KB
MD5ea6783612a6fc80c7f28b260c58de8a8
SHA106887b0eeecee48cad3bd1f63bdc271f424a8d5b
SHA256337d23a536bca9b6b206266e7914c34dbf9ea1626323a9439ec6b01eb7d25090
SHA51253f82800f5cb24646465064ee09680566dde315525cbb902ff66d128edf1a6f401d3d339f3f4ae7d97723406397493c7eeafd79c1d30433dafc6345d06759e2f