Analysis
-
max time kernel
88s -
max time network
115s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-11-2024 12:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
nurik.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
23 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
nurik.exe
-
Size
333KB
-
MD5
f6e15a4eba5f1bcfd4c60ad8c4b2f9b7
-
SHA1
e929b611283987c4dc213b7ce786bb5762fbcaaf
-
SHA256
bcd7b068992fb848fc3ba76021b3e095d0a0682c17146b4d836fa2a7846a2e0f
-
SHA512
474c63a3dc03ddc3baf0463723ac991bd0cec08ebeaa64b867c91ae8624bbe37e1b1011e05f55ed7f1135f96931d654b243e8634d6dc367bd5ced05a6c1d7070
-
SSDEEP
6144:ChCaXLv7nv96n5wmrHtU0wd9vKPoYYqUOiD:gbnFLUNeYYq7
Malware Config
Signatures
-
Processes:
1891a9f000924ff9afea8af30362cd90.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1891a9f000924ff9afea8af30362cd90.exe -
Processes:
1891a9f000924ff9afea8af30362cd90.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 1891a9f000924ff9afea8af30362cd90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1891a9f000924ff9afea8af30362cd90.exe = "0" 1891a9f000924ff9afea8af30362cd90.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
Processes:
1891a9f000924ff9afea8af30362cd90.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1891a9f000924ff9afea8af30362cd90.exe" 1891a9f000924ff9afea8af30362cd90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 1891a9f000924ff9afea8af30362cd90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1891a9f000924ff9afea8af30362cd90.exe" 1891a9f000924ff9afea8af30362cd90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1891a9f000924ff9afea8af30362cd90.exe" 1891a9f000924ff9afea8af30362cd90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe 1891a9f000924ff9afea8af30362cd90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "\"cmd.exe\",\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1891a9f000924ff9afea8af30362cd90.exe\"" 1891a9f000924ff9afea8af30362cd90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1891a9f000924ff9afea8af30362cd90.exe" 1891a9f000924ff9afea8af30362cd90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe 1891a9f000924ff9afea8af30362cd90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1891a9f000924ff9afea8af30362cd90.exe" 1891a9f000924ff9afea8af30362cd90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe 1891a9f000924ff9afea8af30362cd90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 1891a9f000924ff9afea8af30362cd90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 1891a9f000924ff9afea8af30362cd90.exe -
Executes dropped EXE 1 IoCs
Processes:
1891a9f000924ff9afea8af30362cd90.exepid Process 4576 1891a9f000924ff9afea8af30362cd90.exe -
Processes:
1891a9f000924ff9afea8af30362cd90.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 1891a9f000924ff9afea8af30362cd90.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 1891a9f000924ff9afea8af30362cd90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1891a9f000924ff9afea8af30362cd90.exe = "0" 1891a9f000924ff9afea8af30362cd90.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
nurik.exe1891a9f000924ff9afea8af30362cd90.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\nurik.exe\" .." nurik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Qwe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1891a9f000924ff9afea8af30362cd90.exe" 1891a9f000924ff9afea8af30362cd90.exe Set value (str) \REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\nurik.exe\" .." nurik.exe -
Processes:
1891a9f000924ff9afea8af30362cd90.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1891a9f000924ff9afea8af30362cd90.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
1891a9f000924ff9afea8af30362cd90.exedescription ioc Process File opened for modification \??\PhysicalDrive0 1891a9f000924ff9afea8af30362cd90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
nurik.exeTASKKILL.exeTASKKILL.exeTASKKILL.exeschtasks.exeschtasks.exeTASKKILL.exe1891a9f000924ff9afea8af30362cd90.exenurik.exetaskkill.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nurik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1891a9f000924ff9afea8af30362cd90.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nurik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 5 IoCs
Processes:
TASKKILL.exeTASKKILL.exeTASKKILL.exetaskkill.exeTASKKILL.exepid Process 3312 TASKKILL.exe 2020 TASKKILL.exe 3460 TASKKILL.exe 3968 taskkill.exe 2940 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
nurik.exepid Process 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe 4520 nurik.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
nurik.exeTASKKILL.exeTASKKILL.exeTASKKILL.exeTASKKILL.exenurik.exe1891a9f000924ff9afea8af30362cd90.exepowershell.exedescription pid Process Token: SeDebugPrivilege 4520 nurik.exe Token: SeDebugPrivilege 2020 TASKKILL.exe Token: SeDebugPrivilege 3460 TASKKILL.exe Token: 33 4520 nurik.exe Token: SeIncBasePriorityPrivilege 4520 nurik.exe Token: 33 4520 nurik.exe Token: SeIncBasePriorityPrivilege 4520 nurik.exe Token: 33 4520 nurik.exe Token: SeIncBasePriorityPrivilege 4520 nurik.exe Token: 33 4520 nurik.exe Token: SeIncBasePriorityPrivilege 4520 nurik.exe Token: 33 4520 nurik.exe Token: SeIncBasePriorityPrivilege 4520 nurik.exe Token: 33 4520 nurik.exe Token: SeIncBasePriorityPrivilege 4520 nurik.exe Token: SeDebugPrivilege 2940 TASKKILL.exe Token: SeDebugPrivilege 3312 TASKKILL.exe Token: SeDebugPrivilege 4664 nurik.exe Token: 33 4520 nurik.exe Token: SeIncBasePriorityPrivilege 4520 nurik.exe Token: 33 4520 nurik.exe Token: SeIncBasePriorityPrivilege 4520 nurik.exe Token: SeBackupPrivilege 4576 1891a9f000924ff9afea8af30362cd90.exe Token: SeRestorePrivilege 4576 1891a9f000924ff9afea8af30362cd90.exe Token: SeDebugPrivilege 4576 1891a9f000924ff9afea8af30362cd90.exe Token: SeDebugPrivilege 848 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
nurik.exenurik.exe1891a9f000924ff9afea8af30362cd90.exedescription pid Process procid_target PID 4520 wrote to memory of 2020 4520 nurik.exe 79 PID 4520 wrote to memory of 2020 4520 nurik.exe 79 PID 4520 wrote to memory of 2020 4520 nurik.exe 79 PID 4520 wrote to memory of 3460 4520 nurik.exe 80 PID 4520 wrote to memory of 3460 4520 nurik.exe 80 PID 4520 wrote to memory of 3460 4520 nurik.exe 80 PID 4520 wrote to memory of 3968 4520 nurik.exe 85 PID 4520 wrote to memory of 3968 4520 nurik.exe 85 PID 4520 wrote to memory of 3968 4520 nurik.exe 85 PID 4520 wrote to memory of 1996 4520 nurik.exe 87 PID 4520 wrote to memory of 1996 4520 nurik.exe 87 PID 4520 wrote to memory of 1996 4520 nurik.exe 87 PID 4520 wrote to memory of 784 4520 nurik.exe 89 PID 4520 wrote to memory of 784 4520 nurik.exe 89 PID 4520 wrote to memory of 784 4520 nurik.exe 89 PID 4664 wrote to memory of 2940 4664 nurik.exe 92 PID 4664 wrote to memory of 2940 4664 nurik.exe 92 PID 4664 wrote to memory of 2940 4664 nurik.exe 92 PID 4664 wrote to memory of 3312 4664 nurik.exe 94 PID 4664 wrote to memory of 3312 4664 nurik.exe 94 PID 4664 wrote to memory of 3312 4664 nurik.exe 94 PID 4520 wrote to memory of 4576 4520 nurik.exe 96 PID 4520 wrote to memory of 4576 4520 nurik.exe 96 PID 4520 wrote to memory of 4576 4520 nurik.exe 96 PID 4576 wrote to memory of 4704 4576 1891a9f000924ff9afea8af30362cd90.exe 98 PID 4576 wrote to memory of 4704 4576 1891a9f000924ff9afea8af30362cd90.exe 98 PID 4576 wrote to memory of 848 4576 1891a9f000924ff9afea8af30362cd90.exe 99 PID 4576 wrote to memory of 848 4576 1891a9f000924ff9afea8af30362cd90.exe 99 -
System policy modification 1 TTPs 3 IoCs
Processes:
1891a9f000924ff9afea8af30362cd90.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 1891a9f000924ff9afea8af30362cd90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1891a9f000924ff9afea8af30362cd90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" 1891a9f000924ff9afea8af30362cd90.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nurik.exe"C:\Users\Admin\AppData\Local\Temp\nurik.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im Wireshark.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3968
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:1996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\nurik.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:784
-
-
C:\Users\Admin\AppData\Local\Temp\1891a9f000924ff9afea8af30362cd90.exe"C:\Users\Admin\AppData\Local\Temp\1891a9f000924ff9afea8af30362cd90.exe"2⤵
- UAC bypass
- Windows security bypass
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4576 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /tn "GoogleUpdateTaskMachineUK" /sc MINUTE /mo 1 /tr "C:\Users\Admin\AppData\Local\Temp\1891a9f000924ff9afea8af30362cd90.exe" /rl HIGHEST /f3⤵PID:4704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1891a9f000924ff9afea8af30362cd90.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-
-
C:\Users\Admin\AppData\Local\Temp\nurik.exeC:\Users\Admin\AppData\Local\Temp\nurik.exe1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3508
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
529KB
MD5d4a2e9c2470e0a8d6da5bf55a55af4c7
SHA1c2d2b46c1647f9ee47c57e0e689e969a558ff38a
SHA2560308f3e960c42d9cea793b31dd9b60c2a01c4892370575336d98ea42d2e91098
SHA51251b3866504427dfcd57b1c27057585fd4a5c830bad92cefc23ff9d7dd20bb801bf66de1aa41b69c41e4e8699de6ef85955e1a712d1ffbaa7cab9161de87d8460
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82