Analysis
-
max time kernel
207s -
max time network
206s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-12-2024 02:50
General
-
Target
client.exe
-
Size
203KB
-
MD5
74f5229ec05fdb0e5150b41fddb4279a
-
SHA1
441cde89f363f7712cec41360ffbeaa0f480875e
-
SHA256
d27d22f8a8fe189418081c9c97f5ef90194d287c7e383642806ab915ace9b016
-
SHA512
9e115b54468eed5781af82d14a6ba3d7f992d62174249f21403c25ba8263e8363151879a0ef5a91ba3e76f8af4e67e0b9c424d54ba7d740ad4cf4aef311392f9
-
SSDEEP
3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIfKPAGTwjgaxODOeSQcY/UShKH:sLV6Bta6dtJmakIM5vr8PxtPY/1KH
Malware Config
Signatures
-
Nanocore family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe" client.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA client.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\SCSI Subsystem\scsiss.exe client.exe File opened for modification C:\Program Files (x86)\SCSI Subsystem\scsiss.exe client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 576 cmd.exe 4024 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Kills process with taskkill 1 IoCs
pid Process 908 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4024 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2704 schtasks.exe 4260 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 2068 client.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2068 client.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2068 client.exe Token: SeDebugPrivilege 5056 Taskmgr.exe Token: SeSystemProfilePrivilege 5056 Taskmgr.exe Token: SeCreateGlobalPrivilege 5056 Taskmgr.exe Token: SeDebugPrivilege 2068 client.exe Token: SeDebugPrivilege 908 taskkill.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe 5056 Taskmgr.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2704 2068 client.exe 80 PID 2068 wrote to memory of 2704 2068 client.exe 80 PID 2068 wrote to memory of 2704 2068 client.exe 80 PID 2068 wrote to memory of 4260 2068 client.exe 82 PID 2068 wrote to memory of 4260 2068 client.exe 82 PID 2068 wrote to memory of 4260 2068 client.exe 82 PID 2068 wrote to memory of 5056 2068 client.exe 84 PID 2068 wrote to memory of 5056 2068 client.exe 84 PID 2068 wrote to memory of 5056 2068 client.exe 84 PID 2068 wrote to memory of 1736 2068 client.exe 85 PID 2068 wrote to memory of 1736 2068 client.exe 85 PID 2068 wrote to memory of 1736 2068 client.exe 85 PID 2068 wrote to memory of 4544 2068 client.exe 87 PID 2068 wrote to memory of 4544 2068 client.exe 87 PID 2068 wrote to memory of 4544 2068 client.exe 87 PID 2068 wrote to memory of 576 2068 client.exe 89 PID 2068 wrote to memory of 576 2068 client.exe 89 PID 2068 wrote to memory of 576 2068 client.exe 89 PID 576 wrote to memory of 908 576 cmd.exe 91 PID 576 wrote to memory of 908 576 cmd.exe 91 PID 576 wrote to memory of 908 576 cmd.exe 91 PID 576 wrote to memory of 4024 576 cmd.exe 93 PID 576 wrote to memory of 4024 576 cmd.exe 93 PID 576 wrote to memory of 4024 576 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB2C5.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2704
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB324.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4260
-
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5056
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /delete /f /tn "SCSI Subsystem"2⤵
- System Location Discovery: System Language Discovery
PID:1736
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /delete /f /tn "SCSI Subsystem Task"2⤵
- System Location Discovery: System Language Discovery
PID:4544
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /f /im "client.exe" & ping -n 1 -w 3000 1.1.1.1 & type nul > "C:\Users\Admin\AppData\Local\Temp\client.exe" & del /f /q "C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "client.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:908
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 -w 3000 1.1.1.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4024
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54b25c43c4a8a3c8ce6ed59dd27a6d5da
SHA139a1059ae8a14458672fa20053b9214fb0faeba7
SHA2565b4d4a864d877a082656f01ff8fa16ad6305e63d3c0e9df37035a13ffa07d285
SHA51250ebc2b42c5d87b6be155f7c8e950e2826db5cab4b3c895c82c1b0964774c5708a14c33b36e6292e941b2f46092fac3f3adcf4c10f9ff54308b0f6d255331dcf
-
Filesize
1KB
MD5bd110f9fc6c1a842f1d9b269010b0611
SHA1ef71c062902602faef9b66dcd1cfc9fe5baaf389
SHA2568135c4e4eeaa741f752c0ab8f4ee33e3bb8a0cac5923812234f2e5177d50eb5b
SHA512b8a7943a3126880b26407800bbdad5402c5b0e2aa106e7dbbb35d0cb145ca9de114401573a6aa66042a2e13674cfbcc2981d66b813f9b923fff5302210afba1f