Analysis
-
max time kernel
8s -
max time network
10s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
-
submitted
24/02/2025, 09:50
General
-
Target
PW.exe
-
Size
203KB
-
MD5
b2f82753cb0f4d065662b530924bb50c
-
SHA1
631f130194792d63f7fa75451eb3175422d93af8
-
SHA256
8b4cda9baec878f1dd69acf5e3fe33ef80b4ba84856e6416be9a0f40028329a4
-
SHA512
1c120dd4ae8aed29692ded0fc7099fff5a26a1a26b7d1ebd00af325e5e9617b933419ecd9407ef5dec35482bc9809df1ace9ed482dc9c260f6a6eb0ff5e46466
-
SSDEEP
3072:uzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI7h7UcQkPyI7e6cs1WpdGE9pAs:uLV6Bta6dtJmakIM50Q4T7e6L1qpp
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Nanocore family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PW.exe"C:\Users\Admin\AppData\Local\Temp\PW.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB333.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB382.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5faa6c46bb16e1903ec5525505d34dc46
SHA1cb63d917c4c485a0fa1aea00d63ae1178f6198aa
SHA2566d64b298ce4ef6023264ed81a3722f0be12b0f90d2eab3605872d83b80152ad4
SHA5121ca4367c15452e77fd680f7d065c1658ca4c7745b89ebeb01e7989b99cd2a612a4167f92213529d10829196747c301cf5ce387ae15e99a48fd383d180f426195
-
Filesize
1KB
MD5b2a51432a6710d8ef19e6efb6e7137d0
SHA156116dc0ae3db72911885a7e079eb4459427d7d9
SHA2565ac60125d8aa79e67d5b3a3bd0cac1d0e8bd404da6d383f343c0ec249970db13
SHA5122f372ea8d500ece08da39ea3b6a6b741554b21c48f3d42fd43aba7b7f2822750af36adbf7b2e4504b42964d77145a9bfc5f4a0d8921ffbfb60efde79137e8e2b
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
4.8MB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
40KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
80KB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
392KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB