Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 21:01
Static task
static1
Behavioral task
behavioral1
Sample
5a42e2442b79943419bf0e39ad7be827.exe
Resource
win7-20240611-en
General
-
Target
5a42e2442b79943419bf0e39ad7be827.exe
-
Size
600KB
-
MD5
5a42e2442b79943419bf0e39ad7be827
-
SHA1
1a4a5d7594fbdfb3189915502a63c801a2180389
-
SHA256
b449b20b95c94cd1dc77a0edbd7eb8c183392ff0bbb53f2ca374d129f5ace20a
-
SHA512
f18e569b0fc487b77fbe55cb7beadfac99723d5ab0111d03e62bee1cb01db3b8bd6f97a050f95768f77f5eaddf78bf08f7f12ba4ffa52bd7e8e55a60bb4167ed
-
SSDEEP
12288:U9PcfpbzzGwWjZK2P5VQiYwhKrmXLZNa8pKp1wFqexdCZMxZ3Q:viDj7xVQi9hOmXowFTCZQtQ
Malware Config
Extracted
nanocore
1.2.2.0
newsddawork.3utilities.com:1620
maxlogs.webhop.me:1620
1fa46b72-10f9-4da3-bc15-84dde165706d
-
activate_away_mode
true
-
backup_connection_host
maxlogs.webhop.me
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-02-17T03:41:10.727034736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1620
-
default_group
NewBin
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
1fa46b72-10f9-4da3-bc15-84dde165706d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
newsddawork.3utilities.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5a42e2442b79943419bf0e39ad7be827.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation 5a42e2442b79943419bf0e39ad7be827.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Subsystem = "C:\\Program Files (x86)\\WPA Subsystem\\wpass.exe" MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5a42e2442b79943419bf0e39ad7be827.exedescription pid process target process PID 1516 set thread context of 1168 1516 5a42e2442b79943419bf0e39ad7be827.exe MSBuild.exe -
Drops file in Program Files directory 2 IoCs
Processes:
MSBuild.exedescription ioc process File created C:\Program Files (x86)\WPA Subsystem\wpass.exe MSBuild.exe File opened for modification C:\Program Files (x86)\WPA Subsystem\wpass.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
5a42e2442b79943419bf0e39ad7be827.exepowershell.exeMSBuild.exepid process 1516 5a42e2442b79943419bf0e39ad7be827.exe 4584 powershell.exe 1516 5a42e2442b79943419bf0e39ad7be827.exe 4584 powershell.exe 1168 MSBuild.exe 1168 MSBuild.exe 1168 MSBuild.exe 1168 MSBuild.exe 1168 MSBuild.exe 1168 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 1168 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
5a42e2442b79943419bf0e39ad7be827.exepowershell.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1516 5a42e2442b79943419bf0e39ad7be827.exe Token: SeDebugPrivilege 4584 powershell.exe Token: SeDebugPrivilege 1168 MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
5a42e2442b79943419bf0e39ad7be827.exedescription pid process target process PID 1516 wrote to memory of 4584 1516 5a42e2442b79943419bf0e39ad7be827.exe powershell.exe PID 1516 wrote to memory of 4584 1516 5a42e2442b79943419bf0e39ad7be827.exe powershell.exe PID 1516 wrote to memory of 4584 1516 5a42e2442b79943419bf0e39ad7be827.exe powershell.exe PID 1516 wrote to memory of 492 1516 5a42e2442b79943419bf0e39ad7be827.exe schtasks.exe PID 1516 wrote to memory of 492 1516 5a42e2442b79943419bf0e39ad7be827.exe schtasks.exe PID 1516 wrote to memory of 492 1516 5a42e2442b79943419bf0e39ad7be827.exe schtasks.exe PID 1516 wrote to memory of 1168 1516 5a42e2442b79943419bf0e39ad7be827.exe MSBuild.exe PID 1516 wrote to memory of 1168 1516 5a42e2442b79943419bf0e39ad7be827.exe MSBuild.exe PID 1516 wrote to memory of 1168 1516 5a42e2442b79943419bf0e39ad7be827.exe MSBuild.exe PID 1516 wrote to memory of 1168 1516 5a42e2442b79943419bf0e39ad7be827.exe MSBuild.exe PID 1516 wrote to memory of 1168 1516 5a42e2442b79943419bf0e39ad7be827.exe MSBuild.exe PID 1516 wrote to memory of 1168 1516 5a42e2442b79943419bf0e39ad7be827.exe MSBuild.exe PID 1516 wrote to memory of 1168 1516 5a42e2442b79943419bf0e39ad7be827.exe MSBuild.exe PID 1516 wrote to memory of 1168 1516 5a42e2442b79943419bf0e39ad7be827.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a42e2442b79943419bf0e39ad7be827.exe"C:\Users\Admin\AppData\Local\Temp\5a42e2442b79943419bf0e39ad7be827.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zzTmYAoKh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zzTmYAoKh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D02.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ctlhq3wd.4ci.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp6D02.tmpFilesize
1KB
MD52b5b9a2599463629310ea96d17b97fab
SHA1c226ce31bd8580d4f1537eac160201801f4fcbdd
SHA256f86c23e891fba57801193907a3262f0b832b8ebd2df68f9617c1cbb09c98b717
SHA51281136fc4a19ab1f2747ed331f14c63e37d782303ff0d5189d9979b04a439663ba9c60fe886652d3ea3644b4f1eb31ca7ca0fafa36e51bcc736616fc3d7e00b0c
-
memory/1168-76-0x0000000006990000-0x000000000699E000-memory.dmpFilesize
56KB
-
memory/1168-27-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/1168-77-0x00000000069A0000-0x00000000069B2000-memory.dmpFilesize
72KB
-
memory/1168-44-0x0000000006200000-0x000000000620A000-memory.dmpFilesize
40KB
-
memory/1168-43-0x00000000060D0000-0x00000000060EE000-memory.dmpFilesize
120KB
-
memory/1168-42-0x0000000005450000-0x000000000545A000-memory.dmpFilesize
40KB
-
memory/1168-74-0x0000000006950000-0x0000000006962000-memory.dmpFilesize
72KB
-
memory/1168-78-0x00000000069B0000-0x00000000069BC000-memory.dmpFilesize
48KB
-
memory/1168-85-0x0000000006A70000-0x0000000006A84000-memory.dmpFilesize
80KB
-
memory/1168-79-0x00000000069C0000-0x00000000069CE000-memory.dmpFilesize
56KB
-
memory/1168-81-0x00000000069E0000-0x00000000069F0000-memory.dmpFilesize
64KB
-
memory/1168-87-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/1168-84-0x0000000006A30000-0x0000000006A5E000-memory.dmpFilesize
184KB
-
memory/1168-80-0x00000000069D0000-0x00000000069E4000-memory.dmpFilesize
80KB
-
memory/1168-82-0x0000000006A00000-0x0000000006A14000-memory.dmpFilesize
80KB
-
memory/1168-75-0x0000000006960000-0x000000000697A000-memory.dmpFilesize
104KB
-
memory/1168-83-0x0000000006A20000-0x0000000006A2E000-memory.dmpFilesize
56KB
-
memory/1168-23-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1516-8-0x0000000006720000-0x00000000067B2000-memory.dmpFilesize
584KB
-
memory/1516-0-0x00000000744DE000-0x00000000744DF000-memory.dmpFilesize
4KB
-
memory/1516-12-0x00000000063C0000-0x000000000643A000-memory.dmpFilesize
488KB
-
memory/1516-11-0x0000000006390000-0x000000000639C000-memory.dmpFilesize
48KB
-
memory/1516-30-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/1516-10-0x0000000004F70000-0x0000000004F78000-memory.dmpFilesize
32KB
-
memory/1516-9-0x0000000004E90000-0x0000000004EA2000-memory.dmpFilesize
72KB
-
memory/1516-7-0x0000000005A60000-0x0000000005F8C000-memory.dmpFilesize
5.2MB
-
memory/1516-6-0x0000000004CA0000-0x0000000004D3C000-memory.dmpFilesize
624KB
-
memory/1516-5-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/1516-4-0x0000000004A80000-0x0000000004A8A000-memory.dmpFilesize
40KB
-
memory/1516-3-0x00000000049D0000-0x0000000004A62000-memory.dmpFilesize
584KB
-
memory/1516-2-0x0000000004F80000-0x0000000005524000-memory.dmpFilesize
5.6MB
-
memory/1516-1-0x0000000000080000-0x000000000011C000-memory.dmpFilesize
624KB
-
memory/4584-18-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4584-59-0x0000000007580000-0x0000000007623000-memory.dmpFilesize
652KB
-
memory/4584-60-0x0000000007CF0000-0x000000000836A000-memory.dmpFilesize
6.5MB
-
memory/4584-61-0x00000000076B0000-0x00000000076CA000-memory.dmpFilesize
104KB
-
memory/4584-63-0x0000000007720000-0x000000000772A000-memory.dmpFilesize
40KB
-
memory/4584-64-0x0000000007930000-0x00000000079C6000-memory.dmpFilesize
600KB
-
memory/4584-65-0x00000000078B0000-0x00000000078C1000-memory.dmpFilesize
68KB
-
memory/4584-66-0x00000000078E0000-0x00000000078EE000-memory.dmpFilesize
56KB
-
memory/4584-67-0x00000000078F0000-0x0000000007904000-memory.dmpFilesize
80KB
-
memory/4584-68-0x00000000079F0000-0x0000000007A0A000-memory.dmpFilesize
104KB
-
memory/4584-69-0x00000000079D0000-0x00000000079D8000-memory.dmpFilesize
32KB
-
memory/4584-72-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4584-58-0x0000000006940000-0x000000000695E000-memory.dmpFilesize
120KB
-
memory/4584-48-0x0000000070520000-0x000000007056C000-memory.dmpFilesize
304KB
-
memory/4584-47-0x0000000007340000-0x0000000007372000-memory.dmpFilesize
200KB
-
memory/4584-46-0x0000000006420000-0x000000000646C000-memory.dmpFilesize
304KB
-
memory/4584-45-0x0000000006390000-0x00000000063AE000-memory.dmpFilesize
120KB
-
memory/4584-29-0x0000000005D50000-0x00000000060A4000-memory.dmpFilesize
3.3MB
-
memory/4584-24-0x00000000054E0000-0x0000000005502000-memory.dmpFilesize
136KB
-
memory/4584-25-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/4584-26-0x0000000005C20000-0x0000000005C86000-memory.dmpFilesize
408KB
-
memory/4584-22-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4584-20-0x0000000005510000-0x0000000005B38000-memory.dmpFilesize
6.2MB
-
memory/4584-21-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4584-17-0x0000000004DC0000-0x0000000004DF6000-memory.dmpFilesize
216KB