| URL: | https://www.dropbox.com/s/ydo9m1xsemaukj9/PRODUCTS%20SPECIFICATIONS%20AND%20COMPANY%20PROFILE.PDF.rar |
| Full analysis: | https://app.any.run/tasks/de262a1d-c20e-4f8b-b4e8-01eca2b1a258 |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | February 18, 2019, 19:20:34 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | A5D0E8FCF8CDEC9CEBBD983AC647D40B |
| SHA1: | 3D3F16669DC37292AC375C9C9F7817E774855B5A |
| SHA256: | 259052B1F60340B14DAB0C3BAFCB96B5F6AA474AA637DA1FE81081AE37856C21 |
| SSDEEP: | 3:N8DSLcVHGk6OQOkK9FAMqM9LBf5rEjdLq:2OLHk6/ZmASPKdLq |
MALICIOUS
Runs app for hidden code execution
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3456)
Application was dropped or rewritten from another process
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3456)
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3360)
Changes the autorun value in the registry
- reg.exe (PID: 2688)
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3360)
Writes to a start menu file
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3456)
NanoCore was detected
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3360)
Connects to CnC server
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3360)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2616)
- cmd.exe (PID: 3500)
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3456)
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3360)
Creates files in the user directory
- cmd.exe (PID: 3500)
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3456)
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3360)
Starts CMD.EXE for commands execution
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3456)
Uses REG.EXE to modify Windows registry
- cmd.exe (PID: 3500)
Application launched itself
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3456)
Connects to unusual port
- PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe (PID: 3360)
INFO
Application launched itself
- chrome.exe (PID: 2876)
Reads Internet Cache Settings
- chrome.exe (PID: 2876)
Reads settings of System Certificates
- chrome.exe (PID: 2876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
49
Monitored processes
17
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1140 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=960,1112433181398300262,13346142530850764726,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=F486925E31A85CADA40E2535478203EE --mojo-platform-channel-handle=1104 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2584 | cmd /c C:\Users\admin\AppData\Roaming\FolderNext\namexe.exe.bat | C:\Windows\system32\cmd.exe | — | PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2616 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.PDF.rar" | C:\Program Files\WinRAR\WinRAR.exe | chrome.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2688 | reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\admin\AppData\Roaming\FolderNext\namexe.exe.lnk" /f | C:\Windows\system32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2732 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=960,1112433181398300262,13346142530850764726,131072 --enable-features=PasswordImport --service-pipe-token=9FA4BEFECCF0649080EA9ECA35DF4D97 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9FA4BEFECCF0649080EA9ECA35DF4D97 --renderer-client-id=4 --mojo-platform-channel-handle=1916 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2876 | "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.dropbox.com/s/ydo9m1xsemaukj9/PRODUCTS%20SPECIFICATIONS%20AND%20COMPANY%20PROFILE.PDF.rar | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2888 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2880 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 3172 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3216 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=960,1112433181398300262,13346142530850764726,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=4FEF34348442770C89074C9130F04274 --mojo-platform-channel-handle=4112 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 3220 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=960,1112433181398300262,13346142530850764726,131072 --enable-features=PasswordImport --service-pipe-token=4403F15F4451589A1FF7394D871C375F --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4403F15F4451589A1FF7394D871C375F --renderer-client-id=3 --mojo-platform-channel-handle=2132 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
Total events
1 544
Read events
1 477
Write events
64
Delete events
3
Modification events
| (PID) Process: | (2876) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2876) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2876) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2888) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 2876-13194991254960875 |
Value: 259 | |||
| (PID) Process: | (2876) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2876) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2876) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3516-13180984670829101 |
Value: 0 | |||
| (PID) Process: | (2876) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (2876) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 2876-13194991254960875 |
Value: 259 | |||
| (PID) Process: | (2876) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
Executable files
4
Suspicious files
60
Text files
71
Unknown types
11
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\4885c84c-f87b-4fb4-b3f5-54fda65b4702.tmp | — | |
MD5:— | SHA256:— | |||
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\21d68852-d64b-4456-9f6d-779367cd0a90.tmp | — | |
MD5:— | SHA256:— | |||
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF198f94.TMP | text | |
MD5:— | SHA256:— | |||
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:— | SHA256:— | |||
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF198fb3.TMP | text | |
MD5:— | SHA256:— | |||
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old~RF198fc3.TMP | text | |
MD5:— | SHA256:— | |||
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Temp\Cab93CA.tmp | — | |
MD5:— | SHA256:— | |||
| 2876 | chrome.exe | C:\Users\admin\AppData\Local\Temp\Tar93CB.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
58
DNS requests
37
Threats
24
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2876 | chrome.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D | US | der | 471 b | whitelisted |
2876 | chrome.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAU5fm3dSuY9dJCdoTinHgw%3D | US | der | 471 b | whitelisted |
2876 | chrome.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAOjB9Rp1w6gbD2SMpoia4w%3D | US | der | 471 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2876 | chrome.exe | 172.217.21.195:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2876 | chrome.exe | 172.217.16.195:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2876 | chrome.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2876 | chrome.exe | 172.217.22.109:443 | accounts.google.com | Google Inc. | US | whitelisted |
2876 | chrome.exe | 172.217.16.170:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
2876 | chrome.exe | 216.58.206.10:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2876 | chrome.exe | 162.125.248.1:443 | dropbox.com | Dropbox, Inc. | US | shared |
2876 | chrome.exe | 216.58.210.14:443 | clients1.google.com | Google Inc. | US | whitelisted |
2876 | chrome.exe | 172.217.16.131:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
2876 | chrome.exe | 104.16.99.29:443 | cfl.dropboxstatic.com | Cloudflare Inc | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.gstatic.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
www.dropbox.com |
| shared |
accounts.google.com |
| shared |
ocsp.digicert.com |
| whitelisted |
cfl.dropboxstatic.com |
| shared |
safebrowsing.googleapis.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
dropbox.com |
| shared |
fonts.gstatic.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2876 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY Dropbox.com Offsite File Backup in Use |
2876 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY Dropbox.com Offsite File Backup in Use |
3360 | PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe | A Network Trojan was detected | ET TROJAN Possible NanoCore C2 60B |
3360 | PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
3360 | PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
3360 | PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
3360 | PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
3360 | PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
3360 | PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
3360 | PRODUCTS SPECIFICATIONS AND COMPANY PROFILE.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
11 ETPRO signatures available at the full report