| File name: | Uzi Clicker Crack.zip |
| Full analysis: | https://app.any.run/tasks/24ae3e36-ad42-4497-9a03-eb389acf146c |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | July 25, 2022, 18:02:33 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract |
| MD5: | CB4DB822E9F99F99C6A2EA29919BB98D |
| SHA1: | 01D5E5C32CDEA9B1D1FD6BE5655C145CB19890EC |
| SHA256: | 32DEC53C04B704CD6DD821CE91081A95965092EAF80F66137A3A93D3508EC38E |
| SSDEEP: | 6144:zopdCpR25zkOrS43PZ4+4GThAsyIDWSeO:zo3CpR25RrSeZ4rGThAslqO |
MALICIOUS
Drops executable file immediately after starts
- WinRAR.exe (PID: 2920)
- Uzi Clicker Crack.exe (PID: 3936)
NANOCORE was detected
- Uzi Clicker Crack.exe (PID: 3936)
Changes the autorun value in the registry
- Uzi Clicker Crack.exe (PID: 3936)
Application was dropped or rewritten from another process
- Uzi Clicker Crack.exe (PID: 3936)
Connects to CnC server
- Uzi Clicker Crack.exe (PID: 3936)
NANOCORE detected by memory dumps
- Uzi Clicker Crack.exe (PID: 3936)
SUSPICIOUS
Checks supported languages
- WinRAR.exe (PID: 2920)
- Uzi Clicker Crack.exe (PID: 3936)
Creates files in the user directory
- Uzi Clicker Crack.exe (PID: 3936)
Executable content was dropped or overwritten
- Uzi Clicker Crack.exe (PID: 3936)
- WinRAR.exe (PID: 2920)
Reads the computer name
- Uzi Clicker Crack.exe (PID: 3936)
- WinRAR.exe (PID: 2920)
Reads Environment values
- Uzi Clicker Crack.exe (PID: 3936)
Drops a file with a compile date too recent
- Uzi Clicker Crack.exe (PID: 3936)
- WinRAR.exe (PID: 2920)
Modifies files in Chrome extension folder
- chrome.exe (PID: 2428)
INFO
Manual execution by user
- chrome.exe (PID: 2428)
Checks supported languages
- chrome.exe (PID: 2428)
- chrome.exe (PID: 2620)
- chrome.exe (PID: 2232)
- chrome.exe (PID: 2908)
- chrome.exe (PID: 576)
- chrome.exe (PID: 3852)
- chrome.exe (PID: 580)
- chrome.exe (PID: 3364)
- chrome.exe (PID: 1644)
- chrome.exe (PID: 3776)
- chrome.exe (PID: 3448)
- chrome.exe (PID: 2948)
- chrome.exe (PID: 1616)
- chrome.exe (PID: 3148)
- chrome.exe (PID: 2776)
- chrome.exe (PID: 2984)
- chrome.exe (PID: 1624)
- chrome.exe (PID: 3532)
- chrome.exe (PID: 3668)
- chrome.exe (PID: 2784)
Application launched itself
- chrome.exe (PID: 2428)
Reads the computer name
- chrome.exe (PID: 2428)
- chrome.exe (PID: 2232)
- chrome.exe (PID: 2908)
- chrome.exe (PID: 3364)
- chrome.exe (PID: 2776)
Reads the hosts file
- chrome.exe (PID: 2428)
- chrome.exe (PID: 2908)
Reads settings of System Certificates
- chrome.exe (PID: 2908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Nanocore
(PID) Process(3936) Uzi Clicker Crack.exe
BuildTime2022-07-25 07:00:10.884128
Version1.2.2.0
Mutex91b81b10-5381-4d8e-9f28-1f7a42e17c6b
DefaultGroupDefault
PrimaryConnectionHostcsrpkfirma.ddns.net
BackupConnectionHostcsrpkfirma.ddns.net
ConnectionPort54984
RunOnStartupTrue
RequestElevationFalse
BypassUserAccountControlTrue
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipFileName: | Uzi Clicker Crack/ |
|---|---|
| ZipUncompressedSize: | - |
| ZipCompressedSize: | - |
| ZipCRC: | 0x00000000 |
| ZipModifyDate: | 2022:07:25 09:04:06 |
| ZipCompression: | None |
| ZipBitFlag: | - |
| ZipRequiredVersion: | 10 |
Total processes
56
Monitored processes
22
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 576 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,204416540289152193,16822598626706344640,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 580 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,204416540289152193,16822598626706344640,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1616 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,204416540289152193,16822598626706344640,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3640 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1624 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,204416540289152193,16822598626706344640,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1644 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,204416540289152193,16822598626706344640,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2232 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,204416540289152193,16822598626706344640,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1052 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2428 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | Explorer.EXE | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2620 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6db9d988,0x6db9d998,0x6db9d9a4 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2776 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,204416540289152193,16822598626706344640,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2784 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,204416540289152193,16822598626706344640,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
Total events
10 758
Read events
10 678
Write events
80
Delete events
0
Modification events
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Uzi Clicker Crack.zip | |||
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
Executable files
2
Suspicious files
66
Text files
59
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2920 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2920.31905\Uzi Clicker Crack\options.dll | — | |
MD5:— | SHA256:— | |||
| 2428 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62DEDAE3-97C.pma | — | |
MD5:— | SHA256:— | |||
| 3936 | Uzi Clicker Crack.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dat | binary | |
MD5:— | SHA256:— | |||
| 3936 | Uzi Clicker Crack.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe | executable | |
MD5:— | SHA256:— | |||
| 2920 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2920.31905\Uzi Clicker Crack\Uzi Clicker Crack.exe | executable | |
MD5:— | SHA256:— | |||
| 2920 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2920.31905\Readme.txt | text | |
MD5:— | SHA256:— | |||
| 3936 | Uzi Clicker Crack.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.dat | bs | |
MD5:9E7D0351E4DF94A9B0BADCEB6A9DB963 | SHA256:AAFC7B40C5FE680A2BB549C3B90AABAAC63163F74FFFC0B00277C6BBFF88B757 | |||
| 2428 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC | SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731 | |||
| 2428 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat | binary | |
MD5:9C016064A1F864C8140915D77CF3389A | SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787 | |||
| 2428 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF1065b1.TMP | text | |
MD5:936EB7280DA791E6DD28EF3A9B46D39C | SHA256:CBAF2AFD831B32F6D1C12337EE5D2F090D6AE1F4DCB40B08BEF49BF52AD9721F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
54
DNS requests
42
Threats
45
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2908 | chrome.exe | GET | 301 | 66.254.114.41:80 | http://pornhub.com/ | US | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2908 | chrome.exe | 142.250.186.35:443 | update.googleapis.com | Google Inc. | US | whitelisted |
2908 | chrome.exe | 66.254.114.41:80 | pornhub.com | Reflected Networks, Inc. | US | malicious |
2908 | chrome.exe | 66.254.114.41:443 | pornhub.com | Reflected Networks, Inc. | US | malicious |
2908 | chrome.exe | 142.250.185.110:80 | redirector.gvt1.com | Google Inc. | US | whitelisted |
2908 | chrome.exe | 205.185.208.142:443 | di.phncdn.com | Highwinds Network Group, Inc. | US | suspicious |
2908 | chrome.exe | 205.185.208.79:443 | static.trafficjunky.com | Highwinds Network Group, Inc. | US | unknown |
3936 | Uzi Clicker Crack.exe | 83.4.44.227:54984 | csrpkfirma.ddns.net | Orange Polska Spolka Akcyjna | PL | malicious |
2908 | chrome.exe | 216.58.212.132:443 | www.google.com | Google Inc. | US | whitelisted |
2908 | chrome.exe | 142.250.185.142:443 | clients2.google.com | Google Inc. | US | whitelisted |
2908 | chrome.exe | 142.250.185.129:443 | clients2.googleusercontent.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
csrpkfirma.ddns.net |
| malicious |
clients2.google.com |
| whitelisted |
www.google.com |
| malicious |
accounts.google.com |
| shared |
clients2.googleusercontent.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
apis.google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3936 | Uzi Clicker Crack.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
3936 | Uzi Clicker Crack.exe | A Network Trojan was detected | ET TROJAN Possible NanoCore C2 60B |
3936 | Uzi Clicker Crack.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
3936 | Uzi Clicker Crack.exe | A Network Trojan was detected | ET TROJAN Possible NanoCore C2 60B |
3936 | Uzi Clicker Crack.exe | A Network Trojan was detected | ET TROJAN Possible NanoCore C2 60B |
3936 | Uzi Clicker Crack.exe | A Network Trojan was detected | ET TROJAN Possible NanoCore C2 60B |
39 ETPRO signatures available at the full report