Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 13:28
Static task
static1
Behavioral task
behavioral1
Sample
06638a7f94e86279d3188c9d02d54029.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
06638a7f94e86279d3188c9d02d54029.exe
Resource
win10v20201028
General
-
Target
06638a7f94e86279d3188c9d02d54029.exe
-
Size
13.4MB
-
MD5
06638a7f94e86279d3188c9d02d54029
-
SHA1
985ec19800fbf08a21780792671f5359da739ed6
-
SHA256
e78965bb611ca20f0dd54e20a28a4edb801aa2cd07bc2acf21386979df7a0a8e
-
SHA512
6f9839849f8bca21d5d2b431b8d6bda772d00846f104fffe77eb7bd80a094822b8c23bf316315dc8a9afe561d8e5e1c727e873a2f2443cd50ab17301e952cdba
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
njdjprja.exepid process 1352 njdjprja.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 632 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
njdjprja.exedescription pid process target process PID 1352 set thread context of 632 1352 njdjprja.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
06638a7f94e86279d3188c9d02d54029.exenjdjprja.exedescription pid process target process PID 788 wrote to memory of 2032 788 06638a7f94e86279d3188c9d02d54029.exe cmd.exe PID 788 wrote to memory of 2032 788 06638a7f94e86279d3188c9d02d54029.exe cmd.exe PID 788 wrote to memory of 2032 788 06638a7f94e86279d3188c9d02d54029.exe cmd.exe PID 788 wrote to memory of 2032 788 06638a7f94e86279d3188c9d02d54029.exe cmd.exe PID 788 wrote to memory of 1736 788 06638a7f94e86279d3188c9d02d54029.exe cmd.exe PID 788 wrote to memory of 1736 788 06638a7f94e86279d3188c9d02d54029.exe cmd.exe PID 788 wrote to memory of 1736 788 06638a7f94e86279d3188c9d02d54029.exe cmd.exe PID 788 wrote to memory of 1736 788 06638a7f94e86279d3188c9d02d54029.exe cmd.exe PID 788 wrote to memory of 1288 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 1288 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 1288 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 1288 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 1740 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 1740 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 1740 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 1740 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 844 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 844 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 844 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 788 wrote to memory of 844 788 06638a7f94e86279d3188c9d02d54029.exe sc.exe PID 1352 wrote to memory of 632 1352 njdjprja.exe svchost.exe PID 1352 wrote to memory of 632 1352 njdjprja.exe svchost.exe PID 1352 wrote to memory of 632 1352 njdjprja.exe svchost.exe PID 1352 wrote to memory of 632 1352 njdjprja.exe svchost.exe PID 1352 wrote to memory of 632 1352 njdjprja.exe svchost.exe PID 1352 wrote to memory of 632 1352 njdjprja.exe svchost.exe PID 788 wrote to memory of 1556 788 06638a7f94e86279d3188c9d02d54029.exe netsh.exe PID 788 wrote to memory of 1556 788 06638a7f94e86279d3188c9d02d54029.exe netsh.exe PID 788 wrote to memory of 1556 788 06638a7f94e86279d3188c9d02d54029.exe netsh.exe PID 788 wrote to memory of 1556 788 06638a7f94e86279d3188c9d02d54029.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06638a7f94e86279d3188c9d02d54029.exe"C:\Users\Admin\AppData\Local\Temp\06638a7f94e86279d3188c9d02d54029.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sirwsrsl\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\njdjprja.exe" C:\Windows\SysWOW64\sirwsrsl\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create sirwsrsl binPath= "C:\Windows\SysWOW64\sirwsrsl\njdjprja.exe /d\"C:\Users\Admin\AppData\Local\Temp\06638a7f94e86279d3188c9d02d54029.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description sirwsrsl "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start sirwsrsl2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\sirwsrsl\njdjprja.exeC:\Windows\SysWOW64\sirwsrsl\njdjprja.exe /d"C:\Users\Admin\AppData\Local\Temp\06638a7f94e86279d3188c9d02d54029.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\njdjprja.exeMD5
e99a2df622809367e3bee48a925ba4c8
SHA143b52b3bf0805af697579ba4e01e2358ec979865
SHA256667aa46f2f208d98a4bab2f34932602140bf9e75127c367d49d6e3df45e6a9e0
SHA5124cc2a6552e2bd320c2b437cc1477209c2a0bda605ccd982e284ea77670962c92fbf6ad0e9767ba5bc9501e40d766e831215fc6b99ec59ad79fb7ea3b564417d9
-
C:\Windows\SysWOW64\sirwsrsl\njdjprja.exeMD5
e99a2df622809367e3bee48a925ba4c8
SHA143b52b3bf0805af697579ba4e01e2358ec979865
SHA256667aa46f2f208d98a4bab2f34932602140bf9e75127c367d49d6e3df45e6a9e0
SHA5124cc2a6552e2bd320c2b437cc1477209c2a0bda605ccd982e284ea77670962c92fbf6ad0e9767ba5bc9501e40d766e831215fc6b99ec59ad79fb7ea3b564417d9
-
memory/632-9-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/632-10-0x00000000000D9A6B-mapping.dmp
-
memory/844-7-0x0000000000000000-mapping.dmp
-
memory/1288-5-0x0000000000000000-mapping.dmp
-
memory/1556-12-0x0000000000000000-mapping.dmp
-
memory/1736-3-0x0000000000000000-mapping.dmp
-
memory/1740-6-0x0000000000000000-mapping.dmp
-
memory/2032-2-0x0000000000000000-mapping.dmp