Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-12-2020 18:48
Static task
static1
Behavioral task
behavioral1
Sample
084Fxy9f.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
084Fxy9f.exe
Resource
win10v20201028
General
-
Target
084Fxy9f.exe
-
Size
182KB
-
MD5
03f42fa4bb4551157d493df896904f6d
-
SHA1
70fc59125cde458b573fa3394e95b50ae08c0728
-
SHA256
782818678a45e29fa285a560b0e3cb2aa9cd766fbeb228cf97eabdb712a03008
-
SHA512
a39669af4a3bdfc853c458272c19171f90075f9debc833a7f3b29f67604c67522f9d9bca33ff9aa0bda3d8c50c4b1db8468b4894b05c58935998d5586d8dced2
Malware Config
Extracted
njrat
0.7d
HacKed
154.202.3.84:5552
c0792765cb20555a6d17a1641ac2d34e
-
reg_key
c0792765cb20555a6d17a1641ac2d34e
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
SmileZ.exepid process 3336 SmileZ.exe -
Modifies Windows Firewall 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SmileZ.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\c0792765cb20555a6d17a1641ac2d34e = "\"C:\\Windows\\SmileZ.exe\" .." SmileZ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c0792765cb20555a6d17a1641ac2d34e = "\"C:\\Windows\\SmileZ.exe\" .." SmileZ.exe -
Drops file in Windows directory 1 IoCs
Processes:
084Fxy9f.exedescription ioc process File created C:\Windows\SmileZ.exe 084Fxy9f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
SmileZ.exedescription pid process Token: SeDebugPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe Token: 33 3336 SmileZ.exe Token: SeIncBasePriorityPrivilege 3336 SmileZ.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
084Fxy9f.exeSmileZ.exedescription pid process target process PID 636 wrote to memory of 3336 636 084Fxy9f.exe SmileZ.exe PID 636 wrote to memory of 3336 636 084Fxy9f.exe SmileZ.exe PID 636 wrote to memory of 3336 636 084Fxy9f.exe SmileZ.exe PID 3336 wrote to memory of 1776 3336 SmileZ.exe netsh.exe PID 3336 wrote to memory of 1776 3336 SmileZ.exe netsh.exe PID 3336 wrote to memory of 1776 3336 SmileZ.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\084Fxy9f.exe"C:\Users\Admin\AppData\Local\Temp\084Fxy9f.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SmileZ.exe"C:\Windows\SmileZ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\SmileZ.exe" "SmileZ.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SmileZ.exeMD5
03f42fa4bb4551157d493df896904f6d
SHA170fc59125cde458b573fa3394e95b50ae08c0728
SHA256782818678a45e29fa285a560b0e3cb2aa9cd766fbeb228cf97eabdb712a03008
SHA512a39669af4a3bdfc853c458272c19171f90075f9debc833a7f3b29f67604c67522f9d9bca33ff9aa0bda3d8c50c4b1db8468b4894b05c58935998d5586d8dced2
-
C:\Windows\SmileZ.exeMD5
03f42fa4bb4551157d493df896904f6d
SHA170fc59125cde458b573fa3394e95b50ae08c0728
SHA256782818678a45e29fa285a560b0e3cb2aa9cd766fbeb228cf97eabdb712a03008
SHA512a39669af4a3bdfc853c458272c19171f90075f9debc833a7f3b29f67604c67522f9d9bca33ff9aa0bda3d8c50c4b1db8468b4894b05c58935998d5586d8dced2
-
memory/1776-5-0x0000000000000000-mapping.dmp
-
memory/3336-2-0x0000000000000000-mapping.dmp