Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20201028 - submitted
23/02/2021, 14:30
Static task
static1
Behavioral task
behavioral1
Sample
5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe
- Size 31KB
- Sample210223-yq9c6acyda
- SHA256 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7
- MD5 5cf809c28542650e37a2f0f433017215
- SHA1 7156f190f81f65ccf85d6bfc2049bdda884b064c
- SHA512 c8d9b2ae185e28eec6963939235cd2d66b059c5ba7ce65ed3dbf2aed3d95e90ff4effc92855af51d9f3a048cb5b8509d628858d482c7b0123e47d3cd3c6b856a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
Desktop
C2
-
4.tcp.ngrok.io:12301
Mutex
-
d7d6473ebba046254684b9cad242c84a
Attributes
-
reg_key
d7d6473ebba046254684b9cad242c84a
-
splitter
Y262SUCZ4UJJ
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3160 WindowsServices.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7d6473ebba046254684b9cad242c84a.exe WindowsServices.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7d6473ebba046254684b9cad242c84a.exe WindowsServices.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\d7d6473ebba046254684b9cad242c84a = "\"C:\\Windows\\WindowsServices.exe\" .." WindowsServices.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d7d6473ebba046254684b9cad242c84a = "\"C:\\Windows\\WindowsServices.exe\" .." WindowsServices.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WindowsServices.exe 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe Token: SeDebugPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe Token: 33 3160 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3160 WindowsServices.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3984 wrote to memory of 3160 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 77 PID 3984 wrote to memory of 3160 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 77 PID 3984 wrote to memory of 3160 3984 5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe 77 PID 3160 wrote to memory of 3960 3160 WindowsServices.exe 79 PID 3160 wrote to memory of 3960 3160 WindowsServices.exe 79 PID 3160 wrote to memory of 3960 3160 WindowsServices.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe"C:\Users\Admin\AppData\Local\Temp\5df5e059d40b2d8595fb044fd6aea3b2db68ba40927ec23cccd1fea3fca6fac7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\WindowsServices.exe"C:\Windows\WindowsServices.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\WindowsServices.exe" "WindowsServices.exe" ENABLE3⤵PID:3960
-
-