Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 07:18
Static task
static1
Behavioral task
behavioral1
Sample
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe
Resource
win10v20201028
General
-
Target
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe
-
Size
863KB
-
MD5
8b32e28becfe5553d9b59e6ea2973265
-
SHA1
e731235f8faeb6d04d936ebb69b7032132663566
-
SHA256
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f
-
SHA512
6dae649db1d6033850741bb8cc316f222b6f5d476097f1a581fdad5e42f98e667a70457f2fbf0a30870b47976fe5a39c38e8f745ebcc22745e2ce4b3c466ff4a
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:5552
279f6960ed84a752570aca7fb2dc1552
-
reg_key
279f6960ed84a752570aca7fb2dc1552
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
2982.exeserver.exepid process 2200 2982.exe 4152 server.exe -
Modifies Windows Firewall 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Processes:
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe Token: 33 4152 server.exe Token: SeIncBasePriorityPrivilege 4152 server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe2982.exeserver.exedescription pid process target process PID 4640 wrote to memory of 2200 4640 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 2982.exe PID 4640 wrote to memory of 2200 4640 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 2982.exe PID 4640 wrote to memory of 2200 4640 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 2982.exe PID 2200 wrote to memory of 4152 2200 2982.exe server.exe PID 2200 wrote to memory of 4152 2200 2982.exe server.exe PID 2200 wrote to memory of 4152 2200 2982.exe server.exe PID 4152 wrote to memory of 4068 4152 server.exe netsh.exe PID 4152 wrote to memory of 4068 4152 server.exe netsh.exe PID 4152 wrote to memory of 4068 4152 server.exe netsh.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe"C:\Users\Admin\AppData\Local\Temp\2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\2982\2982.exe"C:\Users\Admin\AppData\Local\Temp\2982\2982.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2982\2982.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
C:\Users\Admin\AppData\Local\Temp\2982\2982.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
C:\Users\Admin\AppData\Local\Temp\server.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
C:\Users\Admin\AppData\Local\Temp\server.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
memory/2200-2-0x0000000000000000-mapping.dmp
-
memory/2200-5-0x0000000002640000-0x0000000002641000-memory.dmpFilesize
4KB
-
memory/4068-10-0x0000000000000000-mapping.dmp
-
memory/4152-6-0x0000000000000000-mapping.dmp
-
memory/4152-9-0x00000000027A0000-0x00000000027A1000-memory.dmpFilesize
4KB