Analysis
-
max time kernel
149s -
max time network
196s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-07-2021 13:24
Static task
static1
Behavioral task
behavioral1
Sample
F-Launcher.exe
Resource
win7v20210410
General
-
Target
F-Launcher.exe
-
Size
1.1MB
-
MD5
6c592736cf6ae24c1d7e5d051234fdbd
-
SHA1
dcfddb9aed55a79e38287ddd4e849728d61b67c7
-
SHA256
846d82f6f9d6b965ef683cd91724d72917263cf21e9f0f7e4ed2cb4f1ceacce8
-
SHA512
e5d7692eec1fbdf05c87164951d93a911c0c2308e700d5b7543852c98d31fddfc2c2ed043a514def3a1d9e5fe7317b3771f148dad2c900a3e58e3454e1e6fad1
Malware Config
Extracted
darkcomet
GG
secret92.ddns.net:82
DC_MUTEX-A6ET8RQ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
oqyLUmi211Cb
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Extracted
njrat
0.7NC
NYAN CAT
secret92.ddns.net:8082
0c3398f1458
-
reg_key
0c3398f1458
-
splitter
@!#&^%$
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
darknj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" darknj.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Executes dropped EXE 4 IoCs
Processes:
darknj.exeR-Launcher.exeNJ.EXEmsdcsc.exepid process 1160 darknj.exe 1964 R-Launcher.exe 1744 NJ.EXE 524 msdcsc.exe -
Loads dropped DLL 8 IoCs
Processes:
F-Launcher.exedarknj.exepid process 1644 F-Launcher.exe 1644 F-Launcher.exe 1644 F-Launcher.exe 1644 F-Launcher.exe 1160 darknj.exe 1160 darknj.exe 1160 darknj.exe 1160 darknj.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
darknj.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" darknj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "229" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e70373df7d4e124b984081c90c2387e400000000020000000000106600000001000020000000f6a74d4d6b82e147a8cbe23a3d7cb5a2cfdbe443bae9f3dedd8d464049e6a559000000000e800000000200002000000053ecfe4f91c18432c47c56b80a9d5a5369878f9c54a384447e939e7001aef23d200100002afe06162512433921ca320d4c153e11285b06b06c3bdaeb0bd43dedc5289e5a1cdd8e714984ab910b162415e0efe62f00c216a60a6def2024a80162d655812fa3b2d59dd181c55301ce0046e3b9c1d78c5671264536d2e5eebe1ffdc73794fe32e6abf2e153212602db353551752b99449ec026dacea4aff41e0e143ef438e9260ec855ab7ab945b71743b35fa40b840baeff9789466fa4b30e15668b02e2a3e131c951e0db700b6ffda7519e01c49ae8ab10fb6ca263873638deb571583856b991b789bc775b9184c171e06256bfac1eb6fb51579cd0de4c978a1a3e029995bd7a43275c6afc864ab8faf36ffc60d409e5c85da1ea5dcb73e0b667388182d3f3ec6c1eed9fc8fd61d04cc5c1ff4e7f69c8c9cb27a1d374bbe18f2c8e3413a24000000054a3716a8170b0e72665defce4c258c1c96d3f56c1e4693d300e2b2351134c6fb4060d881580b24815601827dcb25206a135781985c229010829329aae5e172a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "224" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "333" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "22" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "122" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "209" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\trustarc.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\trustarc.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "122" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "209" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "276" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "333638698" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A349DA91-EA26-11EB-85FA-C64C73D39F9F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "229" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dbc97a337ed701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "224" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "229" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "333" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e70373df7d4e124b984081c90c2387e400000000020000000000106600000001000020000000a2aad4b5a4cd8181c6db9f73ab1c5af5ce44cb13f724905761351a2d51e05f1c000000000e8000000002000020000000a36a7bf7878818cc56108c555e9ed658efcd08ada8ddc612da2cd24ec14c092420000000d666f8b4a5da56e379789213867a3be53e85efbb7ce2a6fce2ee9b5a670d252140000000e3a3208e830ac02c6f97dd936bd5a3f5f9d3c2805807ddef8419551a3252687a25f47b7206e8dc86ccbd089ad83bcd59cab3b836fd2a058e5562b97887cb45ad iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "122" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "276" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "22" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "209" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 524 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
darknj.exemsdcsc.exeNJ.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 1160 darknj.exe Token: SeSecurityPrivilege 1160 darknj.exe Token: SeTakeOwnershipPrivilege 1160 darknj.exe Token: SeLoadDriverPrivilege 1160 darknj.exe Token: SeSystemProfilePrivilege 1160 darknj.exe Token: SeSystemtimePrivilege 1160 darknj.exe Token: SeProfSingleProcessPrivilege 1160 darknj.exe Token: SeIncBasePriorityPrivilege 1160 darknj.exe Token: SeCreatePagefilePrivilege 1160 darknj.exe Token: SeBackupPrivilege 1160 darknj.exe Token: SeRestorePrivilege 1160 darknj.exe Token: SeShutdownPrivilege 1160 darknj.exe Token: SeDebugPrivilege 1160 darknj.exe Token: SeSystemEnvironmentPrivilege 1160 darknj.exe Token: SeChangeNotifyPrivilege 1160 darknj.exe Token: SeRemoteShutdownPrivilege 1160 darknj.exe Token: SeUndockPrivilege 1160 darknj.exe Token: SeManageVolumePrivilege 1160 darknj.exe Token: SeImpersonatePrivilege 1160 darknj.exe Token: SeCreateGlobalPrivilege 1160 darknj.exe Token: 33 1160 darknj.exe Token: 34 1160 darknj.exe Token: 35 1160 darknj.exe Token: SeIncreaseQuotaPrivilege 524 msdcsc.exe Token: SeSecurityPrivilege 524 msdcsc.exe Token: SeTakeOwnershipPrivilege 524 msdcsc.exe Token: SeLoadDriverPrivilege 524 msdcsc.exe Token: SeSystemProfilePrivilege 524 msdcsc.exe Token: SeSystemtimePrivilege 524 msdcsc.exe Token: SeProfSingleProcessPrivilege 524 msdcsc.exe Token: SeIncBasePriorityPrivilege 524 msdcsc.exe Token: SeCreatePagefilePrivilege 524 msdcsc.exe Token: SeBackupPrivilege 524 msdcsc.exe Token: SeRestorePrivilege 524 msdcsc.exe Token: SeShutdownPrivilege 524 msdcsc.exe Token: SeDebugPrivilege 524 msdcsc.exe Token: SeSystemEnvironmentPrivilege 524 msdcsc.exe Token: SeChangeNotifyPrivilege 524 msdcsc.exe Token: SeRemoteShutdownPrivilege 524 msdcsc.exe Token: SeUndockPrivilege 524 msdcsc.exe Token: SeManageVolumePrivilege 524 msdcsc.exe Token: SeImpersonatePrivilege 524 msdcsc.exe Token: SeCreateGlobalPrivilege 524 msdcsc.exe Token: 33 524 msdcsc.exe Token: 34 524 msdcsc.exe Token: 35 524 msdcsc.exe Token: SeDebugPrivilege 1744 NJ.EXE Token: 33 1744 NJ.EXE Token: SeIncBasePriorityPrivilege 1744 NJ.EXE Token: 33 1744 NJ.EXE Token: SeIncBasePriorityPrivilege 1744 NJ.EXE Token: 33 1744 NJ.EXE Token: SeIncBasePriorityPrivilege 1744 NJ.EXE Token: 33 1744 NJ.EXE Token: SeIncBasePriorityPrivilege 1744 NJ.EXE Token: 33 1744 NJ.EXE Token: SeIncBasePriorityPrivilege 1744 NJ.EXE Token: 33 1744 NJ.EXE Token: SeIncBasePriorityPrivilege 1744 NJ.EXE Token: 33 1744 NJ.EXE Token: SeIncBasePriorityPrivilege 1744 NJ.EXE Token: 33 1744 NJ.EXE Token: SeIncBasePriorityPrivilege 1744 NJ.EXE Token: 33 1744 NJ.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 456 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
msdcsc.exeiexplore.exeIEXPLORE.EXEpid process 524 msdcsc.exe 456 iexplore.exe 456 iexplore.exe 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
F-Launcher.exedarknj.execmd.execmd.exedescription pid process target process PID 1644 wrote to memory of 1160 1644 F-Launcher.exe darknj.exe PID 1644 wrote to memory of 1160 1644 F-Launcher.exe darknj.exe PID 1644 wrote to memory of 1160 1644 F-Launcher.exe darknj.exe PID 1644 wrote to memory of 1160 1644 F-Launcher.exe darknj.exe PID 1644 wrote to memory of 1160 1644 F-Launcher.exe darknj.exe PID 1644 wrote to memory of 1160 1644 F-Launcher.exe darknj.exe PID 1644 wrote to memory of 1160 1644 F-Launcher.exe darknj.exe PID 1644 wrote to memory of 1964 1644 F-Launcher.exe R-Launcher.exe PID 1644 wrote to memory of 1964 1644 F-Launcher.exe R-Launcher.exe PID 1644 wrote to memory of 1964 1644 F-Launcher.exe R-Launcher.exe PID 1644 wrote to memory of 1964 1644 F-Launcher.exe R-Launcher.exe PID 1644 wrote to memory of 1964 1644 F-Launcher.exe R-Launcher.exe PID 1644 wrote to memory of 1964 1644 F-Launcher.exe R-Launcher.exe PID 1644 wrote to memory of 1964 1644 F-Launcher.exe R-Launcher.exe PID 1160 wrote to memory of 1700 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1700 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1700 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1700 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1700 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1700 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1700 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1720 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1720 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1720 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1720 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1720 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1720 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1720 1160 darknj.exe cmd.exe PID 1160 wrote to memory of 1744 1160 darknj.exe NJ.EXE PID 1160 wrote to memory of 1744 1160 darknj.exe NJ.EXE PID 1160 wrote to memory of 1744 1160 darknj.exe NJ.EXE PID 1160 wrote to memory of 1744 1160 darknj.exe NJ.EXE PID 1160 wrote to memory of 1744 1160 darknj.exe NJ.EXE PID 1160 wrote to memory of 1744 1160 darknj.exe NJ.EXE PID 1160 wrote to memory of 1744 1160 darknj.exe NJ.EXE PID 1700 wrote to memory of 836 1700 cmd.exe attrib.exe PID 1700 wrote to memory of 836 1700 cmd.exe attrib.exe PID 1700 wrote to memory of 836 1700 cmd.exe attrib.exe PID 1700 wrote to memory of 836 1700 cmd.exe attrib.exe PID 1700 wrote to memory of 836 1700 cmd.exe attrib.exe PID 1700 wrote to memory of 836 1700 cmd.exe attrib.exe PID 1700 wrote to memory of 836 1700 cmd.exe attrib.exe PID 1720 wrote to memory of 616 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 616 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 616 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 616 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 616 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 616 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 616 1720 cmd.exe attrib.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe PID 1160 wrote to memory of 1608 1160 darknj.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 836 attrib.exe 616 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\F-Launcher.exe"C:\Users\Admin\AppData\Local\Temp\F-Launcher.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\darknj.exe"C:\Users\Admin\AppData\Local\Temp\darknj.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXE"C:\Users\Admin\AppData\Local\Temp\NJ.EXE"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"3⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
-
C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:456 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015MD5
2902de11e30dcc620b184e3bb0f0c1cb
SHA15d11d14a2558801a2688dc2d6dfad39ac294f222
SHA256e6a7f1f8810e46a736e80ee5ac6187690f28f4d5d35d130d410e20084b2c1544
SHA512efd415cde25b827ac2a7ca4d6486ce3a43cdcc1c31d3a94fd7944681aa3e83a4966625bf2e6770581c4b59d05e35ff9318d9adaddade9070f131076892af2fa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
62bf1ec27c9b69d45e5caae254ab74c7
SHA123b9b49d78afd7a39805aa22fa2f86fc5177d2de
SHA256eff71dd8709d3a4d287802fd6f6b76083decec34e430edccd817bd4df4bbdc3f
SHA5126dedda398bb0c92220c6804f3753b6458d4a648dd642a2230324a456464c41342fb62bc56cd63ae7ce110772f78cbc38cacf3d0b98d26258867377abba3de528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
83701674f83f693a3f31227009ac6ae6
SHA1566372993e29950bf10022abfc9dfc8a65082103
SHA25637922e1301130061fe58f3b17fb0064a177149115c9453bd28e0d36a7b8e99c0
SHA512c8d13e540cf9aa5b6dceefac61524143a70bbe219b868d083c6dc4ef71845102b2c2c1700205c17f7a54bcf398bcb3a9e73a89b31e20edbb3270e8626b6b9cea
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sgyae4t\imagestore.datMD5
e446bed674e49c7434578d241160403c
SHA1196d7693c7fa401392e4f9249b4bb7093799d131
SHA256d3043ea905fb370f278018bcb16c3721f278acf73ac2a67b3293bbf6a21e1524
SHA512f924f99acc3214a86414e21993f01f20c93084a1ae7308aa85c39b268049e89ab8d9fd39ccd317157165bb4c245d24e9efd9f75dfd2d89570dff32de7fd965f1
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
7033b44842fd35925e857497f9cb1653
SHA10db1543f4af1b37e9d3d93b75f5d8329d6337b3f
SHA256381bc1886d534d20d33107d09b09fd7e4fffba102c0314b6d8359be5ebb6231f
SHA512f74abf39181aa65068740d99968d503ce96bd2dc3c2a0a7251422204c7cda0aa54bc20edce2b37b264348cf97594ed3f99a31028a1eb9e17fd81b4ba4453de0f
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
7033b44842fd35925e857497f9cb1653
SHA10db1543f4af1b37e9d3d93b75f5d8329d6337b3f
SHA256381bc1886d534d20d33107d09b09fd7e4fffba102c0314b6d8359be5ebb6231f
SHA512f74abf39181aa65068740d99968d503ce96bd2dc3c2a0a7251422204c7cda0aa54bc20edce2b37b264348cf97594ed3f99a31028a1eb9e17fd81b4ba4453de0f
-
C:\Users\Admin\AppData\Local\Temp\R-Launcher.exeMD5
f09f583748cb26682f60279b8bba14c8
SHA1caf750a85d3abd708c080ebfa995bc2cc0b4cafd
SHA2567f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc
SHA512cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9
-
C:\Users\Admin\AppData\Local\Temp\darknj.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
C:\Users\Admin\AppData\Local\Temp\darknj.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NZYHIVLP.txtMD5
b00b1c32b40e838e143628dcc9736e17
SHA162cb52ec8fbae413a8f22d4469590f246763cd44
SHA256178a9ef5b97e26c98671e252eafb39dad2de00a2290530d30ff3220fc2c12223
SHA512367cbed15baf8c0c47e9b4c3f48d75919bbec5fbd04327b286ab38bf7aacfcd17354e7d3ec7238c6d4937ff8fd3b9cc7227a151ffc2b412e2addc326a0612358
-
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
7033b44842fd35925e857497f9cb1653
SHA10db1543f4af1b37e9d3d93b75f5d8329d6337b3f
SHA256381bc1886d534d20d33107d09b09fd7e4fffba102c0314b6d8359be5ebb6231f
SHA512f74abf39181aa65068740d99968d503ce96bd2dc3c2a0a7251422204c7cda0aa54bc20edce2b37b264348cf97594ed3f99a31028a1eb9e17fd81b4ba4453de0f
-
\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
7033b44842fd35925e857497f9cb1653
SHA10db1543f4af1b37e9d3d93b75f5d8329d6337b3f
SHA256381bc1886d534d20d33107d09b09fd7e4fffba102c0314b6d8359be5ebb6231f
SHA512f74abf39181aa65068740d99968d503ce96bd2dc3c2a0a7251422204c7cda0aa54bc20edce2b37b264348cf97594ed3f99a31028a1eb9e17fd81b4ba4453de0f
-
\Users\Admin\AppData\Local\Temp\R-Launcher.exeMD5
f09f583748cb26682f60279b8bba14c8
SHA1caf750a85d3abd708c080ebfa995bc2cc0b4cafd
SHA2567f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc
SHA512cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9
-
\Users\Admin\AppData\Local\Temp\R-Launcher.exeMD5
f09f583748cb26682f60279b8bba14c8
SHA1caf750a85d3abd708c080ebfa995bc2cc0b4cafd
SHA2567f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc
SHA512cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9
-
\Users\Admin\AppData\Local\Temp\darknj.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
\Users\Admin\AppData\Local\Temp\darknj.exeMD5
2308cedb77f66e4a821d57e8ee1e08a5
SHA142ddaf9aef498e366fecdad6b2acbbe9d9d0d47c
SHA2568eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b
SHA512ad91461e7e5747a8815015c910f84720bd90cf520a39dcc01cd75c5a8840a8beda9969de2c5e8778cac5d863bf11fcb6c0c946c81b4a3ed43792ca0202264f77
-
memory/456-100-0x000007FEFBFF1000-0x000007FEFBFF3000-memory.dmpFilesize
8KB
-
memory/456-99-0x0000000000000000-mapping.dmp
-
memory/524-92-0x0000000000000000-mapping.dmp
-
memory/524-97-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/616-82-0x0000000000000000-mapping.dmp
-
memory/836-81-0x0000000000000000-mapping.dmp
-
memory/1108-98-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1108-95-0x0000000000000000-mapping.dmp
-
memory/1160-62-0x0000000000000000-mapping.dmp
-
memory/1160-76-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1608-86-0x0000000000000000-mapping.dmp
-
memory/1608-89-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1644-59-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1700-71-0x0000000000000000-mapping.dmp
-
memory/1720-72-0x0000000000000000-mapping.dmp
-
memory/1744-88-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/1744-78-0x0000000000000000-mapping.dmp
-
memory/1788-101-0x0000000000000000-mapping.dmp
-
memory/1964-67-0x0000000000000000-mapping.dmp