Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 16:19
Static task
static1
Behavioral task
behavioral1
Sample
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe
Resource
win10v2004-20220414-en
General
-
Target
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe
-
Size
32KB
-
MD5
049ac27d872ea5b85f8bae209cfd6f62
-
SHA1
39d8f3ee02f40eb559044bbbecf5d3fadfbd8079
-
SHA256
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c
-
SHA512
d53bc9673cc5e4c55d58b1d40c7136d0590f6a54f1855100962feff2b7cc6b9fe5e6eb76eff5cf4d8b20076bd5efebccaa4987fab983ea1505c9b507f34c4547
Malware Config
Extracted
njrat
Hacked By HiDDen PerSOn
9fd934de9393f22478a39ad38fdd5c13
-
reg_key
9fd934de9393f22478a39ad38fdd5c13
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
System32.exepid process 1932 System32.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
System32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9fd934de9393f22478a39ad38fdd5c13.exe System32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9fd934de9393f22478a39ad38fdd5c13.exe System32.exe -
Loads dropped DLL 1 IoCs
Processes:
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exepid process 1972 d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
System32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\9fd934de9393f22478a39ad38fdd5c13 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9fd934de9393f22478a39ad38fdd5c13 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
System32.exedescription pid process Token: SeDebugPrivilege 1932 System32.exe Token: 33 1932 System32.exe Token: SeIncBasePriorityPrivilege 1932 System32.exe Token: 33 1932 System32.exe Token: SeIncBasePriorityPrivilege 1932 System32.exe Token: 33 1932 System32.exe Token: SeIncBasePriorityPrivilege 1932 System32.exe Token: 33 1932 System32.exe Token: SeIncBasePriorityPrivilege 1932 System32.exe Token: 33 1932 System32.exe Token: SeIncBasePriorityPrivilege 1932 System32.exe Token: 33 1932 System32.exe Token: SeIncBasePriorityPrivilege 1932 System32.exe Token: 33 1932 System32.exe Token: SeIncBasePriorityPrivilege 1932 System32.exe Token: 33 1932 System32.exe Token: SeIncBasePriorityPrivilege 1932 System32.exe Token: 33 1932 System32.exe Token: SeIncBasePriorityPrivilege 1932 System32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exeSystem32.exedescription pid process target process PID 1972 wrote to memory of 1932 1972 d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe System32.exe PID 1972 wrote to memory of 1932 1972 d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe System32.exe PID 1972 wrote to memory of 1932 1972 d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe System32.exe PID 1972 wrote to memory of 1932 1972 d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe System32.exe PID 1932 wrote to memory of 1396 1932 System32.exe netsh.exe PID 1932 wrote to memory of 1396 1932 System32.exe netsh.exe PID 1932 wrote to memory of 1396 1932 System32.exe netsh.exe PID 1932 wrote to memory of 1396 1932 System32.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe"C:\Users\Admin\AppData\Local\Temp\d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System32.exe" "System32.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
32KB
MD5049ac27d872ea5b85f8bae209cfd6f62
SHA139d8f3ee02f40eb559044bbbecf5d3fadfbd8079
SHA256d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c
SHA512d53bc9673cc5e4c55d58b1d40c7136d0590f6a54f1855100962feff2b7cc6b9fe5e6eb76eff5cf4d8b20076bd5efebccaa4987fab983ea1505c9b507f34c4547
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
32KB
MD5049ac27d872ea5b85f8bae209cfd6f62
SHA139d8f3ee02f40eb559044bbbecf5d3fadfbd8079
SHA256d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c
SHA512d53bc9673cc5e4c55d58b1d40c7136d0590f6a54f1855100962feff2b7cc6b9fe5e6eb76eff5cf4d8b20076bd5efebccaa4987fab983ea1505c9b507f34c4547
-
\Users\Admin\AppData\Local\Temp\System32.exeFilesize
32KB
MD5049ac27d872ea5b85f8bae209cfd6f62
SHA139d8f3ee02f40eb559044bbbecf5d3fadfbd8079
SHA256d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c
SHA512d53bc9673cc5e4c55d58b1d40c7136d0590f6a54f1855100962feff2b7cc6b9fe5e6eb76eff5cf4d8b20076bd5efebccaa4987fab983ea1505c9b507f34c4547
-
memory/1396-62-0x0000000000000000-mapping.dmp
-
memory/1932-57-0x0000000000000000-mapping.dmp
-
memory/1932-61-0x0000000074D60000-0x000000007530B000-memory.dmpFilesize
5.7MB
-
memory/1972-54-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1972-55-0x0000000074D60000-0x000000007530B000-memory.dmpFilesize
5.7MB