Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 16:19
Static task
static1
Behavioral task
behavioral1
Sample
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe
Resource
win10v2004-20220414-en
General
-
Target
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe
-
Size
32KB
-
MD5
049ac27d872ea5b85f8bae209cfd6f62
-
SHA1
39d8f3ee02f40eb559044bbbecf5d3fadfbd8079
-
SHA256
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c
-
SHA512
d53bc9673cc5e4c55d58b1d40c7136d0590f6a54f1855100962feff2b7cc6b9fe5e6eb76eff5cf4d8b20076bd5efebccaa4987fab983ea1505c9b507f34c4547
Malware Config
Extracted
njrat
Hacked By HiDDen PerSOn
9fd934de9393f22478a39ad38fdd5c13
-
reg_key
9fd934de9393f22478a39ad38fdd5c13
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
System32.exepid process 4596 System32.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe -
Drops startup file 2 IoCs
Processes:
System32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9fd934de9393f22478a39ad38fdd5c13.exe System32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9fd934de9393f22478a39ad38fdd5c13.exe System32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
System32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9fd934de9393f22478a39ad38fdd5c13 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9fd934de9393f22478a39ad38fdd5c13 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
System32.exedescription pid process Token: SeDebugPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe Token: 33 4596 System32.exe Token: SeIncBasePriorityPrivilege 4596 System32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exeSystem32.exedescription pid process target process PID 1540 wrote to memory of 4596 1540 d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe System32.exe PID 1540 wrote to memory of 4596 1540 d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe System32.exe PID 1540 wrote to memory of 4596 1540 d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe System32.exe PID 4596 wrote to memory of 616 4596 System32.exe netsh.exe PID 4596 wrote to memory of 616 4596 System32.exe netsh.exe PID 4596 wrote to memory of 616 4596 System32.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe"C:\Users\Admin\AppData\Local\Temp\d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System32.exe" "System32.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
32KB
MD5049ac27d872ea5b85f8bae209cfd6f62
SHA139d8f3ee02f40eb559044bbbecf5d3fadfbd8079
SHA256d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c
SHA512d53bc9673cc5e4c55d58b1d40c7136d0590f6a54f1855100962feff2b7cc6b9fe5e6eb76eff5cf4d8b20076bd5efebccaa4987fab983ea1505c9b507f34c4547
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
32KB
MD5049ac27d872ea5b85f8bae209cfd6f62
SHA139d8f3ee02f40eb559044bbbecf5d3fadfbd8079
SHA256d38892f53771d07077325146c925cb9cfdfe23afceedc71ddfb4b67ce51b827c
SHA512d53bc9673cc5e4c55d58b1d40c7136d0590f6a54f1855100962feff2b7cc6b9fe5e6eb76eff5cf4d8b20076bd5efebccaa4987fab983ea1505c9b507f34c4547
-
memory/616-135-0x0000000000000000-mapping.dmp
-
memory/1540-130-0x0000000075430000-0x00000000759E1000-memory.dmpFilesize
5.7MB
-
memory/4596-131-0x0000000000000000-mapping.dmp
-
memory/4596-134-0x0000000075430000-0x00000000759E1000-memory.dmpFilesize
5.7MB