Analysis
-
max time kernel
965s -
max time network
977s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
13-06-2022 11:02
Static task
static1
General
-
Target
Server.exe
-
Size
25KB
-
MD5
7201bca64567be4cd9b0d8debf8ed1b0
-
SHA1
8525c615c51e1361cf0bc3d40ac007e9d58a6b92
-
SHA256
718c12ab5271ab853f9f758f20637bfc5008a53113a39734d064b4d7e806c244
-
SHA512
f5d294e84ce14d6498e9a555881d862cbe1d713e9e48cecbb941b4c0f7046d4948971f6812ac2cf499a84f21df72ea29bdd42db1d4a6553769448bbddc25b8f0
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
gay
4.tcp.eu.ngrok.io:15404
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE 14 IoCs
Processes:
Dllhost.exeServer.exeServer.exe.exeServer.exeServer.exeMEMZ.exeServer.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 1880 Dllhost.exe 912 Server.exe 1340 Server.exe 592 .exe 1116 Server.exe 1928 Server.exe 976 MEMZ.exe 1648 Server.exe 1808 MEMZ.exe 1712 MEMZ.exe 2036 MEMZ.exe 1560 MEMZ.exe 360 MEMZ.exe 1888 MEMZ.exe -
Drops startup file 4 IoCs
Processes:
Dllhost.exe.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Anti.exe .exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Anti.exe .exe -
Loads dropped DLL 1 IoCs
Processes:
MEMZ.exepid process 976 MEMZ.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Windows\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Windows\\Dllhost.exe\" .." Dllhost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Drops file in Windows directory 2 IoCs
Processes:
Server.exeDllhost.exedescription ioc process File created C:\Windows\Dllhost.exe Server.exe File opened for modification C:\Windows\Dllhost.exe Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b3f15a157fd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000f7466d319990a11db2da9e4b0d9d8c62dc7ddd74fe867908ff439a6372dbcb8c000000000e800000000200002000000054646075224eb163e94362898d476e8c72ed7b94ae83bf96eab3d2cd0c0183db90000000baf6d6943e6e1f00874033fb7f0408ae058d1f6e1955ecb56f9a3f8361f9f44b36ead49965e70d75fdf503cf18d705cfaabfb045525fe2e22babc91465b6d2a834aadb5db2991d48fcaf84a11873ed7865489b590b0049ce3b407e48142ff1f76ae139858abfcc11fd671df6f4644eef9c3187b548514abe5be78d41ff959eaacaff86c54e9fff1df2239953e41340ad400000003fc8edb932fefc5066ea8930eb8d40ab58209ec0c494558b0c4bcbb84bb48b61c73de7a69264d4566e12ae1891413e4dd638664bb58e7d103931f7afb77d958f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80EF87D1-EB08-11EC-AF97-C2F2D41BD72F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000422f3f6ec702829ced1e8e8e4c744acb5167899676839bb0187c17312333551a000000000e8000000002000020000000390f1f271d41fc42517c0016d7d46b891ba2ac51fa94d6e509d6d774e6b8083120000000675bebc84aaa1b4ce6e4e0b3edeb19abedd0359fc364f1239410f412d32cf87440000000b9bc7bd313dcc05f125a5019d05d7243ba9f4f1864ad531f95d8cf8254eb38aedb20c51603c287feab6faf0c92a81c084fb68c161dd6f32017edf2479e6c81e1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
.exepid process 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe 592 .exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Dllhost.exepid process 1880 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Dllhost.exe.exedescription pid process Token: SeDebugPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: SeDebugPrivilege 592 .exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe Token: 33 1880 Dllhost.exe Token: SeIncBasePriorityPrivilege 1880 Dllhost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.execscript.exepid process 888 iexplore.exe 1972 cscript.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
iexplore.exeIEXPLORE.EXEMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 888 iexplore.exe 888 iexplore.exe 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1712 MEMZ.exe 1560 MEMZ.exe 1808 MEMZ.exe 360 MEMZ.exe 2036 MEMZ.exe 1712 MEMZ.exe 1560 MEMZ.exe 1808 MEMZ.exe 360 MEMZ.exe 2036 MEMZ.exe 1560 MEMZ.exe 1712 MEMZ.exe 2036 MEMZ.exe 1808 MEMZ.exe 360 MEMZ.exe 1712 MEMZ.exe 1560 MEMZ.exe 1808 MEMZ.exe 2036 MEMZ.exe 360 MEMZ.exe 1560 MEMZ.exe 1712 MEMZ.exe 2036 MEMZ.exe 1808 MEMZ.exe 360 MEMZ.exe 1560 MEMZ.exe 1712 MEMZ.exe 2036 MEMZ.exe 360 MEMZ.exe 1808 MEMZ.exe 1560 MEMZ.exe 1712 MEMZ.exe 2036 MEMZ.exe 1808 MEMZ.exe 360 MEMZ.exe 1560 MEMZ.exe 1712 MEMZ.exe 2036 MEMZ.exe 360 MEMZ.exe 1808 MEMZ.exe 1712 MEMZ.exe 1560 MEMZ.exe 2036 MEMZ.exe 360 MEMZ.exe 1808 MEMZ.exe 1712 MEMZ.exe 1560 MEMZ.exe 2036 MEMZ.exe 360 MEMZ.exe 1808 MEMZ.exe 1712 MEMZ.exe 1560 MEMZ.exe 2036 MEMZ.exe 1808 MEMZ.exe 360 MEMZ.exe 1712 MEMZ.exe 1560 MEMZ.exe 2036 MEMZ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Server.exeDllhost.exetaskeng.exeiexplore.exeMEMZ.exeMEMZ.exedescription pid process target process PID 1964 wrote to memory of 1880 1964 Server.exe Dllhost.exe PID 1964 wrote to memory of 1880 1964 Server.exe Dllhost.exe PID 1964 wrote to memory of 1880 1964 Server.exe Dllhost.exe PID 1880 wrote to memory of 1712 1880 Dllhost.exe schtasks.exe PID 1880 wrote to memory of 1712 1880 Dllhost.exe schtasks.exe PID 1880 wrote to memory of 1712 1880 Dllhost.exe schtasks.exe PID 1976 wrote to memory of 912 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 912 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 912 1976 taskeng.exe Server.exe PID 1880 wrote to memory of 888 1880 Dllhost.exe iexplore.exe PID 1880 wrote to memory of 888 1880 Dllhost.exe iexplore.exe PID 1880 wrote to memory of 888 1880 Dllhost.exe iexplore.exe PID 888 wrote to memory of 1448 888 iexplore.exe IEXPLORE.EXE PID 888 wrote to memory of 1448 888 iexplore.exe IEXPLORE.EXE PID 888 wrote to memory of 1448 888 iexplore.exe IEXPLORE.EXE PID 888 wrote to memory of 1448 888 iexplore.exe IEXPLORE.EXE PID 1976 wrote to memory of 1340 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 1340 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 1340 1976 taskeng.exe Server.exe PID 1880 wrote to memory of 592 1880 Dllhost.exe .exe PID 1880 wrote to memory of 592 1880 Dllhost.exe .exe PID 1880 wrote to memory of 592 1880 Dllhost.exe .exe PID 1880 wrote to memory of 592 1880 Dllhost.exe .exe PID 1976 wrote to memory of 1116 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 1116 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 1116 1976 taskeng.exe Server.exe PID 1880 wrote to memory of 1540 1880 Dllhost.exe cmd.exe PID 1880 wrote to memory of 1540 1880 Dllhost.exe cmd.exe PID 1880 wrote to memory of 1540 1880 Dllhost.exe cmd.exe PID 1976 wrote to memory of 1928 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 1928 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 1928 1976 taskeng.exe Server.exe PID 1880 wrote to memory of 1632 1880 Dllhost.exe cmd.exe PID 1880 wrote to memory of 1632 1880 Dllhost.exe cmd.exe PID 1880 wrote to memory of 1632 1880 Dllhost.exe cmd.exe PID 1976 wrote to memory of 1648 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 1648 1976 taskeng.exe Server.exe PID 1976 wrote to memory of 1648 1976 taskeng.exe Server.exe PID 976 wrote to memory of 1808 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1808 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1808 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1808 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1712 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1712 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1712 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1712 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 2036 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 2036 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 2036 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 2036 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1560 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1560 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1560 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1560 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 360 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 360 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 360 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 360 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1888 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1888 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1888 976 MEMZ.exe MEMZ.exe PID 976 wrote to memory of 1888 976 MEMZ.exe MEMZ.exe PID 1888 wrote to memory of 1796 1888 MEMZ.exe notepad.exe PID 1888 wrote to memory of 1796 1888 MEMZ.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Dllhost.exe"C:\Windows\Dllhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.upload.ee/image/2298158/koli.swf3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:888 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exe"cmd.exe"3⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat" "3⤵
-
C:\Windows\system32\cscript.execscript x.js4⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt6⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {3841DD25-8630-4D3E-92A1-6C85983B60E0} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.exeFilesize
16KB
MD5b21947a28760750689f46e071d575d07
SHA16008a9ff367e7a715422d2e2f96312f1a3231a9e
SHA256f643ab116e7bd8515032a502b8700afb5bdbfc08fc1caa08817b3061e98b763e
SHA51275fd467e4be5480e7dc4ce665a50cf5fcea3c4301f17674feec866d04e0f7036efaec0feffa35fc07ab19b70ff82d133c457c88d7c776f62160bff6cf13a2399
-
C:\Users\Admin\AppData\Local\Temp\.exeFilesize
16KB
MD5b21947a28760750689f46e071d575d07
SHA16008a9ff367e7a715422d2e2f96312f1a3231a9e
SHA256f643ab116e7bd8515032a502b8700afb5bdbfc08fc1caa08817b3061e98b763e
SHA51275fd467e4be5480e7dc4ce665a50cf5fcea3c4301f17674feec866d04e0f7036efaec0feffa35fc07ab19b70ff82d133c457c88d7c776f62160bff6cf13a2399
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
50KB
MD5d45a7ec0cc3bea3317d3c67e762908e8
SHA129e09a23e2b0b2241a5616aa93b880d2365489e3
SHA256150e09068a7417f467c59eeee48b17748dcc46eb7b0006ac85d5a65bfeb29e95
SHA512b9441ffa1e82811147e99e769fbd81adbadd57778e460c221339fc4942cb7f9c6bc5bf3358384f787a9a34db677a9069a92305a297bf19e994efafe6fc02a536
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
50KB
MD5d45a7ec0cc3bea3317d3c67e762908e8
SHA129e09a23e2b0b2241a5616aa93b880d2365489e3
SHA256150e09068a7417f467c59eeee48b17748dcc46eb7b0006ac85d5a65bfeb29e95
SHA512b9441ffa1e82811147e99e769fbd81adbadd57778e460c221339fc4942cb7f9c6bc5bf3358384f787a9a34db677a9069a92305a297bf19e994efafe6fc02a536
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
50KB
MD5d45a7ec0cc3bea3317d3c67e762908e8
SHA129e09a23e2b0b2241a5616aa93b880d2365489e3
SHA256150e09068a7417f467c59eeee48b17748dcc46eb7b0006ac85d5a65bfeb29e95
SHA512b9441ffa1e82811147e99e769fbd81adbadd57778e460c221339fc4942cb7f9c6bc5bf3358384f787a9a34db677a9069a92305a297bf19e994efafe6fc02a536
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
50KB
MD5d45a7ec0cc3bea3317d3c67e762908e8
SHA129e09a23e2b0b2241a5616aa93b880d2365489e3
SHA256150e09068a7417f467c59eeee48b17748dcc46eb7b0006ac85d5a65bfeb29e95
SHA512b9441ffa1e82811147e99e769fbd81adbadd57778e460c221339fc4942cb7f9c6bc5bf3358384f787a9a34db677a9069a92305a297bf19e994efafe6fc02a536
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
50KB
MD5d45a7ec0cc3bea3317d3c67e762908e8
SHA129e09a23e2b0b2241a5616aa93b880d2365489e3
SHA256150e09068a7417f467c59eeee48b17748dcc46eb7b0006ac85d5a65bfeb29e95
SHA512b9441ffa1e82811147e99e769fbd81adbadd57778e460c221339fc4942cb7f9c6bc5bf3358384f787a9a34db677a9069a92305a297bf19e994efafe6fc02a536
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
50KB
MD5d45a7ec0cc3bea3317d3c67e762908e8
SHA129e09a23e2b0b2241a5616aa93b880d2365489e3
SHA256150e09068a7417f467c59eeee48b17748dcc46eb7b0006ac85d5a65bfeb29e95
SHA512b9441ffa1e82811147e99e769fbd81adbadd57778e460c221339fc4942cb7f9c6bc5bf3358384f787a9a34db677a9069a92305a297bf19e994efafe6fc02a536
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exeFilesize
25KB
MD57201bca64567be4cd9b0d8debf8ed1b0
SHA18525c615c51e1361cf0bc3d40ac007e9d58a6b92
SHA256718c12ab5271ab853f9f758f20637bfc5008a53113a39734d064b4d7e806c244
SHA512f5d294e84ce14d6498e9a555881d862cbe1d713e9e48cecbb941b4c0f7046d4948971f6812ac2cf499a84f21df72ea29bdd42db1d4a6553769448bbddc25b8f0
-
C:\Windows\Dllhost.exeFilesize
25KB
MD57201bca64567be4cd9b0d8debf8ed1b0
SHA18525c615c51e1361cf0bc3d40ac007e9d58a6b92
SHA256718c12ab5271ab853f9f758f20637bfc5008a53113a39734d064b4d7e806c244
SHA512f5d294e84ce14d6498e9a555881d862cbe1d713e9e48cecbb941b4c0f7046d4948971f6812ac2cf499a84f21df72ea29bdd42db1d4a6553769448bbddc25b8f0
-
C:\Windows\Dllhost.exeFilesize
25KB
MD57201bca64567be4cd9b0d8debf8ed1b0
SHA18525c615c51e1361cf0bc3d40ac007e9d58a6b92
SHA256718c12ab5271ab853f9f758f20637bfc5008a53113a39734d064b4d7e806c244
SHA512f5d294e84ce14d6498e9a555881d862cbe1d713e9e48cecbb941b4c0f7046d4948971f6812ac2cf499a84f21df72ea29bdd42db1d4a6553769448bbddc25b8f0
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
memory/360-104-0x0000000000000000-mapping.dmp
-
memory/592-70-0x0000000000000000-mapping.dmp
-
memory/592-73-0x0000000075401000-0x0000000075403000-memory.dmpFilesize
8KB
-
memory/592-74-0x0000000074B20000-0x00000000750CB000-memory.dmpFilesize
5.7MB
-
memory/592-76-0x0000000074B20000-0x00000000750CB000-memory.dmpFilesize
5.7MB
-
memory/912-65-0x0000000001370000-0x0000000001378000-memory.dmpFilesize
32KB
-
memory/912-62-0x0000000000000000-mapping.dmp
-
memory/1116-77-0x0000000000000000-mapping.dmp
-
memory/1116-79-0x00000000013B0000-0x00000000013B8000-memory.dmpFilesize
32KB
-
memory/1340-69-0x0000000000040000-0x0000000000048000-memory.dmpFilesize
32KB
-
memory/1340-67-0x0000000000000000-mapping.dmp
-
memory/1540-82-0x0000000000000000-mapping.dmp
-
memory/1560-101-0x0000000000000000-mapping.dmp
-
memory/1632-85-0x0000000000000000-mapping.dmp
-
memory/1648-89-0x0000000000000000-mapping.dmp
-
memory/1712-61-0x0000000000000000-mapping.dmp
-
memory/1712-95-0x0000000000000000-mapping.dmp
-
memory/1796-111-0x0000000000000000-mapping.dmp
-
memory/1808-92-0x0000000000000000-mapping.dmp
-
memory/1880-57-0x0000000000000000-mapping.dmp
-
memory/1880-80-0x000000001BBE0000-0x000000001BBEE000-memory.dmpFilesize
56KB
-
memory/1880-81-0x0000000000610000-0x0000000000626000-memory.dmpFilesize
88KB
-
memory/1880-66-0x0000000000620000-0x000000000062A000-memory.dmpFilesize
40KB
-
memory/1880-60-0x0000000000E60000-0x0000000000E68000-memory.dmpFilesize
32KB
-
memory/1888-108-0x0000000000000000-mapping.dmp
-
memory/1928-83-0x0000000000000000-mapping.dmp
-
memory/1964-54-0x0000000000FD0000-0x0000000000FD8000-memory.dmpFilesize
32KB
-
memory/1964-56-0x000007FEFC021000-0x000007FEFC023000-memory.dmpFilesize
8KB
-
memory/1964-55-0x0000000000340000-0x0000000000352000-memory.dmpFilesize
72KB
-
memory/2036-98-0x0000000000000000-mapping.dmp