Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    27-06-2022 13:27

General

  • Target

    Payloads.js

  • Size

    58KB

  • MD5

    94c08ba8dc8fa3697207c53665c1ddb3

  • SHA1

    1af6156240c60e2b39269e3649b2a30f981e75b9

  • SHA256

    40de3b364abfeae905e92cd564381d46a80c386c6011e37ce95df860abb572eb

  • SHA512

    11e1a9c810ed146a09aa79ee3d500af4a24d1c2432d5e3b62e125738bf0737dcc110c6926224850e5436b6af6a95ce25b4f8b4de4070f1e53d12a0fbc616dedf

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HACKED JFK

C2

103.149.13.61:4545

Mutex

782e4e93b9158d4d448232ed139fc0db

Attributes
  • reg_key

    782e4e93b9158d4d448232ed139fc0db

  • splitter

    |'|'|

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

  • Blocklisted process makes network request 16 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Drops startup file 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Payloads.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:824
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PoqvcWJwJA.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:936
    • C:\Users\Admin\AppData\Roaming\Server.exe
      "C:\Users\Admin\AppData\Roaming\Server.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Windows\system32\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Server.exe" "Server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:1868

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\PoqvcWJwJA.js

    Filesize

    5KB

    MD5

    38b9e490740629a6dd24eec991ddbd10

    SHA1

    dbf4d6c461b7f74a30533834d13b02da01e2e42f

    SHA256

    f17073bfd898f4b6442198f04be36ab8b821b7771b2e152213dba0b53571177c

    SHA512

    211d3a4cc32be4f6f38aa37cb9e1c3ed5cc18b8f43e8face02656e0e60c6ab666fbaba5dfec2b294d986f49fa9580822d056a6565d1a0aaa1ae5a415216578c8

  • C:\Users\Admin\AppData\Roaming\Server.exe

    Filesize

    25KB

    MD5

    7398714aa7e951484c0230bd1919a4d7

    SHA1

    ba27dc586f7de6d5bc21e54a8ba7b02c980b23ac

    SHA256

    d6355ea09274149b47d0fab0edc18d2627a1866557ac3a4cce6f4f15b586b9c2

    SHA512

    391249bdee93f2d2bea6c2c46f791d9533de73c79804a11ac18959fbf3eaf87483988c4fd1310187bf6a8afe3757c302682025b6295380ea0dc6b383693719cf

  • C:\Users\Admin\AppData\Roaming\Server.exe

    Filesize

    25KB

    MD5

    7398714aa7e951484c0230bd1919a4d7

    SHA1

    ba27dc586f7de6d5bc21e54a8ba7b02c980b23ac

    SHA256

    d6355ea09274149b47d0fab0edc18d2627a1866557ac3a4cce6f4f15b586b9c2

    SHA512

    391249bdee93f2d2bea6c2c46f791d9533de73c79804a11ac18959fbf3eaf87483988c4fd1310187bf6a8afe3757c302682025b6295380ea0dc6b383693719cf

  • memory/824-54-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

    Filesize

    8KB

  • memory/936-55-0x0000000000000000-mapping.dmp

  • memory/1564-57-0x0000000000000000-mapping.dmp

  • memory/1564-61-0x00000000010C0000-0x00000000010CC000-memory.dmp

    Filesize

    48KB

  • memory/1868-63-0x0000000000000000-mapping.dmp