Analysis
-
max time kernel
151s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 07:11
Behavioral task
behavioral1
Sample
3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe
Resource
win10v2004-20220414-en
General
-
Target
3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe
-
Size
23KB
-
MD5
6da1b9e34be8401e656dd8a263d1857a
-
SHA1
c252431527c0aebb9edca387ce9ddb71d2baa311
-
SHA256
3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1
-
SHA512
48b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:2222
a2e45a7dbc044c98d46693fd415d81b0
-
reg_key
a2e45a7dbc044c98d46693fd415d81b0
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
revenge.exepid process 1928 revenge.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe -
Drops startup file 2 IoCs
Processes:
revenge.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2e45a7dbc044c98d46693fd415d81b0.exe revenge.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2e45a7dbc044c98d46693fd415d81b0.exe revenge.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
revenge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a2e45a7dbc044c98d46693fd415d81b0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\revenge.exe\" .." revenge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a2e45a7dbc044c98d46693fd415d81b0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\revenge.exe\" .." revenge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
revenge.exedescription pid process Token: SeDebugPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe Token: 33 1928 revenge.exe Token: SeIncBasePriorityPrivilege 1928 revenge.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exerevenge.exedescription pid process target process PID 3764 wrote to memory of 1928 3764 3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe revenge.exe PID 3764 wrote to memory of 1928 3764 3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe revenge.exe PID 3764 wrote to memory of 1928 3764 3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe revenge.exe PID 1928 wrote to memory of 2328 1928 revenge.exe netsh.exe PID 1928 wrote to memory of 2328 1928 revenge.exe netsh.exe PID 1928 wrote to memory of 2328 1928 revenge.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe"C:\Users\Admin\AppData\Local\Temp\3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\revenge.exe"C:\Users\Admin\AppData\Local\Temp\revenge.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\revenge.exe" "revenge.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\revenge.exeFilesize
23KB
MD56da1b9e34be8401e656dd8a263d1857a
SHA1c252431527c0aebb9edca387ce9ddb71d2baa311
SHA2563e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1
SHA51248b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79
-
C:\Users\Admin\AppData\Local\Temp\revenge.exeFilesize
23KB
MD56da1b9e34be8401e656dd8a263d1857a
SHA1c252431527c0aebb9edca387ce9ddb71d2baa311
SHA2563e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1
SHA51248b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79
-
memory/1928-131-0x0000000000000000-mapping.dmp
-
memory/1928-135-0x0000000074DD0000-0x0000000075381000-memory.dmpFilesize
5.7MB
-
memory/1928-136-0x0000000074DD0000-0x0000000075381000-memory.dmpFilesize
5.7MB
-
memory/2328-137-0x0000000000000000-mapping.dmp
-
memory/3764-130-0x0000000074DD0000-0x0000000075381000-memory.dmpFilesize
5.7MB
-
memory/3764-134-0x0000000074DD0000-0x0000000075381000-memory.dmpFilesize
5.7MB