Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
29-07-2022 05:56
Behavioral task
behavioral1
Sample
2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe
Resource
win10v2004-20220721-en
General
-
Target
2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe
-
Size
37KB
-
MD5
2cf3ef9b4b6aff5b4fa53dd9a61e77fd
-
SHA1
b19d77793f0410c6b8fb044e573ebbfa4e9ba6f1
-
SHA256
faa2e37de4a92178dfcc4d7966f1482f32755963736a964568e6d855f054eefb
-
SHA512
5a3233ca3e8dc3a886addd8acda04ca0337e1a43760a617dc690f1b3851ef684acf51132cd07e548e566dc9c170bdd5cad48182d2bc525b6f41e231f4e19ad02
Malware Config
Extracted
njrat
im523
HacKed
2.tcp.eu.ngrok.io:16632
f635a65108320f6738abf7ac7c96edbf
-
reg_key
f635a65108320f6738abf7ac7c96edbf
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
paint.exepid process 2032 paint.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
paint.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f635a65108320f6738abf7ac7c96edbf.exe paint.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f635a65108320f6738abf7ac7c96edbf.exe paint.exe -
Loads dropped DLL 1 IoCs
Processes:
2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exepid process 1668 2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
paint.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\f635a65108320f6738abf7ac7c96edbf = "\"C:\\Users\\Admin\\AppData\\Roaming\\paint.exe\" .." paint.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f635a65108320f6738abf7ac7c96edbf = "\"C:\\Users\\Admin\\AppData\\Roaming\\paint.exe\" .." paint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 996 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
paint.exepid process 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe 2032 paint.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
paint.exepid process 2032 paint.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
paint.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2032 paint.exe Token: SeDebugPrivilege 996 taskkill.exe Token: 33 2032 paint.exe Token: SeIncBasePriorityPrivilege 2032 paint.exe Token: 33 2032 paint.exe Token: SeIncBasePriorityPrivilege 2032 paint.exe Token: 33 2032 paint.exe Token: SeIncBasePriorityPrivilege 2032 paint.exe Token: 33 2032 paint.exe Token: SeIncBasePriorityPrivilege 2032 paint.exe Token: 33 2032 paint.exe Token: SeIncBasePriorityPrivilege 2032 paint.exe Token: 33 2032 paint.exe Token: SeIncBasePriorityPrivilege 2032 paint.exe Token: 33 2032 paint.exe Token: SeIncBasePriorityPrivilege 2032 paint.exe Token: 33 2032 paint.exe Token: SeIncBasePriorityPrivilege 2032 paint.exe Token: 33 2032 paint.exe Token: SeIncBasePriorityPrivilege 2032 paint.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exepaint.exedescription pid process target process PID 1668 wrote to memory of 2032 1668 2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe paint.exe PID 1668 wrote to memory of 2032 1668 2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe paint.exe PID 1668 wrote to memory of 2032 1668 2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe paint.exe PID 1668 wrote to memory of 2032 1668 2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe paint.exe PID 2032 wrote to memory of 1968 2032 paint.exe netsh.exe PID 2032 wrote to memory of 1968 2032 paint.exe netsh.exe PID 2032 wrote to memory of 1968 2032 paint.exe netsh.exe PID 2032 wrote to memory of 1968 2032 paint.exe netsh.exe PID 2032 wrote to memory of 996 2032 paint.exe taskkill.exe PID 2032 wrote to memory of 996 2032 paint.exe taskkill.exe PID 2032 wrote to memory of 996 2032 paint.exe taskkill.exe PID 2032 wrote to memory of 996 2032 paint.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe"C:\Users\Admin\AppData\Local\Temp\2cf3ef9b4b6aff5b4fa53dd9a61e77fd.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\paint.exe"C:\Users\Admin\AppData\Roaming\paint.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\paint.exe" "paint.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\paint.exeFilesize
37KB
MD52cf3ef9b4b6aff5b4fa53dd9a61e77fd
SHA1b19d77793f0410c6b8fb044e573ebbfa4e9ba6f1
SHA256faa2e37de4a92178dfcc4d7966f1482f32755963736a964568e6d855f054eefb
SHA5125a3233ca3e8dc3a886addd8acda04ca0337e1a43760a617dc690f1b3851ef684acf51132cd07e548e566dc9c170bdd5cad48182d2bc525b6f41e231f4e19ad02
-
C:\Users\Admin\AppData\Roaming\paint.exeFilesize
37KB
MD52cf3ef9b4b6aff5b4fa53dd9a61e77fd
SHA1b19d77793f0410c6b8fb044e573ebbfa4e9ba6f1
SHA256faa2e37de4a92178dfcc4d7966f1482f32755963736a964568e6d855f054eefb
SHA5125a3233ca3e8dc3a886addd8acda04ca0337e1a43760a617dc690f1b3851ef684acf51132cd07e548e566dc9c170bdd5cad48182d2bc525b6f41e231f4e19ad02
-
\Users\Admin\AppData\Roaming\paint.exeFilesize
37KB
MD52cf3ef9b4b6aff5b4fa53dd9a61e77fd
SHA1b19d77793f0410c6b8fb044e573ebbfa4e9ba6f1
SHA256faa2e37de4a92178dfcc4d7966f1482f32755963736a964568e6d855f054eefb
SHA5125a3233ca3e8dc3a886addd8acda04ca0337e1a43760a617dc690f1b3851ef684acf51132cd07e548e566dc9c170bdd5cad48182d2bc525b6f41e231f4e19ad02
-
memory/996-64-0x0000000000000000-mapping.dmp
-
memory/1668-54-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB
-
memory/1668-55-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB
-
memory/1668-61-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB
-
memory/1968-63-0x0000000000000000-mapping.dmp
-
memory/2032-57-0x0000000000000000-mapping.dmp
-
memory/2032-62-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB
-
memory/2032-66-0x00000000748E0000-0x0000000074E8B000-memory.dmpFilesize
5.7MB