Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04-09-2022 23:01
Behavioral task
behavioral1
Sample
0448a1129ee3c9198ea9e4e2d24da6e4.exe
Resource
win7-20220901-en
General
-
Target
0448a1129ee3c9198ea9e4e2d24da6e4.exe
-
Size
93KB
-
MD5
0448a1129ee3c9198ea9e4e2d24da6e4
-
SHA1
e77779889bf71efd4f7f9c0e87b07a970b50179f
-
SHA256
9c59f5c307a254394410941d0053fd57d97478e5900c04fc161d818a7b564d7d
-
SHA512
7108aaa62b8a3c65d8a290017441c5f8c47ab34a9a1edbe83f6600f757ee1a5e37bd5cfeae1e3a1a99079ec126891efbf62ccdf797a8ae04c64405984c55faec
-
SSDEEP
768:hY3AUfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3EKZsGdpx:TU5WhIUKcuOJhPhBjEwzGi1dDDDhgS
Malware Config
Extracted
njrat
0.7d
HacKed
NC50Y3AuZXUubmdyb2suaW8Strik:MTQ1NDU=
1f895475f5ddc401fae8d2be35829e62
-
reg_key
1f895475f5ddc401fae8d2be35829e62
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 1080 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe -
Loads dropped DLL 2 IoCs
Processes:
0448a1129ee3c9198ea9e4e2d24da6e4.exepid process 960 0448a1129ee3c9198ea9e4e2d24da6e4.exe 960 0448a1129ee3c9198ea9e4e2d24da6e4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
server.exepid process 1080 server.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe Token: 33 1080 server.exe Token: SeIncBasePriorityPrivilege 1080 server.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0448a1129ee3c9198ea9e4e2d24da6e4.exeserver.exedescription pid process target process PID 960 wrote to memory of 1080 960 0448a1129ee3c9198ea9e4e2d24da6e4.exe server.exe PID 960 wrote to memory of 1080 960 0448a1129ee3c9198ea9e4e2d24da6e4.exe server.exe PID 960 wrote to memory of 1080 960 0448a1129ee3c9198ea9e4e2d24da6e4.exe server.exe PID 960 wrote to memory of 1080 960 0448a1129ee3c9198ea9e4e2d24da6e4.exe server.exe PID 1080 wrote to memory of 1916 1080 server.exe netsh.exe PID 1080 wrote to memory of 1916 1080 server.exe netsh.exe PID 1080 wrote to memory of 1916 1080 server.exe netsh.exe PID 1080 wrote to memory of 1916 1080 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0448a1129ee3c9198ea9e4e2d24da6e4.exe"C:\Users\Admin\AppData\Local\Temp\0448a1129ee3c9198ea9e4e2d24da6e4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD5047dda8d29bbbf2b6e1c3f4212189eba
SHA1eb10217bbf887b1ad9b984cb7a559b177e2c762a
SHA256afd43463eba279dc102afa66f3ef7173885c540c02776217638de34e03486125
SHA51284c38a784fa77686de5be91738fffd0371ca667eff0e117c87e8e2d676ef29b7defe21c7bfa83f00ef967d73d3983fb038bd07b93fde963ec5ae10a2f569a822
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD50448a1129ee3c9198ea9e4e2d24da6e4
SHA1e77779889bf71efd4f7f9c0e87b07a970b50179f
SHA2569c59f5c307a254394410941d0053fd57d97478e5900c04fc161d818a7b564d7d
SHA5127108aaa62b8a3c65d8a290017441c5f8c47ab34a9a1edbe83f6600f757ee1a5e37bd5cfeae1e3a1a99079ec126891efbf62ccdf797a8ae04c64405984c55faec
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD50448a1129ee3c9198ea9e4e2d24da6e4
SHA1e77779889bf71efd4f7f9c0e87b07a970b50179f
SHA2569c59f5c307a254394410941d0053fd57d97478e5900c04fc161d818a7b564d7d
SHA5127108aaa62b8a3c65d8a290017441c5f8c47ab34a9a1edbe83f6600f757ee1a5e37bd5cfeae1e3a1a99079ec126891efbf62ccdf797a8ae04c64405984c55faec
-
\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD50448a1129ee3c9198ea9e4e2d24da6e4
SHA1e77779889bf71efd4f7f9c0e87b07a970b50179f
SHA2569c59f5c307a254394410941d0053fd57d97478e5900c04fc161d818a7b564d7d
SHA5127108aaa62b8a3c65d8a290017441c5f8c47ab34a9a1edbe83f6600f757ee1a5e37bd5cfeae1e3a1a99079ec126891efbf62ccdf797a8ae04c64405984c55faec
-
\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD50448a1129ee3c9198ea9e4e2d24da6e4
SHA1e77779889bf71efd4f7f9c0e87b07a970b50179f
SHA2569c59f5c307a254394410941d0053fd57d97478e5900c04fc161d818a7b564d7d
SHA5127108aaa62b8a3c65d8a290017441c5f8c47ab34a9a1edbe83f6600f757ee1a5e37bd5cfeae1e3a1a99079ec126891efbf62ccdf797a8ae04c64405984c55faec
-
memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/960-55-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/960-62-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1080-58-0x0000000000000000-mapping.dmp
-
memory/1080-64-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1080-67-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1916-65-0x0000000000000000-mapping.dmp