Analysis
-
max time kernel
152s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 22:03
Static task
static1
Behavioral task
behavioral1
Sample
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe
Resource
win10v2004-20220812-en
General
-
Target
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe
-
Size
75KB
-
MD5
51e44f83dadd7c650626bc3fc0b023a0
-
SHA1
980f7e510752177589f73820ebe8a44dceff9210
-
SHA256
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea
-
SHA512
d908f4a841b11b4b2366bf0c7293c6a6439cda8e531f37e5243ded0070f7000eb12ccaab6974d863992acddb22c50b336b8892dc2199c4940e3db4f6c43838f0
-
SSDEEP
1536:PNQQMr5TScbEjtsAJ2kSCCRbIL5A8skarPToftGD4W:P7o2cbkyAJ2kObINvabx4W
Malware Config
Extracted
njrat
0.6.4
HacKed
savioanon.no-ip.biz:1971
693c40e8f5f059f9726e9dc4e4bdd32f
-
reg_key
693c40e8f5f059f9726e9dc4e4bdd32f
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
%temp%.exesvhost.exesvhost.exeanon.exepid process 1324 %temp%.exe 952 svhost.exe 1108 svhost.exe 596 anon.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
Processes:
%temp%.exepid process 1324 %temp%.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
anon.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\693c40e8f5f059f9726e9dc4e4bdd32f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\anon.exe\" .." anon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\693c40e8f5f059f9726e9dc4e4bdd32f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\anon.exe\" .." anon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exeanon.exepid process 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe 596 anon.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exeanon.exedescription pid process Token: SeDebugPrivilege 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe Token: SeDebugPrivilege 596 anon.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe%temp%.exeanon.exedescription pid process target process PID 1640 wrote to memory of 1108 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 1640 wrote to memory of 1108 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 1640 wrote to memory of 1108 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 1640 wrote to memory of 1108 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 1640 wrote to memory of 952 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 1640 wrote to memory of 952 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 1640 wrote to memory of 952 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 1640 wrote to memory of 952 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 1640 wrote to memory of 1324 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe %temp%.exe PID 1640 wrote to memory of 1324 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe %temp%.exe PID 1640 wrote to memory of 1324 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe %temp%.exe PID 1640 wrote to memory of 1324 1640 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe %temp%.exe PID 1324 wrote to memory of 596 1324 %temp%.exe anon.exe PID 1324 wrote to memory of 596 1324 %temp%.exe anon.exe PID 1324 wrote to memory of 596 1324 %temp%.exe anon.exe PID 1324 wrote to memory of 596 1324 %temp%.exe anon.exe PID 596 wrote to memory of 520 596 anon.exe netsh.exe PID 596 wrote to memory of 520 596 anon.exe netsh.exe PID 596 wrote to memory of 520 596 anon.exe netsh.exe PID 596 wrote to memory of 520 596 anon.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe"C:\Users\Admin\AppData\Local\Temp\ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\svhost.exeC:\Windows\Temp\svhost.exe2⤵
- Executes dropped EXE
-
C:\Windows\Temp\svhost.exeC:\Windows\Temp\svhost.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\%temp%.exe"C:\Users\Admin\AppData\Local\Temp\%temp%.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\anon.exe"C:\Users\Admin\AppData\Local\Temp\anon.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\anon.exe" "anon.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\%temp%.exeFilesize
29KB
MD568111dfc1e5ceb7ace500209f229aac8
SHA12fed1646bcf410580c6b666561464af495f0e4bb
SHA256cf5dc6d712d2e57a72829ad3a44ee97dd81fc78874e74c925947009c391e008e
SHA51251c4ceb33ee7c51c2302204cdcaaf04a9120c56a96a45f9b4916fd5685bc2386c8d0c706d47497ecdfb7fce0ab6ec1e0fe605ea6f1badeb16485ed54ee5ed71e
-
C:\Users\Admin\AppData\Local\Temp\%temp%.exeFilesize
29KB
MD568111dfc1e5ceb7ace500209f229aac8
SHA12fed1646bcf410580c6b666561464af495f0e4bb
SHA256cf5dc6d712d2e57a72829ad3a44ee97dd81fc78874e74c925947009c391e008e
SHA51251c4ceb33ee7c51c2302204cdcaaf04a9120c56a96a45f9b4916fd5685bc2386c8d0c706d47497ecdfb7fce0ab6ec1e0fe605ea6f1badeb16485ed54ee5ed71e
-
C:\Users\Admin\AppData\Local\Temp\anon.exeFilesize
29KB
MD568111dfc1e5ceb7ace500209f229aac8
SHA12fed1646bcf410580c6b666561464af495f0e4bb
SHA256cf5dc6d712d2e57a72829ad3a44ee97dd81fc78874e74c925947009c391e008e
SHA51251c4ceb33ee7c51c2302204cdcaaf04a9120c56a96a45f9b4916fd5685bc2386c8d0c706d47497ecdfb7fce0ab6ec1e0fe605ea6f1badeb16485ed54ee5ed71e
-
C:\Users\Admin\AppData\Local\Temp\anon.exeFilesize
29KB
MD568111dfc1e5ceb7ace500209f229aac8
SHA12fed1646bcf410580c6b666561464af495f0e4bb
SHA256cf5dc6d712d2e57a72829ad3a44ee97dd81fc78874e74c925947009c391e008e
SHA51251c4ceb33ee7c51c2302204cdcaaf04a9120c56a96a45f9b4916fd5685bc2386c8d0c706d47497ecdfb7fce0ab6ec1e0fe605ea6f1badeb16485ed54ee5ed71e
-
C:\Windows\Temp\svhost.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Windows\Temp\svhost.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\AppData\Local\Temp\anon.exeFilesize
29KB
MD568111dfc1e5ceb7ace500209f229aac8
SHA12fed1646bcf410580c6b666561464af495f0e4bb
SHA256cf5dc6d712d2e57a72829ad3a44ee97dd81fc78874e74c925947009c391e008e
SHA51251c4ceb33ee7c51c2302204cdcaaf04a9120c56a96a45f9b4916fd5685bc2386c8d0c706d47497ecdfb7fce0ab6ec1e0fe605ea6f1badeb16485ed54ee5ed71e
-
memory/520-70-0x0000000000000000-mapping.dmp
-
memory/596-65-0x0000000000000000-mapping.dmp
-
memory/596-73-0x0000000073F70000-0x000000007451B000-memory.dmpFilesize
5.7MB
-
memory/596-72-0x0000000073F70000-0x000000007451B000-memory.dmpFilesize
5.7MB
-
memory/1324-63-0x0000000073F70000-0x000000007451B000-memory.dmpFilesize
5.7MB
-
memory/1324-57-0x0000000000000000-mapping.dmp
-
memory/1324-62-0x0000000075071000-0x0000000075073000-memory.dmpFilesize
8KB
-
memory/1324-69-0x0000000073F70000-0x000000007451B000-memory.dmpFilesize
5.7MB
-
memory/1640-54-0x000007FEF37D0000-0x000007FEF41F3000-memory.dmpFilesize
10.1MB
-
memory/1640-55-0x000007FEF24F0000-0x000007FEF3586000-memory.dmpFilesize
16.6MB
-
memory/1640-56-0x000007FEFB821000-0x000007FEFB823000-memory.dmpFilesize
8KB