Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 23:04
Static task
static1
Behavioral task
behavioral1
Sample
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe
Resource
win10v2004-20220812-en
General
-
Target
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe
-
Size
207KB
-
MD5
03f30bb108c14dd61e8cc7283ff03540
-
SHA1
f8de8c631e4c0bce2c0fb172e073d04cafbcc977
-
SHA256
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b
-
SHA512
10fea7e48e877055d1abb498f3dfc22dd110a1ebab832b05e5538fcc47c3dcf8bc25516d9ac251ef33c370e019506d9d8631fc6280d388e62214165d16f90602
-
SSDEEP
3072:opc0A07hw14W+9u08t4uuQU8gd8RM9lOOQCtWnYBV7MnidGiy6Vy3BuOyFmrsds:Ip7hxhySuuQUwkQCtWk7MgQkQ5yFd
Malware Config
Extracted
njrat
0.7d
HacKed
biggsmall.no-ip.biz:5552
27f240735122562cdace87e6f4dc2e8b
-
reg_key
27f240735122562cdace87e6f4dc2e8b
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
taskeng.exetaskeng.exepid process 3412 taskeng.exe 4488 taskeng.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe -
Drops startup file 2 IoCs
Processes:
taskeng.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\27f240735122562cdace87e6f4dc2e8b.exe taskeng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\27f240735122562cdace87e6f4dc2e8b.exe taskeng.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
taskeng.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\27f240735122562cdace87e6f4dc2e8b = "\"C:\\Users\\Admin\\AppData\\Roaming\\taskeng.exe\" .." taskeng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\27f240735122562cdace87e6f4dc2e8b = "\"C:\\Users\\Admin\\AppData\\Roaming\\taskeng.exe\" .." taskeng.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exetaskeng.exedescription pid process target process PID 4664 set thread context of 1040 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 3412 set thread context of 4488 3412 taskeng.exe taskeng.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exetaskeng.exepid process 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 3412 taskeng.exe 3412 taskeng.exe 3412 taskeng.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exetaskeng.exetaskeng.exedescription pid process Token: SeDebugPrivilege 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe Token: SeDebugPrivilege 3412 taskeng.exe Token: SeDebugPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe Token: 33 4488 taskeng.exe Token: SeIncBasePriorityPrivilege 4488 taskeng.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exetaskeng.exetaskeng.exedescription pid process target process PID 4664 wrote to memory of 1040 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 4664 wrote to memory of 1040 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 4664 wrote to memory of 1040 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 4664 wrote to memory of 1040 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 4664 wrote to memory of 1040 4664 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 1040 wrote to memory of 3412 1040 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe taskeng.exe PID 1040 wrote to memory of 3412 1040 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe taskeng.exe PID 1040 wrote to memory of 3412 1040 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe taskeng.exe PID 3412 wrote to memory of 4488 3412 taskeng.exe taskeng.exe PID 3412 wrote to memory of 4488 3412 taskeng.exe taskeng.exe PID 3412 wrote to memory of 4488 3412 taskeng.exe taskeng.exe PID 3412 wrote to memory of 4488 3412 taskeng.exe taskeng.exe PID 3412 wrote to memory of 4488 3412 taskeng.exe taskeng.exe PID 4488 wrote to memory of 3212 4488 taskeng.exe netsh.exe PID 4488 wrote to memory of 3212 4488 taskeng.exe netsh.exe PID 4488 wrote to memory of 3212 4488 taskeng.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe"C:\Users\Admin\AppData\Local\Temp\0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exeC:\Users\Admin\AppData\Local\Temp\0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\taskeng.exe"C:\Users\Admin\AppData\Roaming\taskeng.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\taskeng.exeC:\Users\Admin\AppData\Roaming\taskeng.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\taskeng.exe" "taskeng.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe.logFilesize
587B
MD571a04c1dc6609ccd637da41c8946774f
SHA11519d646d76e7b143adae49ef0de5119981e9c5e
SHA2560267b5fc0869759d96b3a824a1a75395f1c7d01f651b69d6cf50c3ed560fe91a
SHA5123bd32a31478a3732949698703f883b6ce217890d4a57d547e9ee7dee79b2a2682b790309f56a2cf467e74430cb4b90d93cd7fb82a9d549468ff1465cc4149350
-
C:\Users\Admin\AppData\Roaming\taskeng.exeFilesize
207KB
MD503f30bb108c14dd61e8cc7283ff03540
SHA1f8de8c631e4c0bce2c0fb172e073d04cafbcc977
SHA2560e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b
SHA51210fea7e48e877055d1abb498f3dfc22dd110a1ebab832b05e5538fcc47c3dcf8bc25516d9ac251ef33c370e019506d9d8631fc6280d388e62214165d16f90602
-
C:\Users\Admin\AppData\Roaming\taskeng.exeFilesize
207KB
MD503f30bb108c14dd61e8cc7283ff03540
SHA1f8de8c631e4c0bce2c0fb172e073d04cafbcc977
SHA2560e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b
SHA51210fea7e48e877055d1abb498f3dfc22dd110a1ebab832b05e5538fcc47c3dcf8bc25516d9ac251ef33c370e019506d9d8631fc6280d388e62214165d16f90602
-
C:\Users\Admin\AppData\Roaming\taskeng.exeFilesize
207KB
MD503f30bb108c14dd61e8cc7283ff03540
SHA1f8de8c631e4c0bce2c0fb172e073d04cafbcc977
SHA2560e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b
SHA51210fea7e48e877055d1abb498f3dfc22dd110a1ebab832b05e5538fcc47c3dcf8bc25516d9ac251ef33c370e019506d9d8631fc6280d388e62214165d16f90602
-
memory/1040-136-0x0000000075510000-0x0000000075AC1000-memory.dmpFilesize
5.7MB
-
memory/1040-134-0x0000000000000000-mapping.dmp
-
memory/1040-142-0x0000000075510000-0x0000000075AC1000-memory.dmpFilesize
5.7MB
-
memory/1040-135-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3212-149-0x0000000000000000-mapping.dmp
-
memory/3412-143-0x0000000075510000-0x0000000075AC1000-memory.dmpFilesize
5.7MB
-
memory/3412-148-0x0000000075510000-0x0000000075AC1000-memory.dmpFilesize
5.7MB
-
memory/3412-138-0x0000000000000000-mapping.dmp
-
memory/4488-144-0x0000000000000000-mapping.dmp
-
memory/4488-147-0x0000000075510000-0x0000000075AC1000-memory.dmpFilesize
5.7MB
-
memory/4488-150-0x0000000075510000-0x0000000075AC1000-memory.dmpFilesize
5.7MB
-
memory/4664-132-0x0000000075510000-0x0000000075AC1000-memory.dmpFilesize
5.7MB
-
memory/4664-137-0x0000000075510000-0x0000000075AC1000-memory.dmpFilesize
5.7MB
-
memory/4664-133-0x0000000075510000-0x0000000075AC1000-memory.dmpFilesize
5.7MB