Analysis
-
max time kernel
151s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
19-11-2022 08:57
Static task
static1
Behavioral task
behavioral1
Sample
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Resource
win10v2004-20221111-en
General
-
Target
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
-
Size
481KB
-
MD5
27e00b93a37c51f428df323ea212c120
-
SHA1
f2a35453203bd6352e63e8f11b73a141c2e7bcff
-
SHA256
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77
-
SHA512
991a1d3c04bdf76a62df8917577df8487503b7e60a9e764fd4da414ef6820feae35caf43cfbbd98a2a493848afed5968d05e251ac66ecb585df7dfe32580ed43
-
SSDEEP
6144:+4ZXzlxRdFf8SOcHeBl1b3HflUgxwTcDzw2:+sxLFfFOcHK1bvlUgxwd
Malware Config
Extracted
njrat
0.7d
TOP
127.0.0.1:1177
1daaeb58fdbc3f56c70815de2de95e46
-
reg_key
1daaeb58fdbc3f56c70815de2de95e46
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Chrome.exeChrome.exepid process 1168 Chrome.exe 800 Chrome.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Chrome.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1daaeb58fdbc3f56c70815de2de95e46.exe Chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1daaeb58fdbc3f56c70815de2de95e46.exe Chrome.exe -
Loads dropped DLL 1 IoCs
Processes:
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exepid process 1504 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Chrome.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1daaeb58fdbc3f56c70815de2de95e46 = "\"C:\\Users\\Admin\\Chrome.exe\" .." Chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\1daaeb58fdbc3f56c70815de2de95e46 = "\"C:\\Users\\Admin\\Chrome.exe\" .." Chrome.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exeChrome.exedescription pid process target process PID 1684 set thread context of 1504 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe PID 1168 set thread context of 800 1168 Chrome.exe Chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exeChrome.exeChrome.exedescription pid process Token: SeDebugPrivilege 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Token: 33 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Token: SeIncBasePriorityPrivilege 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Token: 33 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Token: SeIncBasePriorityPrivilege 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Token: 33 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Token: SeIncBasePriorityPrivilege 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Token: SeDebugPrivilege 1168 Chrome.exe Token: 33 1168 Chrome.exe Token: SeIncBasePriorityPrivilege 1168 Chrome.exe Token: 33 1168 Chrome.exe Token: SeIncBasePriorityPrivilege 1168 Chrome.exe Token: SeDebugPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe Token: 33 800 Chrome.exe Token: SeIncBasePriorityPrivilege 800 Chrome.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exebf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exeChrome.exeChrome.exedescription pid process target process PID 1684 wrote to memory of 1504 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe PID 1684 wrote to memory of 1504 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe PID 1684 wrote to memory of 1504 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe PID 1684 wrote to memory of 1504 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe PID 1684 wrote to memory of 1504 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe PID 1684 wrote to memory of 1504 1684 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe PID 1504 wrote to memory of 1168 1504 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Chrome.exe PID 1504 wrote to memory of 1168 1504 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Chrome.exe PID 1504 wrote to memory of 1168 1504 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Chrome.exe PID 1504 wrote to memory of 1168 1504 bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe Chrome.exe PID 1168 wrote to memory of 800 1168 Chrome.exe Chrome.exe PID 1168 wrote to memory of 800 1168 Chrome.exe Chrome.exe PID 1168 wrote to memory of 800 1168 Chrome.exe Chrome.exe PID 1168 wrote to memory of 800 1168 Chrome.exe Chrome.exe PID 1168 wrote to memory of 800 1168 Chrome.exe Chrome.exe PID 1168 wrote to memory of 800 1168 Chrome.exe Chrome.exe PID 800 wrote to memory of 456 800 Chrome.exe netsh.exe PID 800 wrote to memory of 456 800 Chrome.exe netsh.exe PID 800 wrote to memory of 456 800 Chrome.exe netsh.exe PID 800 wrote to memory of 456 800 Chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe"C:\Users\Admin\AppData\Local\Temp\bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exeC:\Users\Admin\AppData\Local\Temp\bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\Chrome.exe"C:\Users\Admin\Chrome.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\Chrome.exeC:\Users\Admin\Chrome.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\Chrome.exe" "Chrome.exe" ENABLE5⤵
- Modifies Windows Firewall
PID:456
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Chrome.exeFilesize
481KB
MD527e00b93a37c51f428df323ea212c120
SHA1f2a35453203bd6352e63e8f11b73a141c2e7bcff
SHA256bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77
SHA512991a1d3c04bdf76a62df8917577df8487503b7e60a9e764fd4da414ef6820feae35caf43cfbbd98a2a493848afed5968d05e251ac66ecb585df7dfe32580ed43
-
C:\Users\Admin\Chrome.exeFilesize
481KB
MD527e00b93a37c51f428df323ea212c120
SHA1f2a35453203bd6352e63e8f11b73a141c2e7bcff
SHA256bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77
SHA512991a1d3c04bdf76a62df8917577df8487503b7e60a9e764fd4da414ef6820feae35caf43cfbbd98a2a493848afed5968d05e251ac66ecb585df7dfe32580ed43
-
C:\Users\Admin\Chrome.exeFilesize
481KB
MD527e00b93a37c51f428df323ea212c120
SHA1f2a35453203bd6352e63e8f11b73a141c2e7bcff
SHA256bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77
SHA512991a1d3c04bdf76a62df8917577df8487503b7e60a9e764fd4da414ef6820feae35caf43cfbbd98a2a493848afed5968d05e251ac66ecb585df7dfe32580ed43
-
\Users\Admin\Chrome.exeFilesize
481KB
MD527e00b93a37c51f428df323ea212c120
SHA1f2a35453203bd6352e63e8f11b73a141c2e7bcff
SHA256bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77
SHA512991a1d3c04bdf76a62df8917577df8487503b7e60a9e764fd4da414ef6820feae35caf43cfbbd98a2a493848afed5968d05e251ac66ecb585df7dfe32580ed43
-
memory/456-79-0x0000000000000000-mapping.dmp
-
memory/800-72-0x000000000040746E-mapping.dmp
-
memory/1168-69-0x0000000000A00000-0x0000000000A7E000-memory.dmpFilesize
504KB
-
memory/1168-66-0x0000000000000000-mapping.dmp
-
memory/1168-78-0x00000000049D5000-0x00000000049E6000-memory.dmpFilesize
68KB
-
memory/1504-62-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1504-60-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1504-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1504-58-0x000000000040746E-mapping.dmp
-
memory/1684-63-0x0000000000590000-0x00000000005D0000-memory.dmpFilesize
256KB
-
memory/1684-54-0x0000000000AD0000-0x0000000000B4E000-memory.dmpFilesize
504KB
-
memory/1684-56-0x0000000000620000-0x000000000062A000-memory.dmpFilesize
40KB
-
memory/1684-55-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB