Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:30
Static task
static1
Behavioral task
behavioral1
Sample
34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe
Resource
win10v2004-20220901-en
General
-
Target
34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe
-
Size
192KB
-
MD5
943f756626ce91cde9b9246e26642039
-
SHA1
a633aa256f687d95fa746efcb8d8c55da309b879
-
SHA256
34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900
-
SHA512
125109e78c64516b30de6d757c5d36e8d69ecc8efb3e4a9780e8a2ba130ad3d079b6f702023d353e6168a2d14cf0357482373047fd02b7edc29ffc266323bee8
-
SSDEEP
3072:E2tbXewZT3vviEj3IbQhbElPYSIeXkOAAeSTYSijsFCOJHeI6Awd:E2tbX/v8bQ653BXktVSsTSCOhDc
Malware Config
Extracted
njrat
0.7d
Slave
shadowraze.ddns.net:6357
35030464d16f3980d0eef2fa9a17c25f
-
reg_key
35030464d16f3980d0eef2fa9a17c25f
-
splitter
|'|'|
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FolderName\\file.exe" reg.exe -
Executes dropped EXE 1 IoCs
Processes:
notepad .exepid process 4896 notepad .exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exedescription pid process target process PID 3096 set thread context of 4896 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe notepad .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exepid process 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exenotepad .exedescription pid process Token: SeDebugPrivilege 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe Token: 33 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe Token: SeIncBasePriorityPrivilege 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe Token: SeDebugPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe Token: 33 4896 notepad .exe Token: SeIncBasePriorityPrivilege 4896 notepad .exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.execmd.exewscript.execmd.exenotepad .exedescription pid process target process PID 3096 wrote to memory of 4844 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe cmd.exe PID 3096 wrote to memory of 4844 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe cmd.exe PID 3096 wrote to memory of 4844 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe cmd.exe PID 3096 wrote to memory of 4896 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe notepad .exe PID 3096 wrote to memory of 4896 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe notepad .exe PID 3096 wrote to memory of 4896 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe notepad .exe PID 3096 wrote to memory of 4896 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe notepad .exe PID 3096 wrote to memory of 4896 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe notepad .exe PID 3096 wrote to memory of 4896 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe notepad .exe PID 3096 wrote to memory of 4896 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe notepad .exe PID 3096 wrote to memory of 4896 3096 34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe notepad .exe PID 4844 wrote to memory of 3220 4844 cmd.exe wscript.exe PID 4844 wrote to memory of 3220 4844 cmd.exe wscript.exe PID 4844 wrote to memory of 3220 4844 cmd.exe wscript.exe PID 3220 wrote to memory of 3124 3220 wscript.exe cmd.exe PID 3220 wrote to memory of 3124 3220 wscript.exe cmd.exe PID 3220 wrote to memory of 3124 3220 wscript.exe cmd.exe PID 3124 wrote to memory of 1388 3124 cmd.exe reg.exe PID 3124 wrote to memory of 1388 3124 cmd.exe reg.exe PID 3124 wrote to memory of 1388 3124 cmd.exe reg.exe PID 4896 wrote to memory of 2804 4896 notepad .exe netsh.exe PID 4896 wrote to memory of 2804 4896 notepad .exe netsh.exe PID 4896 wrote to memory of 2804 4896 notepad .exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe"C:\Users\Admin\AppData\Local\Temp\34253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderName\mata.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderName\file.exe" /f5⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\AppData\Local\Temp\notepad .exe"C:\Users\Admin\AppData\Local\Temp\notepad .exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\notepad .exe" "notepad .exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderName\file.exeFilesize
192KB
MD5943f756626ce91cde9b9246e26642039
SHA1a633aa256f687d95fa746efcb8d8c55da309b879
SHA25634253c7c851a1d2e24ccaf5f6e6828ab9f2145c79967b2d0abf1740b7a9fd900
SHA512125109e78c64516b30de6d757c5d36e8d69ecc8efb3e4a9780e8a2ba130ad3d079b6f702023d353e6168a2d14cf0357482373047fd02b7edc29ffc266323bee8
-
C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\FolderName\mata.batFilesize
70B
MD523f72401196919748c14cb64c1d55c3b
SHA1869e3809cb4391e6f5aee5349a871e40a1e1fb22
SHA256d09c4054568f89c5de2bd9bae9cbcbcb3ef2dda9a9ded0153e29da26dc405d11
SHA5122ab844717c31c4819d8773d7604dfc831e950ae9e38fe311acf8178d46f39fafb54b448ebb6b9cf5d1edd47ed36eae11d649c1be346b0a35d380dd07101c79f1
-
C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.batFilesize
264B
MD54a348e658b3bece507de24309737f37e
SHA14abb0d9acf447d8ae8f2c4ffbdde71f74df0eb6e
SHA256fe0ccea8e63ad44a98bce2497dede9f5387c4596427e847686f7595301b1e15f
SHA512c285c3c8f5cbf16d1351d3771abec41970eb0c47211d6102057367f0aa5674ee745520aafa55f4383f6386bb1ec9b5329705added4d75a77ba58dcdc487c0ddd
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
memory/1388-144-0x0000000000000000-mapping.dmp
-
memory/2804-148-0x0000000000000000-mapping.dmp
-
memory/3096-132-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3096-145-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3096-147-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3124-143-0x0000000000000000-mapping.dmp
-
memory/3220-139-0x0000000000000000-mapping.dmp
-
memory/4844-133-0x0000000000000000-mapping.dmp
-
memory/4896-135-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4896-141-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4896-134-0x0000000000000000-mapping.dmp
-
memory/4896-149-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB