Analysis
-
max time kernel
151s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 19:38
Behavioral task
behavioral1
Sample
a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe
Resource
win7-20220812-en
General
-
Target
a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe
-
Size
29KB
-
MD5
3490a3125771a2ddd8d9d633be4201b0
-
SHA1
134db4d28672703ca6670b3f8d8823b1b1f877fe
-
SHA256
a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8
-
SHA512
96ecf261d86f97cc0b091cc01ff109ece03bbbbbf20cdf00fb50b6f1024ffc966602bf20b1ada0f802c616c0797276e5afbfe0e6a488391d787e10a0fa15f0d2
-
SSDEEP
384:CPqvANl7TxTD+VF2dbofPauxnaIuN15708COmqDk9jeHqGBsbh0w4wlAokw9Ohgd:5u75oa4fuTC8cqojeVBKh0p29SgRTn
Malware Config
Extracted
njrat
0.6.4
Stiva
stivadns.zapto.org:1177
c628feb012b1a51cfd51ff0ba11260eb
-
reg_key
c628feb012b1a51cfd51ff0ba11260eb
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Java.exepid process 1352 Java.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c628feb012b1a51cfd51ff0ba11260eb.exe Java.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c628feb012b1a51cfd51ff0ba11260eb.exe Java.exe -
Loads dropped DLL 1 IoCs
Processes:
a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exepid process 1976 a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Java.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c628feb012b1a51cfd51ff0ba11260eb = "\"C:\\ProgramData\\Java.exe\" .." Java.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\c628feb012b1a51cfd51ff0ba11260eb = "\"C:\\ProgramData\\Java.exe\" .." Java.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Java.exepid process 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe 1352 Java.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Java.exedescription pid process Token: SeDebugPrivilege 1352 Java.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exeJava.exedescription pid process target process PID 1976 wrote to memory of 1352 1976 a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe Java.exe PID 1976 wrote to memory of 1352 1976 a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe Java.exe PID 1976 wrote to memory of 1352 1976 a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe Java.exe PID 1976 wrote to memory of 1352 1976 a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe Java.exe PID 1976 wrote to memory of 1352 1976 a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe Java.exe PID 1976 wrote to memory of 1352 1976 a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe Java.exe PID 1976 wrote to memory of 1352 1976 a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe Java.exe PID 1352 wrote to memory of 1296 1352 Java.exe netsh.exe PID 1352 wrote to memory of 1296 1352 Java.exe netsh.exe PID 1352 wrote to memory of 1296 1352 Java.exe netsh.exe PID 1352 wrote to memory of 1296 1352 Java.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe"C:\Users\Admin\AppData\Local\Temp\a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Java.exe"C:\ProgramData\Java.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\Java.exe" "Java.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Java.exeFilesize
29KB
MD53490a3125771a2ddd8d9d633be4201b0
SHA1134db4d28672703ca6670b3f8d8823b1b1f877fe
SHA256a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8
SHA51296ecf261d86f97cc0b091cc01ff109ece03bbbbbf20cdf00fb50b6f1024ffc966602bf20b1ada0f802c616c0797276e5afbfe0e6a488391d787e10a0fa15f0d2
-
C:\ProgramData\Java.exeFilesize
29KB
MD53490a3125771a2ddd8d9d633be4201b0
SHA1134db4d28672703ca6670b3f8d8823b1b1f877fe
SHA256a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8
SHA51296ecf261d86f97cc0b091cc01ff109ece03bbbbbf20cdf00fb50b6f1024ffc966602bf20b1ada0f802c616c0797276e5afbfe0e6a488391d787e10a0fa15f0d2
-
\ProgramData\Java.exeFilesize
29KB
MD53490a3125771a2ddd8d9d633be4201b0
SHA1134db4d28672703ca6670b3f8d8823b1b1f877fe
SHA256a5e656cedb3fe0dfc90d3840add5669385e8d60347a9a47ca697beb4c6b871d8
SHA51296ecf261d86f97cc0b091cc01ff109ece03bbbbbf20cdf00fb50b6f1024ffc966602bf20b1ada0f802c616c0797276e5afbfe0e6a488391d787e10a0fa15f0d2
-
memory/1296-63-0x0000000000000000-mapping.dmp
-
memory/1352-57-0x0000000000000000-mapping.dmp
-
memory/1352-62-0x0000000074120000-0x00000000746CB000-memory.dmpFilesize
5.7MB
-
memory/1352-65-0x0000000074120000-0x00000000746CB000-memory.dmpFilesize
5.7MB
-
memory/1976-54-0x00000000754E1000-0x00000000754E3000-memory.dmpFilesize
8KB
-
memory/1976-55-0x0000000074120000-0x00000000746CB000-memory.dmpFilesize
5.7MB
-
memory/1976-61-0x0000000074120000-0x00000000746CB000-memory.dmpFilesize
5.7MB