njrat | hxxps://www[.]upload[.]ee/files/14908190/Titanic_Executor[.]zip[.]html

Analysis

max time kernel
209s
max time network
211s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
06-02-2023 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.upload.ee/files/14908190/Titanic_Executor.zip.html

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

carolina-electro.at.ply.gg:23401

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 4 IoCs

Processes:

Titanic.exeattrib.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Titanic.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Titanic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Titanic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	attrib.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Titanic.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Titanic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Titanic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Titanic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Titanic.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 7942aa4aa9aed801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\upload.ee\Total = "51"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.upload.ee\ = "83"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\upload.ee\Total = "337"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\upload.ee\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.upload.ee\ = "51"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "150"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "337"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd200c57b3479248820ab0551cc222a800000000020000000000106600000001000020000000d0ec6d87a648277df87f5adcbc6e9a3de5a02e54b49e32486363f3bc043356f4000000000e800000000200002000000072a865966d6d04738c3dc183985cf47c4a66e9aec6caa04d6da9ac87d352b2222000000042609ef3c94a8df19d52d9e1115488347200d23b147726484b74cb9cba8f445340000000041b57236286f0dd4bcb2eb014e305fe614ec71661ba70c2b0c4eab2a5e638ada6589569c6eb386f54095f2dc0cef5964c159f8e364e0ae78d05ec7c6cd8471a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1000214523"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "382546241"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\upload.ee\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382499095"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\upload.ee\Total = "83"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "105"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.upload.ee\ = "150"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\upload.ee\Total = "150"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd200c57b3479248820ab0551cc222a80000000002000000000010660000000100002000000050d74816b06f5a4bb4b80db14423e63eb7d308a68154302cced5096ed3a9dabd000000000e800000000200002000000039181e6c36f23527c3f5033af8ccb0fb2a1b9ebee91aae07d7059bd773c5e52920000000531340b5b4e2c8b1a4c567bba6267304065ce8d722f168bc1c5a34b53af82eb44000000053fd49f620f9688f1020d5809dd91cf840066ed071af01d55411a7b963085ee166cad9971b4ceeace031639c09abf17d9f107c580faeefa06611642028a96674	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\upload.ee\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\upload.ee\Total = "13"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "83"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.upload.ee\ = "337"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31013455"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31013455"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "382539924"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "13"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.upload.ee	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.upload.ee\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.upload.ee\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.upload.ee\ = "105"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1000214523"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 1 IoCs

Processes:

iexplore.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	iexplore.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

Titanic.exe

description	pid	process
Token: SeDebugPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe
Token: 33	1544	Titanic.exe
Token: SeIncBasePriorityPrivilege	1544	Titanic.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

2512 iexplore.exe
2512 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2512 iexplore.exe
2512 iexplore.exe
2768 IEXPLORE.EXE
2768 IEXPLORE.EXE
2768 IEXPLORE.EXE
2768 IEXPLORE.EXE

pid	process
2512	iexplore.exe
2512	iexplore.exe

pid	process
2512	iexplore.exe
2512	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

iexplore.exeTitanic.exe

description	pid	process	target process
PID 2512 wrote to memory of 2768	2512	iexplore.exe	IEXPLORE.EXE
PID 2512 wrote to memory of 2768	2512	iexplore.exe	IEXPLORE.EXE
PID 2512 wrote to memory of 2768	2512	iexplore.exe	IEXPLORE.EXE
PID 1544 wrote to memory of 3284	1544	Titanic.exe	attrib.exe
PID 1544 wrote to memory of 3284	1544	Titanic.exe	attrib.exe
PID 1544 wrote to memory of 3284	1544	Titanic.exe	attrib.exe
PID 1544 wrote to memory of 4156	1544	Titanic.exe	attrib.exe
PID 1544 wrote to memory of 4156	1544	Titanic.exe	attrib.exe
PID 1544 wrote to memory of 4156	1544	Titanic.exe	attrib.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

3284 attrib.exe
4156 attrib.exe

pid	process
3284	attrib.exe
4156	attrib.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.upload.ee/files/14908190/Titanic_Executor.zip.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4308

C:\Users\Admin\AppData\Local\Temp\Temp1_Titanic_Executor.zip\Titanic Executor\Titanic.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Titanic_Executor.zip\Titanic Executor\Titanic.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
2⤵
- Drops startup file
- Views/modifies file attributes
PID:3284

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
2⤵
- Views/modifies file attributes
PID:4156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\709A8EC0F6D3194AD001E9041914421F_EF185B36BF409E157C6594875900B4A1
Filesize
471B

MD5
a70747263ad7fefc50cdd71fae005b5a

SHA1
aacc11dc19f1d5d1e6e8249406bc9dbd63699940

SHA256
4871cd95e2401bc6466cd5539dcb5cfd6195d9b585dc9e62d05c2e8ab8a58e4d

SHA512
17a49ab3ae98112fa5cf440679addb7010c674b53faa649f2e4e060f04eb063faa3579f665ad9770e34c8ee4be7ad48c35e886dcbcf094a6dcbf0e04843b2192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_86C2A03C133240EC4C95180B9FD368BB
Filesize
471B

MD5
ec857dfd9c0b8f914cea2a084db71465

SHA1
851e9c7f996a247102782fe061bd30081adc6a66

SHA256
5ecb4328a5a982d99d7906901f2bb6fa5d768079b5e5962ea353a17046dad40e

SHA512
5c6bf6d0a6f25aa98a99c77150fff6148e0e7a04dae11c0f7b9c5a55d31ab7eea210c2011efd2280bb9cb97520fba7a2385ee4bc3347cf5c064a7595b7b47568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\709A8EC0F6D3194AD001E9041914421F_EF185B36BF409E157C6594875900B4A1
Filesize
426B

MD5
e89a7a9a28cdd1616d5a0bfe4ddd22e0

SHA1
2858fdccd200625c7ea593cdffec8c8b4d51f97f

SHA256
9d589a88ec6acea6b57e67d4450350c584bbcc21d2e2bf512936c64d406171eb

SHA512
98936f81cea666bfae405ac0755ee0f491505a703bd4f6001ef1f4c12d5b48d156b49b0907189c9af6587c17d6f12c46abd021e6bb7660c526fd7648e05833c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_86C2A03C133240EC4C95180B9FD368BB
Filesize
400B

MD5
e66ebcc27b5cf1b02ac67ab9c84652df

SHA1
489249bcfc419f343b9942760c4afff55825cab6

SHA256
7f7c278feaf1bf0f0de75527f56330602c319db46e5c6dcf02ac0c418a440c72

SHA512
f1f994e8e4fa660f0a2cbec48db8e050e164a0908e367eef31e82c3a30b55768790e8fc7bd5f4d8d2f53f6325311c2a7f932cce94e70cc9bc24922adc4f9c441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\C5EUSF6R.cookie
Filesize
611B

MD5
ce362dda8449ed7d43272338de5b8e2e

SHA1
9fb52c932a3bfa4b0da0d745ae04c37f151d21b8

SHA256
fbe3dd245f3ca8a6e246f81d8614b01eadb68d8240c80f1238588a138b042073

SHA512
70f3bd24275ead6182dc2772baaf6f4b380a7d893661a9804877aa5f990777b072a29fb50fbc6705186cdfbe3cefbaaa6edb3529b80cea0cde029aafc7776820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\TY9VEEUA.cookie
Filesize
688B

MD5
22f5271325a0eeb1646f8b400cac008b

SHA1
a90477ebf1ceed2f1b4058c0c51e816321417aa4

SHA256
68c034b5a4ca575fb7e629e741d0c17a6b30b4be825e8300f91bfa0c879ed9fd

SHA512
6838c6ea7584450223ca92c755ef5578b7b0490aafc5a507dda2a96132cabdda58d76d0836ad2375cff3fd61a924e0ddd5fb4edbad5c61dac14ec49f29bf11f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\V1D5OC88.cookie
Filesize
236B

MD5
2631130e8374a9feb8594df5fc19d0e8

SHA1
51bd3f368878ce356e62e7ea58c713656c8115f5

SHA256
790312d124213d2ecb11adb56f9d613d5e7cf09e067db4cb708d35d0d52484eb

SHA512
05dea92914b371b7fbd3e71193457ed8b4a1ace29a32909afa52765b93049011153ede177dc53eb98cc7c3b5f74bb670de0c3cc3554c2ba57e90d88fd49ed16c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe
Filesize
291KB

MD5
d09b241cd50d2946658c3e5d85e2a22f

SHA1
ae0ac19487e50e0582141cb6f085b5422d23d032

SHA256
5a759db95fdbf893758f6e147b38f03768ad778c241fcf3b648752ed428f4f83

SHA512
2a492a540193739b90ef14ad403c5362052d5b2a862d4bf1d08450d488fc7db1ccaf19fd44331f22305b2eaba25e9b002eacf7a6379de73fe6721aa612ffb11d

Download Submit
C:\Users\Admin\Downloads\Titanic_Executor.zip.ydtxitv.partial
Filesize
1.3MB

MD5
9692c779c410663e1026bb7e7b9ece8c

SHA1
db168af12fcd3df0a3615ec1a1f6bc74b8826ace

SHA256
e6cc7e34b28fef13bc68cf424607e0518fb0d04816c11911420976656fc85516

SHA512
a55ac9683fbb01ebb9f841f2d08222d7fedbed956b361578fb41e2115947520d42dce72d89c4926efa14522b18adcfe498cacff22bbd77e80f807cffa9e54b4c

Download Submit
memory/1544-160-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-134-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-131-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-132-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-163-0x0000000000820000-0x0000000000870000-memory.dmp

Filesize
320KB

Download
memory/1544-164-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-135-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-136-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-137-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-138-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-139-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-140-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-141-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-143-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-142-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-144-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-145-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-146-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-147-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-148-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-149-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-150-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-151-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-152-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-153-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-154-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-156-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-155-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-158-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-157-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-159-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-129-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-161-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-162-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-165-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-130-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-133-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-166-0x00000000050B0000-0x000000000514C000-memory.dmp

Filesize
624KB

Download
memory/1544-167-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-168-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-170-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-172-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-173-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-171-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-169-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-174-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-175-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-176-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-177-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-178-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-179-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-180-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-181-0x0000000005E20000-0x000000000631E000-memory.dmp

Filesize
5.0MB

Download
memory/1544-182-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-190-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-127-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-217-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Filesize
408KB

Download
memory/1544-209-0x0000000005970000-0x000000000597A000-memory.dmp

Filesize
40KB

Download
memory/1544-128-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/1544-200-0x00000000059C0000-0x0000000005A52000-memory.dmp

Filesize
584KB

Download
memory/3284-191-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3284-188-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3284-184-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3284-195-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3284-186-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3284-183-0x0000000000000000-mapping.dmp

Download
memory/4156-193-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4156-189-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4156-194-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4156-192-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4156-187-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4156-185-0x0000000000000000-mapping.dmp

Download