Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
28-06-2023 14:23
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230621-en
General
-
Target
file.exe
-
Size
457KB
-
MD5
288a04f04d9fc3e84ff5b2402c8050b1
-
SHA1
8e0b920bb33920e298ac9f73ab4b7ea0bbdfdbf2
-
SHA256
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6
-
SHA512
928b111cfb151ad8967e1bde8e1e17ab592f0312f3883b1faf6578401b49cc741dde7ae426ee1ef7d8c985b3e4d4b287ccabaf01ea3841f8438d4dc993d9b5fb
-
SSDEEP
12288:QkoPbgRuF1R5u7w1eTe5XxLvZNOujzAKv546Q4dPHm:QkEb4E5u7w8Te5XxLhN9l54r4dHm
Malware Config
Extracted
arrowrat
Client
212.224.86.109:1337
mTiBFWwWe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
jsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\DIirrnVVh\\WgQyIIgDg.exe" jsc.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
file.exejsc.exedescription pid process target process PID 1760 set thread context of 1700 1760 file.exe jsc.exe PID 1700 set thread context of 524 1700 jsc.exe cvtres.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
file.exejsc.exepid process 1760 file.exe 1760 file.exe 1700 jsc.exe 1700 jsc.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
file.exejsc.exeexplorer.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 1760 file.exe Token: SeDebugPrivilege 1700 jsc.exe Token: SeShutdownPrivilege 1904 explorer.exe Token: SeShutdownPrivilege 1904 explorer.exe Token: SeShutdownPrivilege 1904 explorer.exe Token: SeShutdownPrivilege 1904 explorer.exe Token: SeShutdownPrivilege 1904 explorer.exe Token: SeShutdownPrivilege 1904 explorer.exe Token: SeShutdownPrivilege 1904 explorer.exe Token: SeShutdownPrivilege 1904 explorer.exe Token: 33 1616 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1616 AUDIODG.EXE Token: 33 1616 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1616 AUDIODG.EXE Token: SeShutdownPrivilege 1904 explorer.exe Token: SeShutdownPrivilege 1904 explorer.exe Token: SeShutdownPrivilege 1904 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
explorer.exepid process 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe -
Suspicious use of SendNotifyMessage 15 IoCs
Processes:
explorer.exepid process 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
jsc.exepid process 1700 jsc.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
file.exejsc.exeexplorer.exedescription pid process target process PID 1760 wrote to memory of 2004 1760 file.exe CasPol.exe PID 1760 wrote to memory of 2004 1760 file.exe CasPol.exe PID 1760 wrote to memory of 2004 1760 file.exe CasPol.exe PID 1760 wrote to memory of 1364 1760 file.exe AddInProcess.exe PID 1760 wrote to memory of 1364 1760 file.exe AddInProcess.exe PID 1760 wrote to memory of 1364 1760 file.exe AddInProcess.exe PID 1760 wrote to memory of 1700 1760 file.exe jsc.exe PID 1760 wrote to memory of 1700 1760 file.exe jsc.exe PID 1760 wrote to memory of 1700 1760 file.exe jsc.exe PID 1760 wrote to memory of 1700 1760 file.exe jsc.exe PID 1760 wrote to memory of 1700 1760 file.exe jsc.exe PID 1760 wrote to memory of 1700 1760 file.exe jsc.exe PID 1760 wrote to memory of 1700 1760 file.exe jsc.exe PID 1760 wrote to memory of 1700 1760 file.exe jsc.exe PID 1760 wrote to memory of 1700 1760 file.exe jsc.exe PID 1700 wrote to memory of 1904 1700 jsc.exe explorer.exe PID 1700 wrote to memory of 1904 1700 jsc.exe explorer.exe PID 1700 wrote to memory of 1904 1700 jsc.exe explorer.exe PID 1700 wrote to memory of 1904 1700 jsc.exe explorer.exe PID 1700 wrote to memory of 524 1700 jsc.exe cvtres.exe PID 1700 wrote to memory of 524 1700 jsc.exe cvtres.exe PID 1700 wrote to memory of 524 1700 jsc.exe cvtres.exe PID 1700 wrote to memory of 524 1700 jsc.exe cvtres.exe PID 1700 wrote to memory of 524 1700 jsc.exe cvtres.exe PID 1700 wrote to memory of 524 1700 jsc.exe cvtres.exe PID 1700 wrote to memory of 524 1700 jsc.exe cvtres.exe PID 1700 wrote to memory of 524 1700 jsc.exe cvtres.exe PID 1700 wrote to memory of 524 1700 jsc.exe cvtres.exe PID 1904 wrote to memory of 860 1904 explorer.exe ctfmon.exe PID 1904 wrote to memory of 860 1904 explorer.exe ctfmon.exe PID 1904 wrote to memory of 860 1904 explorer.exe ctfmon.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"2⤵PID:2004
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"2⤵PID:1364
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:860
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 212.224.86.109 1337 mTiBFWwWe3⤵PID:524
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5701⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-71-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/524-73-0x00000000049B0000-0x00000000049F0000-memory.dmpFilesize
256KB
-
memory/524-66-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/524-65-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/524-64-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/524-61-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/524-62-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/524-63-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/524-68-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1700-56-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1700-58-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1700-72-0x0000000000CE0000-0x0000000000D20000-memory.dmpFilesize
256KB
-
memory/1700-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1760-54-0x0000000000EA0000-0x0000000000F16000-memory.dmpFilesize
472KB
-
memory/1760-55-0x000000001BE30000-0x000000001BEB0000-memory.dmpFilesize
512KB
-
memory/1904-83-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/1904-78-0x0000000003C60000-0x0000000003C61000-memory.dmpFilesize
4KB
-
memory/1904-79-0x0000000003C60000-0x0000000003C61000-memory.dmpFilesize
4KB