Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
28-06-2023 14:25
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230621-en
General
-
Target
file.exe
-
Size
457KB
-
MD5
288a04f04d9fc3e84ff5b2402c8050b1
-
SHA1
8e0b920bb33920e298ac9f73ab4b7ea0bbdfdbf2
-
SHA256
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6
-
SHA512
928b111cfb151ad8967e1bde8e1e17ab592f0312f3883b1faf6578401b49cc741dde7ae426ee1ef7d8c985b3e4d4b287ccabaf01ea3841f8438d4dc993d9b5fb
-
SSDEEP
12288:QkoPbgRuF1R5u7w1eTe5XxLvZNOujzAKv546Q4dPHm:QkEb4E5u7w8Te5XxLhN9l54r4dHm
Malware Config
Extracted
arrowrat
Client
212.224.86.109:1337
mTiBFWwWe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
jsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\DIirrnVVh\\WgQyIIgDg.exe" jsc.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
file.exejsc.exedescription pid process target process PID 1956 set thread context of 1088 1956 file.exe jsc.exe PID 1088 set thread context of 2024 1088 jsc.exe cvtres.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
file.exejsc.exepid process 1956 file.exe 1956 file.exe 1088 jsc.exe 1088 jsc.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
file.exejsc.exeexplorer.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 1956 file.exe Token: SeDebugPrivilege 1088 jsc.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: 33 304 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 304 AUDIODG.EXE Token: 33 304 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 304 AUDIODG.EXE Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
explorer.exepid process 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
explorer.exepid process 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
jsc.exepid process 1088 jsc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
file.exejsc.exeexplorer.exedescription pid process target process PID 1956 wrote to memory of 1932 1956 file.exe AddInProcess32.exe PID 1956 wrote to memory of 1932 1956 file.exe AddInProcess32.exe PID 1956 wrote to memory of 1932 1956 file.exe AddInProcess32.exe PID 1956 wrote to memory of 1932 1956 file.exe AddInProcess32.exe PID 1956 wrote to memory of 920 1956 file.exe WsatConfig.exe PID 1956 wrote to memory of 920 1956 file.exe WsatConfig.exe PID 1956 wrote to memory of 920 1956 file.exe WsatConfig.exe PID 1956 wrote to memory of 1088 1956 file.exe jsc.exe PID 1956 wrote to memory of 1088 1956 file.exe jsc.exe PID 1956 wrote to memory of 1088 1956 file.exe jsc.exe PID 1956 wrote to memory of 1088 1956 file.exe jsc.exe PID 1956 wrote to memory of 1088 1956 file.exe jsc.exe PID 1956 wrote to memory of 1088 1956 file.exe jsc.exe PID 1956 wrote to memory of 1088 1956 file.exe jsc.exe PID 1956 wrote to memory of 1088 1956 file.exe jsc.exe PID 1956 wrote to memory of 1088 1956 file.exe jsc.exe PID 1088 wrote to memory of 2008 1088 jsc.exe explorer.exe PID 1088 wrote to memory of 2008 1088 jsc.exe explorer.exe PID 1088 wrote to memory of 2008 1088 jsc.exe explorer.exe PID 1088 wrote to memory of 2008 1088 jsc.exe explorer.exe PID 1088 wrote to memory of 2024 1088 jsc.exe cvtres.exe PID 1088 wrote to memory of 2024 1088 jsc.exe cvtres.exe PID 1088 wrote to memory of 2024 1088 jsc.exe cvtres.exe PID 1088 wrote to memory of 2024 1088 jsc.exe cvtres.exe PID 1088 wrote to memory of 2024 1088 jsc.exe cvtres.exe PID 1088 wrote to memory of 2024 1088 jsc.exe cvtres.exe PID 1088 wrote to memory of 2024 1088 jsc.exe cvtres.exe PID 1088 wrote to memory of 2024 1088 jsc.exe cvtres.exe PID 1088 wrote to memory of 2024 1088 jsc.exe cvtres.exe PID 2008 wrote to memory of 1668 2008 explorer.exe ctfmon.exe PID 2008 wrote to memory of 1668 2008 explorer.exe ctfmon.exe PID 2008 wrote to memory of 1668 2008 explorer.exe ctfmon.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵PID:1932
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"2⤵PID:920
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:1668
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 212.224.86.109 1337 mTiBFWwWe3⤵PID:2024
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1601⤵
- Suspicious use of AdjustPrivilegeToken
PID:304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-73-0x00000000049B0000-0x00000000049F0000-memory.dmpFilesize
256KB
-
memory/1088-56-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1088-58-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1088-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1956-55-0x000000001BF30000-0x000000001BFB0000-memory.dmpFilesize
512KB
-
memory/1956-54-0x0000000000FF0000-0x0000000001066000-memory.dmpFilesize
472KB
-
memory/2008-83-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB
-
memory/2008-79-0x0000000003E10000-0x0000000003E11000-memory.dmpFilesize
4KB
-
memory/2008-78-0x0000000003E10000-0x0000000003E11000-memory.dmpFilesize
4KB
-
memory/2024-66-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2024-64-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2024-69-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2024-71-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2024-72-0x0000000004A10000-0x0000000004A50000-memory.dmpFilesize
256KB
-
memory/2024-65-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2024-63-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2024-62-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2024-61-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB