Analysis
-
max time kernel
30s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
08-09-2023 22:10
Static task
static1
Behavioral task
behavioral1
Sample
AVI Reader.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
AVI Reader.exe
Resource
win10-20230831-en
Behavioral task
behavioral3
Sample
AVI Reader.exe
Resource
win10v2004-20230831-en
General
-
Target
AVI Reader.exe
-
Size
49KB
-
MD5
c3ec94cb1c15fbfd213aa5d5854b8e3f
-
SHA1
65726604b29227377aadef41da87a7306c852f0c
-
SHA256
87a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4
-
SHA512
e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf
-
SSDEEP
1536:a7dS1EAd8II28ca2zhmamGJCKDRMcyEQXGNEPRbw1Rl:igEA6II2Da2zPf/XyEQSiRby
Malware Config
Extracted
njrat
Platinum
Cheats
127.0.0.1:1
smss.exe
-
reg_key
smss.exe
-
splitter
|Ghost|
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2644 cmd.exe -
Drops startup file 3 IoCs
Processes:
smss.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smss.exe smss.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smss.url smss.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smss.exe smss.exe -
Executes dropped EXE 1 IoCs
Processes:
smss.exepid process 2304 smss.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
smss.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\smss.exe\" .." smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\smss.exe\" .." smss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
taskmgr.exepid process 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
smss.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2304 smss.exe Token: 33 2304 smss.exe Token: SeIncBasePriorityPrivilege 2304 smss.exe Token: 33 2304 smss.exe Token: SeIncBasePriorityPrivilege 2304 smss.exe Token: SeDebugPrivilege 2552 taskmgr.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
taskmgr.exepid process 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
taskmgr.exepid process 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe 2552 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
AVI Reader.execmd.exesmss.exedescription pid process target process PID 3044 wrote to memory of 2304 3044 AVI Reader.exe smss.exe PID 3044 wrote to memory of 2304 3044 AVI Reader.exe smss.exe PID 3044 wrote to memory of 2304 3044 AVI Reader.exe smss.exe PID 3044 wrote to memory of 2644 3044 AVI Reader.exe cmd.exe PID 3044 wrote to memory of 2644 3044 AVI Reader.exe cmd.exe PID 3044 wrote to memory of 2644 3044 AVI Reader.exe cmd.exe PID 2644 wrote to memory of 2660 2644 cmd.exe choice.exe PID 2644 wrote to memory of 2660 2644 cmd.exe choice.exe PID 2644 wrote to memory of 2660 2644 cmd.exe choice.exe PID 2304 wrote to memory of 2792 2304 smss.exe schtasks.exe PID 2304 wrote to memory of 2792 2304 smss.exe schtasks.exe PID 2304 wrote to memory of 2792 2304 smss.exe schtasks.exe PID 2304 wrote to memory of 2788 2304 smss.exe schtasks.exe PID 2304 wrote to memory of 2788 2304 smss.exe schtasks.exe PID 2304 wrote to memory of 2788 2304 smss.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AVI Reader.exe"C:\Users\Admin\AppData\Local\Temp\AVI Reader.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\AVI Reader.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 53⤵
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\smss.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\smss.exeFilesize
49KB
MD5c3ec94cb1c15fbfd213aa5d5854b8e3f
SHA165726604b29227377aadef41da87a7306c852f0c
SHA25687a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4
SHA512e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf
-
C:\Users\Admin\AppData\Local\Temp\smss.exeFilesize
49KB
MD5c3ec94cb1c15fbfd213aa5d5854b8e3f
SHA165726604b29227377aadef41da87a7306c852f0c
SHA25687a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4
SHA512e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smss.exeFilesize
49KB
MD5c3ec94cb1c15fbfd213aa5d5854b8e3f
SHA165726604b29227377aadef41da87a7306c852f0c
SHA25687a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4
SHA512e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf
-
memory/2304-11-0x000007FEF51D0000-0x000007FEF5B6D000-memory.dmpFilesize
9.6MB
-
memory/2304-18-0x0000000000AD0000-0x0000000000B50000-memory.dmpFilesize
512KB
-
memory/2304-10-0x0000000000E60000-0x0000000000E6A000-memory.dmpFilesize
40KB
-
memory/2304-21-0x0000000000AD0000-0x0000000000B50000-memory.dmpFilesize
512KB
-
memory/2304-12-0x0000000000AD0000-0x0000000000B50000-memory.dmpFilesize
512KB
-
memory/2304-20-0x0000000000AD0000-0x0000000000B50000-memory.dmpFilesize
512KB
-
memory/2304-14-0x000007FEF51D0000-0x000007FEF5B6D000-memory.dmpFilesize
9.6MB
-
memory/2304-19-0x000007FEF51D0000-0x000007FEF5B6D000-memory.dmpFilesize
9.6MB
-
memory/2552-23-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2552-22-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/3044-2-0x0000000001FE0000-0x0000000002060000-memory.dmpFilesize
512KB
-
memory/3044-1-0x000007FEF51D0000-0x000007FEF5B6D000-memory.dmpFilesize
9.6MB
-
memory/3044-13-0x000007FEF51D0000-0x000007FEF5B6D000-memory.dmpFilesize
9.6MB
-
memory/3044-0-0x00000000002A0000-0x00000000002AA000-memory.dmpFilesize
40KB
-
memory/3044-4-0x000007FEF51D0000-0x000007FEF5B6D000-memory.dmpFilesize
9.6MB
-
memory/3044-3-0x0000000000420000-0x0000000000438000-memory.dmpFilesize
96KB