Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 16:52
Static task
static1
Behavioral task
behavioral1
Sample
62457e5d7d72b9d2a3dc94404023b8e8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
62457e5d7d72b9d2a3dc94404023b8e8.exe
Resource
win10v2004-20231215-en
General
-
Target
62457e5d7d72b9d2a3dc94404023b8e8.exe
-
Size
33KB
-
MD5
62457e5d7d72b9d2a3dc94404023b8e8
-
SHA1
a0fd127f66696531e9e1fc59d4d8c88c86d14e02
-
SHA256
2b8acd41c61581c4a77c399cf5fe9ba7104cadd2f8cdc6a331536b618b21cbf3
-
SHA512
7a58ae906ec1b7375e14aa0af8c0e1d976b2ee1303e0e7e0f2728152ade4be6b6dbdb2db32137c142d0892b3616689ab31c96a721fb89ff49d6178ba854ecb7b
-
SSDEEP
768:VvTJHptt6VwxbpCrFJyrZXtFS3ypqCFLrv:t1pKabqFJyhfS3cqCFH
Malware Config
Extracted
njrat
0.7d
HacKed
girafa2002otaku.ddns.net:1177
Windows Update
-
reg_key
Windows Update
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.exe explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.exe explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 2768 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe\" .." explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe\" .." explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
explorer.exedescription pid process Token: SeDebugPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe Token: 33 2768 explorer.exe Token: SeIncBasePriorityPrivilege 2768 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
62457e5d7d72b9d2a3dc94404023b8e8.exeexplorer.exedescription pid process target process PID 2368 wrote to memory of 2768 2368 62457e5d7d72b9d2a3dc94404023b8e8.exe explorer.exe PID 2368 wrote to memory of 2768 2368 62457e5d7d72b9d2a3dc94404023b8e8.exe explorer.exe PID 2368 wrote to memory of 2768 2368 62457e5d7d72b9d2a3dc94404023b8e8.exe explorer.exe PID 2768 wrote to memory of 2692 2768 explorer.exe netsh.exe PID 2768 wrote to memory of 2692 2768 explorer.exe netsh.exe PID 2768 wrote to memory of 2692 2768 explorer.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62457e5d7d72b9d2a3dc94404023b8e8.exe"C:\Users\Admin\AppData\Local\Temp\62457e5d7d72b9d2a3dc94404023b8e8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\explorer.exe" "explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\explorer.exeFilesize
33KB
MD562457e5d7d72b9d2a3dc94404023b8e8
SHA1a0fd127f66696531e9e1fc59d4d8c88c86d14e02
SHA2562b8acd41c61581c4a77c399cf5fe9ba7104cadd2f8cdc6a331536b618b21cbf3
SHA5127a58ae906ec1b7375e14aa0af8c0e1d976b2ee1303e0e7e0f2728152ade4be6b6dbdb2db32137c142d0892b3616689ab31c96a721fb89ff49d6178ba854ecb7b
-
memory/2368-0-0x0000000000920000-0x0000000000936000-memory.dmpFilesize
88KB
-
memory/2368-1-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2368-2-0x0000000000390000-0x0000000000410000-memory.dmpFilesize
512KB
-
memory/2368-3-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2368-11-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2768-12-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2768-13-0x0000000000980000-0x0000000000A00000-memory.dmpFilesize
512KB
-
memory/2768-14-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2768-16-0x0000000000980000-0x0000000000A00000-memory.dmpFilesize
512KB
-
memory/2768-17-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2768-18-0x0000000000980000-0x0000000000A00000-memory.dmpFilesize
512KB
-
memory/2768-19-0x0000000000980000-0x0000000000A00000-memory.dmpFilesize
512KB