Analysis
-
max time kernel
61s -
max time network
60s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-06-2024 20:35
Static task
static1
General
-
Target
kay.ps1
-
Size
355KB
-
MD5
953f6ad46d857b89ecdd141940b89464
-
SHA1
0e1a9fc3c25340edb5c51cd55e74dd5b23ab58f6
-
SHA256
377a1d0fa30911193d9518f8db4910397998d710047884aaae474023a0d1bf4b
-
SHA512
a409ab3781cd56969025b36dd3d3ad721618b9ffc7bb60a35fc94857a38461988e8c140e3ce0983ea803c16f1ed68c99021f58914d0a1ac066953a7c6eb2be0f
-
SSDEEP
3072:yVg8cH9dJIRNjZZ4Ir8zKaCaDv1iRRqNhEuoTWk7:EzcpIbjr9C0HqsNF
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
142.202.240.47:4444
e6049327f0d5465989
-
reg_key
e6049327f0d5465989
-
splitter
@!#&^%$
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1768 set thread context of 208 1768 powershell.exe aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1768 powershell.exe 1768 powershell.exe 1768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
powershell.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 1768 powershell.exe Token: SeDebugPrivilege 208 aspnet_compiler.exe Token: 33 208 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 208 aspnet_compiler.exe Token: 33 208 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 208 aspnet_compiler.exe Token: 33 208 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 208 aspnet_compiler.exe Token: 33 208 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 208 aspnet_compiler.exe Token: 33 208 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 208 aspnet_compiler.exe Token: 33 208 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 208 aspnet_compiler.exe Token: 33 208 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 208 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
powershell.exedescription pid process target process PID 1768 wrote to memory of 208 1768 powershell.exe aspnet_compiler.exe PID 1768 wrote to memory of 208 1768 powershell.exe aspnet_compiler.exe PID 1768 wrote to memory of 208 1768 powershell.exe aspnet_compiler.exe PID 1768 wrote to memory of 208 1768 powershell.exe aspnet_compiler.exe PID 1768 wrote to memory of 208 1768 powershell.exe aspnet_compiler.exe PID 1768 wrote to memory of 208 1768 powershell.exe aspnet_compiler.exe PID 1768 wrote to memory of 208 1768 powershell.exe aspnet_compiler.exe PID 1768 wrote to memory of 208 1768 powershell.exe aspnet_compiler.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\kay.ps11⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe#cmd2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1bsp0qh1.h5y.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
memory/208-30-0x00000000055C0000-0x0000000005652000-memory.dmpFilesize
584KB
-
memory/208-22-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/208-33-0x0000000073980000-0x000000007406E000-memory.dmpFilesize
6.9MB
-
memory/208-32-0x0000000005540000-0x000000000554A000-memory.dmpFilesize
40KB
-
memory/208-27-0x000000007398E000-0x000000007398F000-memory.dmpFilesize
4KB
-
memory/208-31-0x0000000073980000-0x000000007406E000-memory.dmpFilesize
6.9MB
-
memory/208-29-0x0000000005960000-0x0000000005E5E000-memory.dmpFilesize
5.0MB
-
memory/208-28-0x00000000053C0000-0x000000000545C000-memory.dmpFilesize
624KB
-
memory/1768-5-0x00000273EC6A0000-0x00000273EC6C2000-memory.dmpFilesize
136KB
-
memory/1768-26-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmpFilesize
9.9MB
-
memory/1768-8-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmpFilesize
9.9MB
-
memory/1768-4-0x00007FFF50293000-0x00007FFF50294000-memory.dmpFilesize
4KB
-
memory/1768-21-0x00000273EC7F0000-0x00000273EC80A000-memory.dmpFilesize
104KB
-
memory/1768-10-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmpFilesize
9.9MB
-
memory/1768-9-0x00000273EC850000-0x00000273EC8C6000-memory.dmpFilesize
472KB