Malware Analysis Report

2025-01-22 13:16

Sample ID 240716-1zk17avgkb
Target 1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d
SHA256 1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d
Tags
njrat evasion persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d

Threat Level: Known bad

The file 1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d was found to be: Known bad.

Malicious Activity Summary

njrat evasion persistence privilege_escalation trojan

njRAT/Bladabindi

Modifies Windows Firewall

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-16 22:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-16 22:05

Reported

2024-07-16 22:07

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Windows\WindowsHealthChecker.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7799a186f618ba54cc458f7422abc774 = "\"C:\\Windows\\WindowsHealthChecker.exe\" .." C:\Windows\WindowsHealthChecker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7799a186f618ba54cc458f7422abc774 = "\"C:\\Windows\\WindowsHealthChecker.exe\" .." C:\Windows\WindowsHealthChecker.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WindowsHealthChecker.exe C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4808 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe
PID 4808 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe
PID 4808 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe
PID 4808 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Windows\system32\cmd.exe
PID 4808 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Windows\system32\cmd.exe
PID 3280 wrote to memory of 2116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 2116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Windows\system32\cmd.exe
PID 4808 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Windows\system32\cmd.exe
PID 4464 wrote to memory of 220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 4464 wrote to memory of 220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1492 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe C:\Windows\WindowsHealthChecker.exe
PID 1492 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe C:\Windows\WindowsHealthChecker.exe
PID 1492 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe C:\Windows\WindowsHealthChecker.exe
PID 628 wrote to memory of 2716 N/A C:\Windows\WindowsHealthChecker.exe C:\Windows\SysWOW64\netsh.exe
PID 628 wrote to memory of 2716 N/A C:\Windows\WindowsHealthChecker.exe C:\Windows\SysWOW64\netsh.exe
PID 628 wrote to memory of 2716 N/A C:\Windows\WindowsHealthChecker.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe

"C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe"

C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fakecmd.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF00D.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\WindowsHealthChecker.exe

"C:\Windows\WindowsHealthChecker.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Windows\WindowsHealthChecker.exe" "WindowsHealthChecker.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
FR 88.168.211.65:6522 tcp
US 8.8.8.8:53 65.211.168.88.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/4808-0-0x00007FF94C2A3000-0x00007FF94C2A5000-memory.dmp

memory/4808-1-0x0000000000200000-0x0000000000216000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe

MD5 b075f9e4015e2f43154b9903d9ec5fb5
SHA1 0717b04115360a6d1d4451c90d0f6b0f781d249f
SHA256 103cb14f2460de6ef7c780becc87bac0599bdd0527e176c0ec87aad2397b57e6
SHA512 4f71a17234a0078733bd61fa80bd3463341dda0c1ac31ac9c496efd528ecd8657cf206160d6b9205e4fab6aa3b10fdd8f1764bc574223c63a38213735fd3939b

memory/4808-7-0x00007FF94C2A0000-0x00007FF94CD61000-memory.dmp

memory/1492-14-0x00000000753F2000-0x00000000753F3000-memory.dmp

memory/1492-15-0x00000000753F0000-0x00000000759A1000-memory.dmp

memory/1492-16-0x00000000753F0000-0x00000000759A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fakecmd.bat

MD5 f96d7ee1c050f915b080bd319564c817
SHA1 6f095907e07e178f9063a01020caf2921d982c7a
SHA256 5d92d1af825219719e4009d70a50a63a8ed5e51e2faf79e2e83bc212e55cad21
SHA512 69e2dbafd04bbae273c957bb6a2afbfc9910a45c3223a00e88975a42c24ee544458f51a43eb39cd12af15cc852779d3c8ede83331b0a159086bc849e69c031bd

memory/2116-18-0x0000017F27E70000-0x0000017F27E92000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_axszqeg3.mbj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2116-28-0x0000017F40580000-0x0000017F405C4000-memory.dmp

memory/2116-29-0x0000017F40A10000-0x0000017F40A86000-memory.dmp

memory/4808-33-0x00007FF94C2A0000-0x00007FF94CD61000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF00D.tmp.bat

MD5 2c2b5a813cb89593be6cd05b7d12c7bd
SHA1 47c3a17342d6f3c690ffe3d868cfa0ef20519fab
SHA256 431591292af030231ef551082ded7a944c365ac529e211f3b285caa0adffeb87
SHA512 4583df917179be69a76dccc3286d97468953d29c4c798c63ab2deb6c4c254ce378a8c389f2c3611747c52821dd4ad1dd03457dca825c4df46d2ca8292ea215b1

memory/1492-44-0x00000000753F0000-0x00000000759A1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-16 22:05

Reported

2024-07-16 22:07

Platform

win11-20240709-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Windows\WindowsHealthChecker.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Microsoft\Windows\CurrentVersion\Run\7799a186f618ba54cc458f7422abc774 = "\"C:\\Windows\\WindowsHealthChecker.exe\" .." C:\Windows\WindowsHealthChecker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7799a186f618ba54cc458f7422abc774 = "\"C:\\Windows\\WindowsHealthChecker.exe\" .." C:\Windows\WindowsHealthChecker.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WindowsHealthChecker.exe C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: 33 N/A C:\Windows\WindowsHealthChecker.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\WindowsHealthChecker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5008 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe
PID 5008 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe
PID 5008 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe
PID 5008 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Windows\system32\cmd.exe
PID 5008 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 2792 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2136 wrote to memory of 2792 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5008 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Windows\system32\cmd.exe
PID 5008 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe C:\Windows\system32\cmd.exe
PID 3712 wrote to memory of 1908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3712 wrote to memory of 1908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2332 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe C:\Windows\WindowsHealthChecker.exe
PID 2332 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe C:\Windows\WindowsHealthChecker.exe
PID 2332 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe C:\Windows\WindowsHealthChecker.exe
PID 900 wrote to memory of 2412 N/A C:\Windows\WindowsHealthChecker.exe C:\Windows\SysWOW64\netsh.exe
PID 900 wrote to memory of 2412 N/A C:\Windows\WindowsHealthChecker.exe C:\Windows\SysWOW64\netsh.exe
PID 900 wrote to memory of 2412 N/A C:\Windows\WindowsHealthChecker.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe

"C:\Users\Admin\AppData\Local\Temp\1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d.exe"

C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fakecmd.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB6DC.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\WindowsHealthChecker.exe

"C:\Windows\WindowsHealthChecker.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Windows\WindowsHealthChecker.exe" "WindowsHealthChecker.exe" ENABLE

Network

Country Destination Domain Proto
FR 88.168.211.65:6522 tcp
US 8.8.8.8:53 65.211.168.88.in-addr.arpa udp

Files

memory/5008-0-0x00007FFC37E33000-0x00007FFC37E35000-memory.dmp

memory/5008-1-0x0000000000A60000-0x0000000000A76000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WindowsModificator.exe

MD5 b075f9e4015e2f43154b9903d9ec5fb5
SHA1 0717b04115360a6d1d4451c90d0f6b0f781d249f
SHA256 103cb14f2460de6ef7c780becc87bac0599bdd0527e176c0ec87aad2397b57e6
SHA512 4f71a17234a0078733bd61fa80bd3463341dda0c1ac31ac9c496efd528ecd8657cf206160d6b9205e4fab6aa3b10fdd8f1764bc574223c63a38213735fd3939b

memory/5008-7-0x00007FFC37E30000-0x00007FFC388F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fakecmd.bat

MD5 f96d7ee1c050f915b080bd319564c817
SHA1 6f095907e07e178f9063a01020caf2921d982c7a
SHA256 5d92d1af825219719e4009d70a50a63a8ed5e51e2faf79e2e83bc212e55cad21
SHA512 69e2dbafd04bbae273c957bb6a2afbfc9910a45c3223a00e88975a42c24ee544458f51a43eb39cd12af15cc852779d3c8ede83331b0a159086bc849e69c031bd

memory/2792-16-0x0000016260490000-0x00000162604B2000-memory.dmp

memory/2332-15-0x00000000014C0000-0x00000000014D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vhwtcqvz.pri.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2792-25-0x0000016278D80000-0x0000016278DC6000-memory.dmp

memory/5008-29-0x00007FFC37E30000-0x00007FFC388F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB6DC.tmp.bat

MD5 05ea5eac0ff457c599e9a566b20def77
SHA1 c6a8c1184cd3857198dce3da73f8370c48013092
SHA256 53ba45f6c2ed98549d49e87341bb2bdf0f71d4750f9a8bb8034a9175535a685a
SHA512 37b3a4bfec9d086549924ae88f492ef862b17aad4283b45a722b7df9863f90b68e71f9421d2038b199bf19c8a99e3d503c3ff0bc67d3a7fe3947cf80611b7586