Analysis
- max time kernel
252s - max time network
254s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
24/07/2024, 15:59
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10-20240404-en
windows10-1703-x64
13 signatures
600 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
600 seconds
Behavioral task
behavioral3
Sample
Server.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral4
Sample
Server.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
5 signatures
600 seconds
Behavioral task
behavioral5
Sample
Server.exe
Resource
win11-20240709-en
windows11-21h2-x64
5 signatures
600 seconds
Errors
Reason
Machine shutdown
General
- Target Server.exe
- Size 43KB
- Sample240724-tfayjsxdnc
- SHA256 a7186967c2a0b62ec5c9bb0a864e9edfddebe3fcf0340a98f7c3b3589f48c097
- MD5 7fb42723aa23f2d2ca4721214cb0ac2c
- SHA1 d242fbb831895c04dcd073fa4871ef3f7c74332d
- SHA512 9a0c6e7e148661debf88a031dd9dcf3f5ce447b7d416bf806c037951a52c4bc07ef19f0efdc98ab94718d54b9d6c5567a250f17c05bc04a1768d43f70b1648cb
- SSDEEP 384:dZyg+2FAJ2HytkDzkl/EUzsg8qpKz4Iij+ZsNO3PlpJKkkjh/TzF7pWnXm/greTP:X/D2oStoz85g7qquXQ/oom/+L
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
HacKed
C2
-
insurance-helmet.gl.at.ply.gg:31388
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .." Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .." Server.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4468 Server.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeDebugPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: 33 4468 Server.exe Token: SeIncBasePriorityPrivilege 4468 Server.exe Token: SeShutdownPrivilege 4048 shutdown.exe Token: SeRemoteShutdownPrivilege 4048 shutdown.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4468 Server.exe 4468 Server.exe 4468 Server.exe 4468 Server.exe 4468 Server.exe 4468 Server.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4908 LogonUI.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4468 wrote to memory of 4048 4468 Server.exe 72 PID 4468 wrote to memory of 4048 4468 Server.exe 72 PID 4468 wrote to memory of 4048 4468 Server.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\shutdown.exeshutdown -s -t 002⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ae9855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4908