njrat | 6dae0159d5da508bf4fadc7a19fba5d13d3494d75db63713ac54fc0c31b09d6e

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
Size

165KB
MD5

3799833548a3e8bdd526ae0ed3398913
SHA1

2ef660ea22a7e134196b464c9bddffd6b0d2b045
SHA256

6dae0159d5da508bf4fadc7a19fba5d13d3494d75db63713ac54fc0c31b09d6e
SHA512

3297bea07f15ebae219e913a94c425bac4bf6c6539f03c3597f9a8b6f16c5d629c5bf879e35356e131aa0311179d4a58fe5d8a150f03d90e9f22c9257b8209d2
SSDEEP

3072:FUCyJ/p6r/INNEfINdo4OpqkjdrfRL9OcEG7O8HVbdnj36vY058siwx5J:KCHfIM4Opb7klkbC5Dis

Score

10^/10

njrat discovery persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Client1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client1.exe	Client1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client1.exe	Client1.exe

Executes dropped EXE 3 IoCs

pid	Process
3068	Client1.exe
2264	Client1.exe
2700	Client1.exe

Loads dropped DLL 1 IoCs

pid	Process
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client1.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client1.exe\" .."	Client1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client1.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client1.exe\" .."	Client1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
2688	TASKKILL.exe
3064	TASKKILL.exe
2864	TASKKILL.exe
2520	TASKKILL.exe
1644	TASKKILL.exe
1376	TASKKILL.exe
1524	TASKKILL.exe
2840	TASKKILL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3064	schtasks.exe
2224	schtasks.exe
2412	schtasks.exe
2928	schtasks.exe
2492	schtasks.exe
1332	schtasks.exe
2580	schtasks.exe
2884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
Token: SeDebugPrivilege	3064	TASKKILL.exe
Token: SeDebugPrivilege	2864	TASKKILL.exe
Token: SeDebugPrivilege	3068	Client1.exe
Token: SeDebugPrivilege	2520	TASKKILL.exe
Token: SeDebugPrivilege	1644	TASKKILL.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: SeDebugPrivilege	2264	Client1.exe
Token: SeDebugPrivilege	1376	TASKKILL.exe
Token: SeDebugPrivilege	1524	TASKKILL.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: SeDebugPrivilege	2700	Client1.exe
Token: SeDebugPrivilege	2840	TASKKILL.exe
Token: SeDebugPrivilege	2688	TASKKILL.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe
Token: 33	3068	Client1.exe
Token: SeIncBasePriorityPrivilege	3068	Client1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2808	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	30
PID 2996 wrote to memory of 2808	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	30
PID 2996 wrote to memory of 2808	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	30
PID 2996 wrote to memory of 2808	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	30
PID 2996 wrote to memory of 2224	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2224	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2224	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2224	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	32
PID 2996 wrote to memory of 3064	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	34
PID 2996 wrote to memory of 3064	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	34
PID 2996 wrote to memory of 3064	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	34
PID 2996 wrote to memory of 3064	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	34
PID 2996 wrote to memory of 2864	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	35
PID 2996 wrote to memory of 2864	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	35
PID 2996 wrote to memory of 2864	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	35
PID 2996 wrote to memory of 2864	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	35
PID 2996 wrote to memory of 2560	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	39
PID 2996 wrote to memory of 2560	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	39
PID 2996 wrote to memory of 2560	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	39
PID 2996 wrote to memory of 2560	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	39
PID 2996 wrote to memory of 2412	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	41
PID 2996 wrote to memory of 2412	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	41
PID 2996 wrote to memory of 2412	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	41
PID 2996 wrote to memory of 2412	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	41
PID 2996 wrote to memory of 3068	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	43
PID 2996 wrote to memory of 3068	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	43
PID 2996 wrote to memory of 3068	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	43
PID 2996 wrote to memory of 3068	2996	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	43
PID 3068 wrote to memory of 2920	3068	Client1.exe	44
PID 3068 wrote to memory of 2920	3068	Client1.exe	44
PID 3068 wrote to memory of 2920	3068	Client1.exe	44
PID 3068 wrote to memory of 2920	3068	Client1.exe	44
PID 3068 wrote to memory of 2928	3068	Client1.exe	46
PID 3068 wrote to memory of 2928	3068	Client1.exe	46
PID 3068 wrote to memory of 2928	3068	Client1.exe	46
PID 3068 wrote to memory of 2928	3068	Client1.exe	46
PID 3068 wrote to memory of 2520	3068	Client1.exe	48
PID 3068 wrote to memory of 2520	3068	Client1.exe	48
PID 3068 wrote to memory of 2520	3068	Client1.exe	48
PID 3068 wrote to memory of 2520	3068	Client1.exe	48
PID 3068 wrote to memory of 1644	3068	Client1.exe	49
PID 3068 wrote to memory of 1644	3068	Client1.exe	49
PID 3068 wrote to memory of 1644	3068	Client1.exe	49
PID 3068 wrote to memory of 1644	3068	Client1.exe	49
PID 3068 wrote to memory of 1248	3068	Client1.exe	52
PID 3068 wrote to memory of 1248	3068	Client1.exe	52
PID 3068 wrote to memory of 1248	3068	Client1.exe	52
PID 3068 wrote to memory of 1248	3068	Client1.exe	52
PID 3068 wrote to memory of 2492	3068	Client1.exe	54
PID 3068 wrote to memory of 2492	3068	Client1.exe	54
PID 3068 wrote to memory of 2492	3068	Client1.exe	54
PID 3068 wrote to memory of 2492	3068	Client1.exe	54
PID 2312 wrote to memory of 2264	2312	taskeng.exe	58
PID 2312 wrote to memory of 2264	2312	taskeng.exe	58
PID 2312 wrote to memory of 2264	2312	taskeng.exe	58
PID 2312 wrote to memory of 2264	2312	taskeng.exe	58
PID 2264 wrote to memory of 2652	2264	Client1.exe	59
PID 2264 wrote to memory of 2652	2264	Client1.exe	59
PID 2264 wrote to memory of 2652	2264	Client1.exe	59
PID 2264 wrote to memory of 2652	2264	Client1.exe	59
PID 2264 wrote to memory of 1332	2264	Client1.exe	61
PID 2264 wrote to memory of 1332	2264	Client1.exe	61
PID 2264 wrote to memory of 1332	2264	Client1.exe	61
PID 2264 wrote to memory of 1332	2264	Client1.exe	61

C:\Users\Admin\AppData\Local\Temp\3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2808
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2224
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2560
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2412
- C:\Users\Admin\AppData\Roaming\Client1.exe
  "C:\Users\Admin\AppData\Roaming\Client1.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYANP /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2928
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2492

C:\Windows\system32\taskeng.exe
taskeng.exe {E859F333-5CA3-4E29-AC7C-BDC162A33652} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Roaming\Client1.exe
  C:\Users\Admin\AppData\Roaming\Client1.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYANP /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1332
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2580
- C:\Users\Admin\AppData\Roaming\Client1.exe
  C:\Users\Admin\AppData\Roaming\Client1.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYANP /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2884
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Client1.exe

Filesize
165KB

MD5
3799833548a3e8bdd526ae0ed3398913

SHA1
2ef660ea22a7e134196b464c9bddffd6b0d2b045

SHA256
6dae0159d5da508bf4fadc7a19fba5d13d3494d75db63713ac54fc0c31b09d6e

SHA512
3297bea07f15ebae219e913a94c425bac4bf6c6539f03c3597f9a8b6f16c5d629c5bf879e35356e131aa0311179d4a58fe5d8a150f03d90e9f22c9257b8209d2

Download Submit
memory/2996-0-0x00000000743C1000-0x00000000743C2000-memory.dmp

Filesize
4KB

Download
memory/2996-1-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/2996-2-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/2996-3-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/2996-13-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/2996-14-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/2996-22-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download