Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2024 11:47
Static task
static1
Behavioral task
behavioral1
Sample
7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe
Resource
win10v2004-20241007-en
General
-
Target
7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe
-
Size
930KB
-
MD5
8c991614d64dd76549a06d317f582435
-
SHA1
8070436cbcb78cc90455477778d2d6a4c49abb65
-
SHA256
7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265
-
SHA512
69616aa5a34cc10a71d3d3398c9b9f9fd59e411d95bd5a6eb7ddc63abeec51c2cd15c83605d00c75e9d13c25b86274f747230c6c684db17844cd121f1f3615c6
-
SSDEEP
24576:lyx6q7OtSIZM98utO/MMEApCahAtcg6Zld6BbfZG:Ax17tUMO/MMtlA+Zz65fZG
Malware Config
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4248 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation tournour.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ba4c12bee3027d94da5c81db2d196bfd.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ba4c12bee3027d94da5c81db2d196bfd.exe svchost.exe -
Executes dropped EXE 3 IoCs
pid Process 2356 tournour.exe 4268 svchost.exe 844 OBOXCL~1.EXE -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ba4c12bee3027d94da5c81db2d196bfd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ba4c12bee3027d94da5c81db2d196bfd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini tournour.exe File opened for modification C:\Windows\assembly\Desktop.ini tournour.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly tournour.exe File created C:\Windows\assembly\Desktop.ini tournour.exe File opened for modification C:\Windows\assembly\Desktop.ini tournour.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OBOXCL~1.EXE -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe 4268 svchost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2356 tournour.exe Token: 33 2356 tournour.exe Token: SeIncBasePriorityPrivilege 2356 tournour.exe Token: SeDebugPrivilege 4268 svchost.exe Token: 33 4268 svchost.exe Token: SeIncBasePriorityPrivilege 4268 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 844 OBOXCL~1.EXE 844 OBOXCL~1.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 844 OBOXCL~1.EXE 844 OBOXCL~1.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3200 wrote to memory of 2356 3200 7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe 83 PID 3200 wrote to memory of 2356 3200 7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe 83 PID 2356 wrote to memory of 4268 2356 tournour.exe 84 PID 2356 wrote to memory of 4268 2356 tournour.exe 84 PID 4268 wrote to memory of 4248 4268 svchost.exe 86 PID 4268 wrote to memory of 4248 4268 svchost.exe 86 PID 3200 wrote to memory of 844 3200 7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe 85 PID 3200 wrote to memory of 844 3200 7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe 85 PID 3200 wrote to memory of 844 3200 7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe"C:\Users\Admin\AppData\Local\Temp\7d94e771fc58a9d7f9a9b851c49bd7c013db08d083837a586af6089ab4246265.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tournour.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tournour.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4248
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OBOXCL~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OBOXCL~1.EXE2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:844
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD519c5f2529928354f11d85cbadb7b1241
SHA1369de9fd7a522d5f95b98c1a1d17d98c36d806e3
SHA256ea513d83410e658ff98696f6127cc695260ed87d2dc9243c5a4257fdc236ab1b
SHA512a2eb4caa3741798b371bdaeb17cfdc07fc0272016ec2a8d8de2a31a8c1d8b10763c66630c81fd107f39b2974fca9adfedb253669bf39781ee0928b9d7cb54548
-
Filesize
192KB
MD59fe2c5c40cfa595dc7654c60ef18f8ae
SHA1866a066b6655e7d20c4a769ca1454f20dac95c4a
SHA25639748fe2be41922a654fbbaf81d4f012410f8eff5366ae7c4ff0af69e8caea3d
SHA51243c23e7663ca1316469dc70ab8622dc1bf78e4f021847dc965bfe7acccb96ea269dd4bcee7bfa28249bf3a434114f6b8d0a5f94bb459b90a7abe81028d61a56a