Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-01-2025 16:30
Behavioral task
behavioral1
Sample
BootstrapperTest.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
BootstrapperTest.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
BootstrapperTest.exe
-
Size
165KB
-
MD5
919f0936ab4ba5e37418b09e38cf085b
-
SHA1
614806a90396d99091a2359f58d883ac6365f91c
-
SHA256
a216cfb7ba787b97292d64d6bd5301aa0b0df32864d57b401479d23fbbeeb245
-
SHA512
27c7a07b1f99627ff0346833287bb539dcece522f2db625ba55abdb16420ba982a8b4404957b050dcbff247c91dfeecb7167defeb417007755c1fcd10f7f71b8
-
SSDEEP
3072:Y6Vy/xsmY7PpyPg2dKb6VDs2j2liGE+gmJhbMZsSxUrTF:Y6nQVb4ZiVzmjb8xU
Score
10/10
Malware Config
Signatures
-
Njrat family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BootstrapperTest.exe BootstrapperTest.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BootstrapperTest.exe BootstrapperTest.exe -
Executes dropped EXE 2 IoCs
pid Process 1636 BootstrapperTest.exe 668 BootstrapperTest.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\BootstrapperTest.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BootstrapperTest.exe\" .." BootstrapperTest.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BootstrapperTest.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BootstrapperTest.exe\" .." BootstrapperTest.exe -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootstrapperTest.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootstrapperTest.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootstrapperTest.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2948 schtasks.exe 2184 schtasks.exe 2380 schtasks.exe 2768 schtasks.exe 2808 schtasks.exe 2508 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe 2396 BootstrapperTest.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeDebugPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: SeDebugPrivilege 1636 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: SeDebugPrivilege 668 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe Token: 33 2396 BootstrapperTest.exe Token: SeIncBasePriorityPrivilege 2396 BootstrapperTest.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2780 2396 BootstrapperTest.exe 31 PID 2396 wrote to memory of 2780 2396 BootstrapperTest.exe 31 PID 2396 wrote to memory of 2780 2396 BootstrapperTest.exe 31 PID 2396 wrote to memory of 2780 2396 BootstrapperTest.exe 31 PID 2396 wrote to memory of 2768 2396 BootstrapperTest.exe 33 PID 2396 wrote to memory of 2768 2396 BootstrapperTest.exe 33 PID 2396 wrote to memory of 2768 2396 BootstrapperTest.exe 33 PID 2396 wrote to memory of 2768 2396 BootstrapperTest.exe 33 PID 2396 wrote to memory of 2876 2396 BootstrapperTest.exe 35 PID 2396 wrote to memory of 2876 2396 BootstrapperTest.exe 35 PID 2396 wrote to memory of 2876 2396 BootstrapperTest.exe 35 PID 2396 wrote to memory of 2876 2396 BootstrapperTest.exe 35 PID 2396 wrote to memory of 2808 2396 BootstrapperTest.exe 37 PID 2396 wrote to memory of 2808 2396 BootstrapperTest.exe 37 PID 2396 wrote to memory of 2808 2396 BootstrapperTest.exe 37 PID 2396 wrote to memory of 2808 2396 BootstrapperTest.exe 37 PID 1480 wrote to memory of 1636 1480 taskeng.exe 40 PID 1480 wrote to memory of 1636 1480 taskeng.exe 40 PID 1480 wrote to memory of 1636 1480 taskeng.exe 40 PID 1480 wrote to memory of 1636 1480 taskeng.exe 40 PID 1636 wrote to memory of 2220 1636 BootstrapperTest.exe 41 PID 1636 wrote to memory of 2220 1636 BootstrapperTest.exe 41 PID 1636 wrote to memory of 2220 1636 BootstrapperTest.exe 41 PID 1636 wrote to memory of 2220 1636 BootstrapperTest.exe 41 PID 1636 wrote to memory of 2508 1636 BootstrapperTest.exe 43 PID 1636 wrote to memory of 2508 1636 BootstrapperTest.exe 43 PID 1636 wrote to memory of 2508 1636 BootstrapperTest.exe 43 PID 1636 wrote to memory of 2508 1636 BootstrapperTest.exe 43 PID 1636 wrote to memory of 1776 1636 BootstrapperTest.exe 45 PID 1636 wrote to memory of 1776 1636 BootstrapperTest.exe 45 PID 1636 wrote to memory of 1776 1636 BootstrapperTest.exe 45 PID 1636 wrote to memory of 1776 1636 BootstrapperTest.exe 45 PID 1636 wrote to memory of 2948 1636 BootstrapperTest.exe 47 PID 1636 wrote to memory of 2948 1636 BootstrapperTest.exe 47 PID 1636 wrote to memory of 2948 1636 BootstrapperTest.exe 47 PID 1636 wrote to memory of 2948 1636 BootstrapperTest.exe 47 PID 1480 wrote to memory of 668 1480 taskeng.exe 50 PID 1480 wrote to memory of 668 1480 taskeng.exe 50 PID 1480 wrote to memory of 668 1480 taskeng.exe 50 PID 1480 wrote to memory of 668 1480 taskeng.exe 50 PID 668 wrote to memory of 2056 668 BootstrapperTest.exe 51 PID 668 wrote to memory of 2056 668 BootstrapperTest.exe 51 PID 668 wrote to memory of 2056 668 BootstrapperTest.exe 51 PID 668 wrote to memory of 2056 668 BootstrapperTest.exe 51 PID 668 wrote to memory of 2184 668 BootstrapperTest.exe 53 PID 668 wrote to memory of 2184 668 BootstrapperTest.exe 53 PID 668 wrote to memory of 2184 668 BootstrapperTest.exe 53 PID 668 wrote to memory of 2184 668 BootstrapperTest.exe 53 PID 668 wrote to memory of 2064 668 BootstrapperTest.exe 55 PID 668 wrote to memory of 2064 668 BootstrapperTest.exe 55 PID 668 wrote to memory of 2064 668 BootstrapperTest.exe 55 PID 668 wrote to memory of 2064 668 BootstrapperTest.exe 55 PID 668 wrote to memory of 2380 668 BootstrapperTest.exe 57 PID 668 wrote to memory of 2380 668 BootstrapperTest.exe 57 PID 668 wrote to memory of 2380 668 BootstrapperTest.exe 57 PID 668 wrote to memory of 2380 668 BootstrapperTest.exe 57
Processes
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2768
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2808
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {7AF22438-F0F1-4784-BC22-98B418D8EC57} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exeC:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:2220
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2508
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:1776
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2948
-
-
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exeC:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:2056
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2184
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:2064
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\BootstrapperTest.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2380
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165KB
MD5919f0936ab4ba5e37418b09e38cf085b
SHA1614806a90396d99091a2359f58d883ac6365f91c
SHA256a216cfb7ba787b97292d64d6bd5301aa0b0df32864d57b401479d23fbbeeb245
SHA51227c7a07b1f99627ff0346833287bb539dcece522f2db625ba55abdb16420ba982a8b4404957b050dcbff247c91dfeecb7167defeb417007755c1fcd10f7f71b8