d9a826109c0b31043a6a74cbd1e15d1cb0c9138c9a8a823d6595eb6989f47dc9

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2023, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

njRAT 0.7d Horror Edition/Plugin/Clip.exe
Size

13KB
MD5

fd829592c5abc1361c2f5e81b2678019
SHA1

91b6d23bc43332bb7fee1b2d924a5c26a86747e4
SHA256

88b7a47f63f149d273015f4f6ce9ef8c5a731b6cf19db7a95220298603000b8c
SHA512

4e3e3b3cbfc2c25ac23399d15dcb6e7b40e5572fe9e5e741152f20589cd94de390fe0bea4abfb53ff427c6dec366d41a43a3a67ccdbb34c139f781be0b6b6c34
SSDEEP

384:Gr+hl2K2kTjnbkHWUWb1Lc4WrYk90/RxLKNrw:GrYSWUWbJ5//KNrw

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	Clip.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 1660	4988	Clip.exe	85
PID 4988 wrote to memory of 1660	4988	Clip.exe	85
PID 1660 wrote to memory of 4104	1660	cmd.exe	87
PID 1660 wrote to memory of 4104	1660	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\njRAT 0.7d Horror Edition\Plugin\Clip.exe
"C:\Users\Admin\AppData\Local\Temp\njRAT 0.7d Horror Edition\Plugin\Clip.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\njRAT 0.7d Horror Edition\Plugin\Clip.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4988-133-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/4988-134-0x000000001B540000-0x000000001B5E6000-memory.dmp

Filesize
664KB

Download
memory/4988-135-0x0000000000F50000-0x0000000000F60000-memory.dmp

Filesize
64KB

Download
memory/4988-136-0x000000001BC10000-0x000000001C0DE000-memory.dmp

Filesize
4.8MB

Download
memory/4988-137-0x000000001B690000-0x000000001B72C000-memory.dmp

Filesize
624KB

Download
memory/4988-138-0x0000000000A60000-0x0000000000A68000-memory.dmp

Filesize
32KB

Download
memory/4988-139-0x000000001C180000-0x000000001C1CC000-memory.dmp

Filesize
304KB

Download
memory/4988-141-0x0000000000F50000-0x0000000000F60000-memory.dmp

Filesize
64KB

Download
memory/4988-142-0x0000000000F50000-0x0000000000F60000-memory.dmp

Filesize
64KB

Download