fdb771456b0ca1d8643c2982884f2fc16527d9adc45bb29fefd97232a64af616

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-04-2023 09:23

Target

njRAT Greenv0.7.exe
Size

27KB
MD5

4615ac6caa9572931cc9ee8bf6689e2c
SHA1

d8324b9ecbd35854092b4266625b9572cb8a4a71
SHA256

fdb771456b0ca1d8643c2982884f2fc16527d9adc45bb29fefd97232a64af616
SHA512

5602c8d56966d473f49e13d7eea69ac8b07d0143a353d98682451a51b10027dd030ff1bc4a40b90922ce93ff517b2e12f4cacd15b44df9640a7be6c326ac3936
SSDEEP

384:NL5LlYn+oYjGmhcbws96PASW+MlAQk93vmhm7UMKmIEecKdbXTzm9bVhcak67r6h:dfZsm2rlA/vMHTi9bD

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	njRAT Greenv0.7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\njRAT Greenv0.7.exe
"C:\Users\Admin\AppData\Local\Temp\njRAT Greenv0.7.exe"
1⤵
- Drops startup file
PID:1580

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1580-56-0x0000000001FB0000-0x0000000001FF0000-memory.dmp

Filesize
256KB

Download
memory/1580-57-0x0000000001FB0000-0x0000000001FF0000-memory.dmp

Filesize
256KB

Download