hxxps://github[.]com/JumperYT-official/njRAT-Platinum-Edition-RuS

max time kernel
303s
max time network
308s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
13/08/2023, 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/JumperYT-official/njRAT-Platinum-Edition-RuS

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	100.20.121.79

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133364040148809388"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 88003100000000000d571c6510004e4a5241542d7e310000700009000400efbe0d571c650d571c652e000000950600000000040000000000000000000000000000008eaa6f006e006a005200410054002d0050006c006100740069006e0075006d002d00450064006900740069006f006e002d005200750053002d006d00610069006e00000018000000	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000009511475f95add901e18ff066e3cdd901e18ff066e3cdd90114000000	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NjRat Platinum Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "5"	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 = 8c003100000000000d57226510004e4a5241542d7e312e37442d0000700009000400efbe0d571c650d5722652e0000009906000000000800000000000000000000000000000088be1f016e006a005200410054002d0030002e00370064002d0050006c006100740069006e0075006d002d00450064006900740069006f006e002d0052007500530000001c000000	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = 00000000ffffffff	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	NjRat Platinum Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	NjRat Platinum Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NjRat Platinum Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	NjRat Platinum Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 7800310000000000e35637501100557365727300640009000400efbe724a0b5de35637502e000000320500000000010000000000000000003a00000000004054f30055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\NodeSlot = "4"	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat Platinum Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 7e003100000000000d571c6511004465736b746f7000680009000400efbee35637500d571c652e000000a75201000000010000000000000000003e00000000001f2c73004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	NjRat Platinum Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	NjRat Platinum Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	NjRat Platinum Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NjRat Platinum Edition.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	chrome.exe
2128	chrome.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3880	NjRat Platinum Edition.exe
1312	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe
Token: SeShutdownPrivilege	2128	chrome.exe
Token: SeCreatePagefilePrivilege	2128	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
2128	chrome.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
3880	NjRat Platinum Edition.exe
1312	taskmgr.exe
3880	NjRat Platinum Edition.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3880	NjRat Platinum Edition.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 4596	2128	chrome.exe	69
PID 2128 wrote to memory of 4596	2128	chrome.exe	69
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3520	2128	chrome.exe	72
PID 2128 wrote to memory of 3076	2128	chrome.exe	71
PID 2128 wrote to memory of 3076	2128	chrome.exe	71
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75
PID 2128 wrote to memory of 504	2128	chrome.exe	75

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/JumperYT-official/njRAT-Platinum-Edition-RuS
1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcbcc79758,0x7ffcbcc79768,0x7ffcbcc79778
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:2
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5168 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5420 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5664 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5500 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=6092 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5136 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2872 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5612 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=816 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4804 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5720 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:8
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4668 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6624 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=1612 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3440 --field-trial-handle=1776,i,14074291918176494180,131558946939396342,131072 /prefetch:2
  2⤵
  PID:2644

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410
1⤵
PID:4220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4508

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:1312

C:\Users\Admin\Desktop\njRAT-Platinum-Edition-RuS-main\njRAT-0.7d-Platinum-Edition-RuS\NjRat Platinum Edition.exe
"C:\Users\Admin\Desktop\njRAT-Platinum-Edition-RuS-main\njRAT-0.7d-Platinum-Edition-RuS\NjRat Platinum Edition.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3880
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Desktop\New Client.exe"
  2⤵
  PID:3400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
febe98b862ba62a55aaf1fa0ad2da883

SHA1
446daeefd0cb4ab0343d9e00071a75885ad39b59

SHA256
d81cf08e0cf2cfbea8aa41107f725a89b83348f176c6217bc196d66815adcfd4

SHA512
e22939b7121edb34086974dd1152ee5d73958b5d4e2996c7eaa3f61a644ce8d0f0c676c6a21f7c150ce1d848991a99f3279fc3f27caed70666bb3e926df8753d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
dd3e016bebecc000c6e5182b4d93adec

SHA1
f94d087c2ca6744dadbd00fcf1ae2cbb86c08de0

SHA256
b5be5f57ce4f4820d2118f9c1a191fd18788a40155a09a6b1a9bd5181c1b3bb0

SHA512
2c8a39319b8a116b3219e4dd43b957261f24f7d064fb5aed05942c67b42e6ab05d6436fd87a4d72495152fe6714f2cc0fe7516911d30c8b2e83620fe6986c4a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
5eb923992a19154a9cd4d99c281c7ff1

SHA1
81d296cb4248087ce9d959261f9bb8e72ac73d1f

SHA256
9922c53065c302ee6e17a4dcba249cd2e2a9139c9d5f7af42933841e7c2da60f

SHA512
1af80d5ec7870688bf97b424ffd95bb9398293784beaddad9fcbfcfcc739f7990059d480b7b5fcc5b003ad8d22dfbcf8b3b6b56fa7e523a5095fdc9fffe9b9b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
af19dbf7f975d89cd15eb2b2832595c0

SHA1
9a90ec36feaa048ef7b1bd9e4dc6df2908fcf5a1

SHA256
4aeb9d06e5234a98f018de9079133772d22fd10b7ffd9a33afe520c55f8e3ede

SHA512
4fab885ee82cff7bc49db0f0eb67608ef07c52afb82d5849b4e676377d572ead1f1ddf9198547d22eec1c4ce6da0fa56352afda71eb25ae5d3d259795cc96110

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b4fbef3f05598f1216912a7e358ba8c8

SHA1
52247c8c31aea22f78aefe1b249afca95cccda87

SHA256
11b41a2920faccf89c2e0c649aa5e59ca9886004733b17fcda708c62429b93b8

SHA512
4e04fae890c75952a6f6e315b9dd4b7451d6c1d05a7bcb8478410c9f3135a7d93e8be77476d28382755a337072aa47d29a6dedea3c01d85d20edb4b3c6cc65ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
555d7e4fc2ed48e0aaf961d61d56716f

SHA1
f010484e589d74c537d417d0e4c5c5b0423c96ec

SHA256
2187c6dd7bbd02eac2dc4207c159dd91c4d66c52dffcaa3decfa401f6b6931b2

SHA512
79d86f1307edcbac8e4d4c5159e991a0cc358661b091e581339027cd0f0c3ffbb712fb84da8257759bd4b040dc3a2738d96665465b63738f898273ea2c101dff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
508a3c40aa29bf08ae6f6b193e482c9a

SHA1
dc0323fe25a0a21e3931e2d03560d173135411d1

SHA256
5304082c66ce0b364d05df4c54ffdfa12aec4ac5bddcee23a212f74798d9bdf1

SHA512
aa2aceb5a9688cd96d4a6ff47de28afe0734bf3a6ad54107f572f97eecf0e6f937807c89acea882b7873d28fb68468aeca912dd6f15ff3d264b62f7613d6d376

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ebd07816e7f801128db2ff1c2f9a76fe

SHA1
fb093615268ce3eb24b56b5aef881513a39c4632

SHA256
8637da20ffffd691231f4bea8bb1fc9f9ada7106a2f8ee57a1f7d25390970d5c

SHA512
252679fe11a8dff0dc64030ff04cc15a7dfa7a70abd73bd7647127435132e6d84d0ff2aac32dc0c740e8db0c8072a99c280d61002228c479c03106028f63fd09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9ecdf946fc684e54216a7aa3e766b887

SHA1
bce6d6454205509570d759802fa2add66ead27fc

SHA256
7851aa43e78d42ced99608a7d645a90a4458313bbd489439d5efe08a5c30840c

SHA512
0f793b75491c79d61028bfb8ae76ec68cc9ca2cc2668387822f9ede138b8b7f1b5c9b16751bc5c82100de89322dc2844943159d0aa53a4e8b89372c03caec8c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9a6a224e477adede97c531dc251c318b

SHA1
646d84bfcad567a33e3031d6ec5bc6b9a6ccf0a6

SHA256
f73057ecc78191dda2181b78811e1338b23db2b740b531ba0074f128a7f7a9c9

SHA512
15449b008a71bc51510816fa2009e20334c37879ab63360cc3809fba5daa6f5c46ed8322a0b0aa9da19e5203ff6ca45f28ccbac5dbef9c4ebd3c3d84772bf892

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ba8f7463657ccdd16e7f4819ea49fba5

SHA1
e13f40e9930585ecca7a6fe1b51869edc40ab563

SHA256
d1ba2279fbb560b28788f51ee005656d0ecaaf25685c2cad9250f80ae97ab6e0

SHA512
d69f60c65b20d0688864fe729bd7eb8697a7e3479c3738353336bd8421d89a22bd1015c5bbb2c7bffb479b48291a5413f05b40721d0a174d2ea4d7a9efef5e8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
993fcf8f385dd2c8d8cfbcc3ca6ab496

SHA1
7cd26c72c55bf96d2701cf91f1060b7eccb889e7

SHA256
e7a5d59b00cd5d0d152ea41321a210e7a7f317032e46fa46819d3592ac2d11cd

SHA512
8239602dfc47376073a6c5b16a5364669df322989dee0d83ad0496c3aa16855fc05ff4556b83693686d57d22362c44d466c2e31b2d2be9f946a637ccf5618e44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
a079ce10d2be0edb54f17dbe87a0acaa

SHA1
77ebdf7ff978c5550e53bfbaf00b751e04e2180b

SHA256
b480e01167ee2bc4ab9e5f7789a976b7d670f4ede8a6c576207b6fd5c77bd6cb

SHA512
5b55f564b7b84dde5d23a8d3b84d7984fb14805bef2f0ae5fb583dfc011c00b0d7678797d6a8d78336ecdd0fcd70a17141fc9929e9eccda1158557afed9a0a60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
4ab174cdb632f8ae97705a04cd8edd84

SHA1
bc7dfed5382cf8b6210ead9f8b13796261769442

SHA256
01110a19c0104413a34590b6f7e1cbd42feb1e68cceef60539fbfd11a57dc10a

SHA512
632394bb03fca75619f7cf4689fc39d32731ecb3338faf783d4550ef96822a7872e0eb3b5cc443dd1e206fe93c1e347fafbcf922979ed2117209e5720ca0aed0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
109KB

MD5
6a80ba49d944ed313fa11af6454da1f0

SHA1
9b96213554019b3eb374499a96d3554a0505e154

SHA256
93c6adaba647e4a8ec4174c284b2435d32e474eec656b29fd47efb896fed2a40

SHA512
e5826d31b2273c17c9a150c09599b91bde90d18362f758bad7a6b7c2693cb2da90aee0028d11c44d84899d2651b3c73ba052cebf81f562fb65f434bcc6cfd92c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe586dd8.TMP

Filesize
105KB

MD5
78153a6b3b468eb79096c8e6c6da8816

SHA1
9989d10d2860a1b73863373979724763b8c9b7f2

SHA256
09710123e35e9bfdee52a6abaab7d057a28c8c3b77ba2ef4ee2c849db238d47b

SHA512
248fe77825edbd7ea52d6fed8e3dad2c0a8511e4d89923dfaab4fb1774d42b33334d271e467c49a1d55b6fc044b41fb2011a234bec8e993d7142079d6c2ed851

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\njRAT-Platinum-Edition-RuS-main.zip

Filesize
9.4MB

MD5
77b83a87828704868df93a4c15c6fbb7

SHA1
69955655c90b8fc5778ff165b2417933560f2772

SHA256
2f2eed1731f3addbd1c192ab1c82631caba60e6cba3b32aaacde4c1d75effb0b

SHA512
10a3818520d774d21779dc101c9d81830841ccc8f1ceb3837e3202df3f761790ee2a8c134163062d247b7451c749446a4e6947716e470a3ab101093ed2ae662b

Download Submit
memory/3880-663-0x0000000003170000-0x0000000003178000-memory.dmp

Filesize
32KB

Download
memory/3880-673-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-652-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-659-0x000000001C590000-0x000000001CA5E000-memory.dmp

Filesize
4.8MB

Download
memory/3880-662-0x000000001CB20000-0x000000001CBBC000-memory.dmp

Filesize
624KB

Download
memory/3880-650-0x00007FFCA6750000-0x00007FFCA70F0000-memory.dmp

Filesize
9.6MB

Download
memory/3880-664-0x000000001CC80000-0x000000001CCCC000-memory.dmp

Filesize
304KB

Download
memory/3880-665-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-666-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-667-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-668-0x000000001E7D0000-0x000000001E7E2000-memory.dmp

Filesize
72KB

Download
memory/3880-669-0x00007FFCA6750000-0x00007FFCA70F0000-memory.dmp

Filesize
9.6MB

Download
memory/3880-670-0x00007FFCA6750000-0x00007FFCA70F0000-memory.dmp

Filesize
9.6MB

Download
memory/3880-671-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-672-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-651-0x000000001C010000-0x000000001C0B6000-memory.dmp

Filesize
664KB

Download
memory/3880-675-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-674-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-676-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-677-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-678-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-679-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-649-0x00007FFCA6750000-0x00007FFCA70F0000-memory.dmp

Filesize
9.6MB

Download
memory/3880-685-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/3880-686-0x0000000022C60000-0x0000000022D60000-memory.dmp

Filesize
1024KB

Download
memory/3880-687-0x0000000022C60000-0x0000000022D60000-memory.dmp

Filesize
1024KB

Download
memory/3880-688-0x0000000022C60000-0x0000000022D60000-memory.dmp

Filesize
1024KB

Download
memory/3880-691-0x0000000022C60000-0x0000000022D60000-memory.dmp

Filesize
1024KB

Download
memory/3880-648-0x00000000008D0000-0x00000000010C4000-memory.dmp

Filesize
8.0MB

Download