njrat | hxxps://mega[.]nz/file/bKZDkJrS#K7HVReWsrrV7tyY0uJaezZ-J0qrB6NT6p3Ijj8EkmPg

Resubmissions

27/07/2024, 17:06

240727-vmgkcazalm3

26/07/2024, 12:17

240726-pf8gla1bjf10

Analysis

max time kernel
70s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://mega.nz/file/bKZDkJrS#K7HVReWsrrV7tyY0uJaezZ-J0qrB6NT6p3Ijj8EkmPg
Sample240726-pf8gla1bjf

Score

10^/10

njrat hacked discovery persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

127.0.0.1:5552

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Dllhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Dllhost.exe

Executes dropped EXE 1 IoCs

pid	Process
2280	Dllhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .."	Dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .."	Dllhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	contactmanager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	contactmanager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
3108	msedge.exe
3108	msedge.exe
4628	identity_helper.exe
4628	identity_helper.exe
5700	msedge.exe
5700	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6040	contactmanager.exe
2280	Dllhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: 33	732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	732	AUDIODG.EXE
Token: SeDebugPrivilege	2280	Dllhost.exe
Token: 33	2280	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2280	Dllhost.exe
Token: 33	2280	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2280	Dllhost.exe
Token: 33	2280	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2280	Dllhost.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5100	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 1248	3108	msedge.exe	84
PID 3108 wrote to memory of 1248	3108	msedge.exe	84
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 4672	3108	msedge.exe	85
PID 3108 wrote to memory of 2424	3108	msedge.exe	86
PID 3108 wrote to memory of 2424	3108	msedge.exe	86
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87
PID 3108 wrote to memory of 3048	3108	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/bKZDkJrS#K7HVReWsrrV7tyY0uJaezZ-J0qrB6NT6p3Ijj8EkmPg
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedab946f8,0x7ffedab94708,0x7ffedab94718
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17353988228721046455,1963351678303393759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x308
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5992

C:\Users\Admin\AppData\Local\Temp\Temp1_contact-manager-portable.zip\contactmanager.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_contact-manager-portable.zip\contactmanager.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:6040
- C:\Users\Admin\AppData\Local\Temp\Dllhost.exe
  "C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1388

C:\Users\Admin\Downloads\contact-manager-portable\contactmanager.exe
"C:\Users\Admin\Downloads\contact-manager-portable\contactmanager.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5912

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3917055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

contactmanager.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\contactmanager.exe.log
Size 507B
SHA256 650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5
MD5 25d1b50e7c0d451f3d850eb54d27ca05
SHA1 a238807715c70a335f54e80d4855644b21a9e870
SHA512 4223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
MD5 584971c8ba88c824fd51a05dddb45a98
SHA1 b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA512 5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
MD5 b28ef7d9f6d74f055cc49876767c886c
SHA1 d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA512 491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9e5c0f4122aa48b44244f07484159833fdd17eb76cf575721a961adbaac76285
MD5 2d5764761fc9f145c1fb541986dfd1d8
SHA1 227c2e081ead60176300a939e96bab1a5480bbf7
SHA512 b8a018c2ba304bff59eb8ebabb34bef875f8cead0c285db118a9335098e6479be88418ede98f4e0528c22277d7da73f326a769733cb57bb3987aee06b2333281
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f90f2f7b34a4198f691d4fadf65a5b60bfa1711e4da56dae358e540e3dac4d03
MD5 3f6f7c98b60a12636412bc3526e9c4c3
SHA1 629e31fb03b59c7a587b21691a0eb5c69deecfef
SHA512 feea36f9714f091743d063bad0e9482ff47976fe2b3a87367fbb8311c5c423abfb4e5dbf44837fb10808801e4242acad7469afb0ebc82797ae6ab1bdb0458b41
SSDEEP 96:n9kkU1MnhqwpvWMoiVmdeH1JjRUWQyV+VDCziEwb:n9kpuhqGWMXBro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b6e0b4cb03e55fc6c66fb2135511d6dfa497a3878395e8faae7b44332724b5ef
MD5 1027db02ad960d658299e3f7fa22ca39
SHA1 0bf88f7e584bcb8860e6def25e0c6b31d46af6ed
SHA512 a62d6cf3ed7d9e64c2515996775e8849579d00ee522271579babf5449dabfe772b145ae1dbd8cb84eca2df10a6561e80b8a04982cdfb14637b2c4db941186608
SSDEEP 96:n9keU1MnhqwpvWMoiVmdeOouz1j1JHRUWQyV+VD7AiEwb:n9k/uhqGWMbuzhdrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e22f63fe3d662f5ac27391a9dd8bad2804d97391a4efa702753e013cc2d513fe
MD5 5634f324f5cdf774b3b11ebc931d5caf
SHA1 25c0237517ce7d7a9c2ad02eb802067854d15d43
SHA512 3b71cbe5a6d18ad43ef8c54f0d3b2f67299e6d0a0cdadc3eb92b548447c3a00a8da1ccea34cec1633853960d1799d662678b7610e8a3e5e7c22b3a205055dee1
SSDEEP 96:n9k8sQkU1MnhqwpvWMoiVmdeOouz1j1JHMUWQyV+VD7AiEwb:n9kUuhqGWMbuzhgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fee8fe0b3c07fdc12e607784c699a2bee4422d1d90aaa5df0f02a44dde01060a
MD5 2868dcc98b93db1ecf6da9d536e4f743
SHA1 28d93843885e031fa122ea7b3c7ef5439aab1be0
SHA512 d194fac3cf34930ad7465cbdedc5b4e8f536440a7c822c9abf09cd63120f08a94970f177d391479a7d2ff6948b46fd5e0cef7f8c3a730a58400922438166f156
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57c8af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c8af.TMP
Size 48B
SHA256 cefc656c1fca8a66e28b28b8538b6c98e98c69e04b9fb9f371887cf589b1c49f
MD5 e2298bddd1dc3fcb22d1faa7470d0982
SHA1 ce073cd4f49ef93d27763a1fa6843f5da730cb5f
SHA512 5bcf771ad903aa7d6c2c713f840fa8dd3d862b631b0f3416b1397ea26b2da85c0288f8dd3f5ea36ed463408e3ef1c23a5b67496912356c2734146f4224488976
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 051f5850c71a859fd37eebbedd1f597a4ebdbf74bc4ec667e96c9195b452748f
MD5 cbefb2a869c220aaff08e9e1eba944ea
SHA1 d75f3743da12d7aaf1c857f260fee3112c7446bb
SHA512 29804f81e98bbfc7339ca046fe66b23cd9c29047da7b555531d1f21012f02af101898434ea762b6c614d18d71ef0d49ac2f8662da3017ebfc05c62ce27463055
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprKaU/5WPe2RUspeNWMMlvQ:A9iIxuERzA83h09RZxYr2/wuNyaV09w9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f1646beb07346779369880bab7c60f623dbe7a3dfe2f63722d4c5143beab9544
MD5 b22f8ec0a7f1de9bf875e8fd105a063c
SHA1 4c0510ae82d229d838bf69e573cc5f809ae0e022
SHA512 c58f40f95b757f91eac28deb8b8bea3932bcb7d27bca3fff17f0232d358ad35ea702244f7c53466d541485ca6ea2edc1733b0495b7bc0f90aab47b94eac279b0
SSDEEP 192:9oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprKaU/5WPe2RUspeNwMMlvQ:x9iIxuERzA83h09RZxYr2/wuNEaV09w9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dllhost.exe

Path C:\Users\Admin\AppData\Local\Temp\Dllhost.exe
Size 43KB
SHA256 1847908f9ea29e2ee609949ff2d24c9447de8a58c8b278f1c6f57c01650ba7a2
MD5 833be7bb4ef66edd363dd51fb6527833
SHA1 a325773f9746bb680e6f84fc35c504c8d4b06ef3
SHA512 e761bb075f18e23769f1f1a1daf232cdc19236d72f84846ca8d06c0fb5c0b2ba7fdcf9353a236bc661c0b89c2561f4ae3b3ceeca5e59b73cfb73d33a70940439
SSDEEP 384:+ZyCvHn1iDcsyEqtBfkEGCOEhGyOEtzcIij+ZsNO3PlpJKkkjh/TzF7pWno/greT:EhHnU4pEqtNkE5SyZuXQ/oR3+L
MD5 SHA1 SHA512 SSDEEP

Submit Download

contact-manager-portable.zip

Path C:\Users\Admin\Downloads\contact-manager-portable.zip
Size 590KB
SHA256 563eaf1abc620b87546d8c0ae59ac2080b97e5adccbc5f6f4ce820180c7ec6d3
MD5 fce3e93e9cbe663ab3a80a87dd220e87
SHA1 9a02cbeeb3cfa184d4f9986aaf2c3c166d936b66
SHA512 e835142066664b1f25af0b0e9b86469409965b4a0a0e25050c12049e29540416c4a881c847a7b5916e6b5d26ceb40c52636b782582c813c3f798d5600ccfb6b5
SSDEEP 12288:7Zod6b9ZwX+bkxxsJnLo6JbwXsj1SXuspZxTbT3DiculXn:59ZwX+bc2t1j14uoxTnmZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2280-211-0x0000000005950000-0x000000000595A000-memory.dmp

Download

memory/6040-165-0x0000000005550000-0x00000000055E2000-memory.dmp

Download

memory/6040-164-0x0000000005A60000-0x0000000006004000-memory.dmp

Download

memory/6040-163-0x0000000005160000-0x00000000051FC000-memory.dmp

Download

memory/6040-162-0x0000000000760000-0x0000000000772000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads