Analysis

  • max time kernel
    424s
  • max time network
    403s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    09-12-2024 14:47

General

  • Target

    NjRat.0.7D-main(1).zip

  • Size

    48.8MB

  • MD5

    80d3d5163cafe75e0f2d1666a4c65414

  • SHA1

    b94d1e8abcf337c888f403e4e7563c896fa7d51c

  • SHA256

    d96bb6e66aef5a2901a0bfb80df3382d79cdcf60c9916badf27b456244bc6929

  • SHA512

    d606abeacdb158dfdfabd89d7e3c12800704faa499821d01494899d5c36d93d2cc540d8747633535e148abffba4ac8c1fb3016fc03535c3d75cf74edd34daae3

  • SSDEEP

    1572864:u5rfgndUOnIfRGjDT159RHXDZ8411rbYfkI:u5rf0mOnGRaThBZ84frUsI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main(1).zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\AppData\Local\Temp\7zOC660140A\NjRat 0.7D Danger Edition.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC660140A\NjRat 0.7D Danger Edition.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4568
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1124
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:5076
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1368
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    PID:3408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zOC660140A\NjRat 0.7D Danger Edition.exe

    Filesize

    8.2MB

    MD5

    eda04645089d60f5cb602c8012a33e07

    SHA1

    85ae9d1a404d0a2063bee3d8d7bb9bef233fa71a

    SHA256

    e6cff62a0e8e7c654eec97093a1295773f223cd3a6a11f65c91491cfbd6be751

    SHA512

    fe9a1bddd90aabb6f5abb1d15666e75ab3c6136d1dbf2c79f0bbcd1dffe2089ac8a73ffe11b3d1cbbd6b393fc51f921fd5c50bf490a38e9038d2c366aaa9468d

  • memory/4568-15-0x0000000075072000-0x0000000075073000-memory.dmp

    Filesize

    4KB

  • memory/4568-16-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-17-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-18-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-19-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-20-0x0000000075072000-0x0000000075073000-memory.dmp

    Filesize

    4KB

  • memory/4568-21-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-22-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-23-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-24-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-25-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-26-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-27-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/4568-28-0x0000000075070000-0x0000000075621000-memory.dmp

    Filesize

    5.7MB

  • memory/5076-33-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB

  • memory/5076-31-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB

  • memory/5076-32-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB

  • memory/5076-43-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB

  • memory/5076-42-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB

  • memory/5076-41-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB

  • memory/5076-40-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB

  • memory/5076-39-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB

  • memory/5076-38-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB

  • memory/5076-37-0x0000026565AD0000-0x0000026565AD1000-memory.dmp

    Filesize

    4KB