92daebf4afdf05aa2b7e92ec7d81c44803d255fc9bd6bbda8f9ed4af271b45da

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

37KB
MD5

704ed08f02343f35ff669d8ec651d4c1
SHA1

44b3f95cd69649435f129d9bcd0363a402d1534a
SHA256

92daebf4afdf05aa2b7e92ec7d81c44803d255fc9bd6bbda8f9ed4af271b45da
SHA512

022f1ffe197e038c46b2ce46e59106bd910d5eb85fc6a08d999dda14ed5be7eb1c168b7a0e4158ab23368d97c43fd1b44034e543c5c0e68b3ba6fbae860c2cb9
SSDEEP

384:ZLm2KMizd9jnBhFbJ8ycPVnvvnwaUBTrAF+rMRTyN/0L+EcoinblneHQM3epzXF0:Q2g9lLJfcPVn3VU9rM+rMRa8Nu7ct

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4872	netsh.exe
1736	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Server.exe

Executes dropped EXE 1 IoCs

pid	Process
852	njrat_test.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
20	5.tcp.eu.ngrok.io
41	5.tcp.eu.ngrok.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	njrat_test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3548	cmd.exe
2936	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2936	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4456	msedge.exe
4456	msedge.exe
4072	identity_helper.exe
4072	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe
Token: 33	852	njrat_test.exe
Token: SeIncBasePriorityPrivilege	852	njrat_test.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 852	4596	Server.exe	87
PID 4596 wrote to memory of 852	4596	Server.exe	87
PID 4596 wrote to memory of 852	4596	Server.exe	87
PID 852 wrote to memory of 4872	852	njrat_test.exe	95
PID 852 wrote to memory of 4872	852	njrat_test.exe	95
PID 852 wrote to memory of 4872	852	njrat_test.exe	95
PID 852 wrote to memory of 4456	852	njrat_test.exe	107
PID 852 wrote to memory of 4456	852	njrat_test.exe	107
PID 4456 wrote to memory of 4828	4456	msedge.exe	108
PID 4456 wrote to memory of 4828	4456	msedge.exe	108
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 5116	4456	msedge.exe	109
PID 4456 wrote to memory of 4420	4456	msedge.exe	110
PID 4456 wrote to memory of 4420	4456	msedge.exe	110
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111
PID 4456 wrote to memory of 3068	4456	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\njrat_test.exe
  "C:\Users\Admin\AppData\Local\Temp\njrat_test.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\njrat_test.exe" "njrat_test.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.google.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6dcd46f8,0x7ffc6dcd4708,0x7ffc6dcd4718
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6988470531333297957,12288471056678521428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
      4⤵
      PID:5012
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\njrat_test.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /k ping 0 & del "C:\Users\Admin\AppData\Local\Temp\njrat_test.exe" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3548
  - - C:\Windows\SysWOW64\PING.EXE
      ping 0
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7d86fa20f05993965fd490eb1407baa3

SHA1
b986f9e7ad640a65c2a0f371e81eaa2f7eb807fb

SHA256
055c85fecd68d2276115e3c3db315ada7b9c3c88a9c01307b226c14bbf5d113e

SHA512
5e2decf1703b5e9e2af5017a2bcbeca0764bf5d35fd83f3cdb54e23390bc0130eecefe7b56e07b2e380b326b931c195b34bd77bc6a65ad528bcda9702356f8ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
845B

MD5
027f499f372a0d5fe4f7ee156f5a5802

SHA1
5a905a99a64f2d97371c46a5ddc4db589eee7288

SHA256
7746f007f7ae94725987cb51ad31047db6e9336f94907d9cfc43b9679eb22217

SHA512
ab361b9182547a745c8fea1bc7a2eacc5bb7b952587f380a9e8bd49b457e998ab06d3790edd97166bd61fd60abd016bb5244e3a3bbefb3ebfac620f92da4b539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cede4f977050c8f8ab3322018de75650

SHA1
398172ce7699c036e1356a29e051ea8de7d37470

SHA256
7bd8ca1525bd99d6fa24fd5c36d79aec61794c4ca9996c1b8bcac2f10579aeb9

SHA512
3a13e986257d99e7e897409dc20229682f0bce06611e15eeb1c3c66c0134555e7cb4319f413e8247ee16a76c5f3dfbe4e5a948c393203d9583fb29e004bcfbfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0acd50d47786488bd343b5d81d0cf2a3

SHA1
b250314f13b9f6106bb0b5e589ec02c2d71a5b81

SHA256
de2cab543a5c61c5379aec51e3185e56e68827aea3a64e4626cb4d4b823e066e

SHA512
ce0c1e4949950f645cf2a21734f75f0d83926551b47c71ccc74bf2c37d9c24622df6a12cad72ebbd65ac746aa971125797fce0889e140f50b57c1556e1b8fbb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b3c5b09ff2a77969faba615a03d47392

SHA1
2d1fd98861be077ead487afdd5a888f2742568ce

SHA256
e150a791c55b8add220020d743468b71a3b402dc59d8f0225ec3a97d195708dd

SHA512
88dde96c3aaa966a770ce992322cc006cef7c87abad620ba2ab3c0c18e23665fca4d3de4b7959657f86b76d502aedac04499d64cb3998f8f2b7a04cb78c70aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\njrat_test.exe

Filesize
37KB

MD5
704ed08f02343f35ff669d8ec651d4c1

SHA1
44b3f95cd69649435f129d9bcd0363a402d1534a

SHA256
92daebf4afdf05aa2b7e92ec7d81c44803d255fc9bd6bbda8f9ed4af271b45da

SHA512
022f1ffe197e038c46b2ce46e59106bd910d5eb85fc6a08d999dda14ed5be7eb1c168b7a0e4158ab23368d97c43fd1b44034e543c5c0e68b3ba6fbae860c2cb9

Download Submit
memory/852-15-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/852-20-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/852-19-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/852-18-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/852-17-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/852-16-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/852-14-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/852-12-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/852-142-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4596-0-0x0000000075212000-0x0000000075213000-memory.dmp

Filesize
4KB

Download
memory/4596-13-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4596-2-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4596-1-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download