8ad29df347af2e9fa20ecb1067063286cdb477b66dd53eb762a8142259971eae

Analysis

user interaction
yes
max time kernel
54s
max time network
39s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/11/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NjRat Storm.exe
Size 8.4MB
Sample261107-pbmdkacy2p
SHA256 8ad29df347af2e9fa20ecb1067063286cdb477b66dd53eb762a8142259971eae
MD5 bafc5e56b42019046187b69ab8281e54
SHA1 a07e15297ddf7cceb6b45387c15736ca087aeeaa
SHA512 93eb02251449c2a044eb92a67ee3b1a74c36b7145e2cdcc09dd85b9682ccfd67f178e64be8243d6e1dae7a18e3c8cefd7f65df979214f01965c156b4044c1b42
SSDEEP 98304:T3llQ5RMDoMu2oW5nnim//7uvwCt5tuo32v:T3wF+nnim//7uVtF
TLSH
T11B965C1276A4C911E1BDA3F4D2E181F606B4BD0FD134863B25A53E69B9F1782BC02BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NjRat Storm.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NjRat Storm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NjRat Storm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NjRat Storm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000000c89d1ac3842dd0161e8aaa84142dd01d6acafa84142dd0114000000	NjRat Storm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	NjRat Storm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "4"	NjRat Storm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	NjRat Storm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	NjRat Storm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NjRat Storm.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NjRat Storm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NjRat Storm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat Storm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4468	NjRat Storm.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4468	NjRat Storm.exe
4468	NjRat Storm.exe
4468	NjRat Storm.exe
4468	NjRat Storm.exe
4468	NjRat Storm.exe
4468	NjRat Storm.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4468	NjRat Storm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4468	NjRat Storm.exe

C:\Users\Admin\AppData\Local\Temp\NjRat Storm.exe
"C:\Users\Admin\AppData\Local\Temp\NjRat Storm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4468-0-0x0000000000220000-0x0000000000A92000-memory.dmp

Download

memory/4468-1-0x0000000005420000-0x00000000054BC000-memory.dmp

Download

memory/4468-2-0x0000000005A80000-0x0000000006026000-memory.dmp

Download

memory/4468-3-0x0000000005570000-0x0000000005602000-memory.dmp

Download

memory/4468-4-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

memory/4468-6-0x0000000005670000-0x00000000056C6000-memory.dmp

Download

memory/4468-5-0x0000000005530000-0x000000000553A000-memory.dmp

Download

memory/4468-7-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

memory/4468-8-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

memory/4468-9-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

memory/4468-10-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

memory/4468-11-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

memory/4468-12-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

memory/4468-13-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

memory/4468-14-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

memory/4468-15-0x00000000057D0000-0x00000000057E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads