njrat | de947beae25bf933df8a1b438c7199248629418750214c0fb87a9158e4a7482b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
12/11/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jra71515.exe
Size 1.1MB
Sample261112-2ffsssxt3l
SHA256 de947beae25bf933df8a1b438c7199248629418750214c0fb87a9158e4a7482b
MD5 9193f1fbfcc4b93cff2b061193d82814
SHA1 a0d61d9161ce2b9f777187de3cc83cf1d5e844e2
SHA512 005ddfc42a8bf22b0ed207d3bb1ffbfa8df02fec100dcc4c99a1192484a35025a21df614c2d6839e27c8b53721dcb2803c23e789c7054eb1d6d508677280b3ab
SSDEEP 12288:IRXUzJS4tptp+i90s2pkx37nE/bf1FWGf4fgwbV0s2pkx37nE/bf1FWGf4XXWn0Q:xYUv9awbVtG1
TLSH
T18C35F8102BEAC417F1BB9F315AE365D59B7EF1A36B569D4E1180A3E60612B40FC9033B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

d.m.e defense_evasion discovery execution njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

D.M.e

18.tcp.cpolar.top:13330

Mutex

0816db741ccd03ac63dcc9752556d8ac

Attributes

reg_key
0816db741ccd03ac63dcc9752556d8ac
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	jra71515.exe
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	Squidward.exe

Creates a file in the Startup directory 1 TTPs 9 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Squidward.exe	jra71515.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe	Squidward.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe	Squidward.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe	Squidward.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR.exe	Squidward.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR.exe	Squidward.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe	Squidward.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe	Squidward.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe	Squidward.exe

Executes dropped EXE 4 IoCs

pid	Process
4396	Squidward.exe
2056	MasonMBR-SLEEP.exe
4340	MasonRootkit.exe
3936	MasonGDI.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 4964	4732	jra71515.exe	85

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	jra71515.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1212	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jra71515.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jra71515.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jra71515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jra71515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2972	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe
4340	MasonRootkit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3348	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: SeDebugPrivilege	4340	MasonRootkit.exe
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe
Token: 33	4964	jra71515.exe
Token: SeIncBasePriorityPrivilege	4964	jra71515.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4964	4732	jra71515.exe	85
PID 4732 wrote to memory of 4964	4732	jra71515.exe	85
PID 4732 wrote to memory of 4964	4732	jra71515.exe	85
PID 4732 wrote to memory of 4964	4732	jra71515.exe	85
PID 4732 wrote to memory of 4964	4732	jra71515.exe	85
PID 4964 wrote to memory of 4396	4964	jra71515.exe	95
PID 4396 wrote to memory of 2056	4396	Squidward.exe	96
PID 4396 wrote to memory of 4340	4396	Squidward.exe	97
PID 4396 wrote to memory of 3936	4396	Squidward.exe	98
PID 4396 wrote to memory of 2460	4396	Squidward.exe	99
PID 4340 wrote to memory of 592	4340	MasonRootkit.exe	5
PID 4340 wrote to memory of 668	4340	MasonRootkit.exe	7
PID 4340 wrote to memory of 888	4340	MasonRootkit.exe	11
PID 4340 wrote to memory of 1020	4340	MasonRootkit.exe	13
PID 4340 wrote to memory of 740	4340	MasonRootkit.exe	14
PID 4340 wrote to memory of 1016	4340	MasonRootkit.exe	15
PID 4340 wrote to memory of 1040	4340	MasonRootkit.exe	16
PID 4340 wrote to memory of 1092	4340	MasonRootkit.exe	17
PID 4340 wrote to memory of 1124	4340	MasonRootkit.exe	18
PID 4340 wrote to memory of 1144	4340	MasonRootkit.exe	19
PID 4340 wrote to memory of 1172	4340	MasonRootkit.exe	20
PID 4340 wrote to memory of 1280	4340	MasonRootkit.exe	22
PID 4340 wrote to memory of 1496	4340	MasonRootkit.exe	24
PID 4340 wrote to memory of 1508	4340	MasonRootkit.exe	25
PID 4340 wrote to memory of 1516	4340	MasonRootkit.exe	26
PID 4340 wrote to memory of 1552	4340	MasonRootkit.exe	27
PID 4340 wrote to memory of 1740	4340	MasonRootkit.exe	28
PID 4396 wrote to memory of 1212	4396	Squidward.exe	102
PID 4340 wrote to memory of 1760	4340	MasonRootkit.exe	29
PID 4340 wrote to memory of 1776	4340	MasonRootkit.exe	30
PID 4340 wrote to memory of 1800	4340	MasonRootkit.exe	31
PID 4340 wrote to memory of 1888	4340	MasonRootkit.exe	32
PID 4340 wrote to memory of 1976	4340	MasonRootkit.exe	33
PID 4340 wrote to memory of 2000	4340	MasonRootkit.exe	34
PID 4340 wrote to memory of 1384	4340	MasonRootkit.exe	35
PID 4340 wrote to memory of 1316	4340	MasonRootkit.exe	36
PID 4340 wrote to memory of 1308	4340	MasonRootkit.exe	37
PID 4340 wrote to memory of 1640	4340	MasonRootkit.exe	38
PID 4340 wrote to memory of 2072	4340	MasonRootkit.exe	39
PID 4340 wrote to memory of 2188	4340	MasonRootkit.exe	40
PID 1212 wrote to memory of 2972	1212	cmd.exe	104
PID 4340 wrote to memory of 2308	4340	MasonRootkit.exe	42
PID 4340 wrote to memory of 2504	4340	MasonRootkit.exe	44
PID 4340 wrote to memory of 2524	4340	MasonRootkit.exe	45
PID 4340 wrote to memory of 2624	4340	MasonRootkit.exe	46
PID 4340 wrote to memory of 2656	4340	MasonRootkit.exe	47
PID 4340 wrote to memory of 2692	4340	MasonRootkit.exe	48
PID 4340 wrote to memory of 2752	4340	MasonRootkit.exe	49
PID 4340 wrote to memory of 2760	4340	MasonRootkit.exe	50
PID 4340 wrote to memory of 2780	4340	MasonRootkit.exe	51
PID 4340 wrote to memory of 772	4340	MasonRootkit.exe	52
PID 4340 wrote to memory of 2840	4340	MasonRootkit.exe	53
PID 4340 wrote to memory of 3104	4340	MasonRootkit.exe	54
PID 4340 wrote to memory of 3168	4340	MasonRootkit.exe	55
PID 4340 wrote to memory of 3300	4340	MasonRootkit.exe	56
PID 4340 wrote to memory of 3348	4340	MasonRootkit.exe	57
PID 4340 wrote to memory of 3500	4340	MasonRootkit.exe	58
PID 4340 wrote to memory of 3788	4340	MasonRootkit.exe	60
PID 4340 wrote to memory of 4032	4340	MasonRootkit.exe	62
PID 4340 wrote to memory of 1228	4340	MasonRootkit.exe	63
PID 4340 wrote to memory of 4484	4340	MasonRootkit.exe	66
PID 4340 wrote to memory of 3116	4340	MasonRootkit.exe	68
PID 4340 wrote to memory of 4720	4340	MasonRootkit.exe	69
PID 4340 wrote to memory of 3128	4340	MasonRootkit.exe	70

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:592
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1172

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-41d4ded2-1bbf-4e30-844e-172567078bd5 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-979507d5-9b28-4ca6-a49a-782cc297bb08 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3a410422-47a1-4684-ba9d-56174fb18634 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8d4b5eab-f936-410d-8cc0-699749913a4e -LifetimeId:97a30947-4649-4082-afe7-ff3fe889aaa0 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1516
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1760
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1976
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x304 0x2fc
  2⤵
  PID:2456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2072

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3300

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3348
- C:\Users\Admin\AppData\Local\Temp\jra71515.exe
  "C:\Users\Admin\AppData\Local\Temp\jra71515.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Users\Admin\AppData\Local\Temp\jra71515.exe
    "C:\Users\Admin\AppData\Local\Temp\jra71515.exe"
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Enumerates video capture drivers
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Squidward.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Squidward.exe"
      4⤵
      Checks computer location settings
      Creates a file in the Startup directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe"
        5⤵
        Executes dropped EXE
        
        PID:2056
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4340
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\MasonMBR.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF156.tmp.bat""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1212
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1208
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3500

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4032

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1228

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3128

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1924

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3748

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:556

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:5044

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jra71515.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jra71515.exe.log
Size 425B
SHA256 83c70bfcb1b41892c9c50cabe9bc2d96b2f7420b28545afabd32f682ac62d0ad
MD5 8c7889bde41724ce3db7c67e730677f6
SHA1 485891cc9120cb2203a2483754dbd5e6ea24f28e
SHA512 b7c3aab27fc924dcaef78987b492931e164b9e30b813c532fe87e1d40001ed1861c4b5ddbdd85cd2278681a22e32eee816877f4f63cecaa9972976d87e38f5cc
TLSH
T114E061302371A1D589427F511C2C278902BF43856114FE1939D5166FD82605B3F313F7
MD5 SHA1 SHA512 TLSH

Submit Download

tmpF156.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpF156.tmp.bat
Size 204B
SHA256 3ca1db3936369565294b935d252d509a7029053b7c45d6e5dbff9509ab4f4068
MD5 7f0d8dc749899f17be3f96d9034ea1f4
SHA1 a6ce50e4841c7ef6fb0e45db627bd3cb07ac70cb
SHA512 6577eb21da014e588ad8abdc3a969db1a65c9932f93670b487a856d454c22cc3a03aaeb99159bb48b1b65bd6c7b91f1b4c78a093c7ff8ff23c8a0b9e952ded9e
TLSH
T14BD0221018EDF60FB957781302BBD24DD0A69C833A05AB20A34C0019680045CE0B8683
MD5 SHA1 SHA512 TLSH

Submit Download

MasonGDI.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe
Size 61KB
SHA256 57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6
MD5 2f9823efd49a6f8fc32ba52d75e620a4
SHA1 39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e
SHA512 2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad
SSDEEP 1536:PTynnng4PEIGZ5eqIXzgmYi/ZuPiDNG9j3+aOPw1WX6CjV9nu:9OFGfeZgmJ8POoOu1WX6CjS
TLSH
T13653F186E3B8C421D0F71333AD67E99413F5EAD69D56CA1F0A80935B6ED23464F21E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-SLEEP.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe
Size 65KB
SHA256 de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93
MD5 f006d2343d121bd2043925e87063fde7
SHA1 402799473ca52edb826a37e0042456032db121f3
SHA512 707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0
SSDEEP 1536:ToHs+RMT9qQPhcm7V0vppY62kxt+nl5Hr1lo/u:MHssMT9qQPSmyvB2cKl5L3P
TLSH
T1FC63F1129FE8026AC35F47B25DE573910F2ADE44DE06775F809182A18F49AC88773B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Squidward.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Squidward.exe
Size 535KB
SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
MD5 82bf26203c5d76dfa3a591f1cb60d7b5
SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
TLSH
T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-91-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/592-89-0x0000015960B70000-0x0000015960B9B000-memory.dmp

Download

memory/592-88-0x0000015960790000-0x00000159607B5000-memory.dmp

Download

memory/668-94-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/668-93-0x0000017B94770000-0x0000017B9479B000-memory.dmp

Download

memory/740-105-0x000002377A5C0000-0x000002377A5EB000-memory.dmp

Download

memory/740-106-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/888-99-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/888-98-0x000002147F030000-0x000002147F05B000-memory.dmp

Download

memory/1016-119-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1016-118-0x000001CF69060000-0x000001CF6908B000-memory.dmp

Download

memory/1020-101-0x00000244CE7C0000-0x00000244CE7EB000-memory.dmp

Download

memory/1020-102-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1040-122-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1040-121-0x0000028790A60000-0x0000028790A8B000-memory.dmp

Download

memory/1092-125-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1092-124-0x000001F5C0C70000-0x000001F5C0C9B000-memory.dmp

Download

memory/1124-127-0x000001CCABB20000-0x000001CCABB4B000-memory.dmp

Download

memory/1124-128-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1144-131-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1144-130-0x00000146EB1C0000-0x00000146EB1EB000-memory.dmp

Download

memory/1172-115-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1172-114-0x0000026A05B20000-0x0000026A05B4B000-memory.dmp

Download

memory/1280-133-0x00000241FCD90000-0x00000241FCDBB000-memory.dmp

Download

memory/1280-134-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1308-195-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1308-194-0x000002B9AF380000-0x000002B9AF3AB000-memory.dmp

Download

memory/1316-191-0x000001681BD40000-0x000001681BD6B000-memory.dmp

Download

memory/1316-192-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1384-188-0x000001B16FAB0000-0x000001B16FADB000-memory.dmp

Download

memory/1384-189-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1496-141-0x000001DD267C0000-0x000001DD267EB000-memory.dmp

Download

memory/1496-142-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1508-144-0x000002804BF90000-0x000002804BFBB000-memory.dmp

Download

memory/1508-145-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1516-148-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1516-147-0x000001961E360000-0x000001961E38B000-memory.dmp

Download

memory/1552-151-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1552-150-0x000002990CAE0000-0x000002990CB0B000-memory.dmp

Download

memory/1640-198-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1640-197-0x00000205DC330000-0x00000205DC35B000-memory.dmp

Download

memory/1740-153-0x000001F041160000-0x000001F04118B000-memory.dmp

Download

memory/1740-154-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1760-160-0x000001A8F03B0000-0x000001A8F03DB000-memory.dmp

Download

memory/1760-161-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1776-165-0x000002668A730000-0x000002668A75B000-memory.dmp

Download

memory/1776-166-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1800-168-0x00000225B4520000-0x00000225B454B000-memory.dmp

Download

memory/1800-169-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1888-180-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/1888-179-0x0000024775170000-0x000002477519B000-memory.dmp

Download

memory/1976-182-0x000002A3C3390000-0x000002A3C33BB000-memory.dmp

Download

memory/1976-183-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/2000-185-0x0000024FB6340000-0x0000024FB636B000-memory.dmp

Download

memory/2000-186-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/2056-54-0x0000000000F70000-0x0000000000F86000-memory.dmp

Download

memory/2072-201-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/2072-200-0x0000020814D70000-0x0000020814D9B000-memory.dmp

Download

memory/2188-205-0x0000000001210000-0x000000000123B000-memory.dmp

Download

memory/3936-82-0x0000000000E80000-0x0000000000E96000-memory.dmp

Download

memory/4340-66-0x00007FF8B0470000-0x00007FF8B052D000-memory.dmp

Download

memory/4340-65-0x00007FF8B0750000-0x00007FF8B0948000-memory.dmp

Download

memory/4396-36-0x0000000000A60000-0x0000000000AA2000-memory.dmp

Download

memory/4396-35-0x000000001AFE0000-0x000000001AFF0000-memory.dmp

Download

memory/4396-34-0x0000000000230000-0x00000000002BC000-memory.dmp

Download

memory/4732-0-0x0000000000910000-0x0000000000A30000-memory.dmp

Download

memory/4732-2-0x0000000005320000-0x000000000532A000-memory.dmp

Download

memory/4732-1-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/4964-19-0x0000000008410000-0x0000000008432000-memory.dmp

Download

memory/4964-16-0x00000000074E0000-0x00000000074F8000-memory.dmp

Download

memory/4964-15-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Download

memory/4964-14-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Download

memory/4964-13-0x0000000005A70000-0x0000000005B02000-memory.dmp

Download

memory/4964-12-0x0000000005980000-0x0000000005990000-memory.dmp

Download

memory/4964-11-0x0000000005ED0000-0x0000000006476000-memory.dmp

Download

memory/4964-10-0x0000000005830000-0x00000000058CC000-memory.dmp

Download

memory/4964-3-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4964-5-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4964-6-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4964-4-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4964-17-0x0000000001710000-0x0000000001724000-memory.dmp

Download

memory/4964-18-0x0000000008540000-0x0000000008558000-memory.dmp

Download