| File name: | WindowsServices.exe |
| Full analysis: | https://app.any.run/tasks/b5135db0-7f5c-4c7b-9b73-7ca56def81c4 |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | October 22, 2023, 19:28:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 03B59A3CE57AB30FB8851460BEFA7E0E |
| SHA1: | 3A7B888766923369576773A54C76575DFC561461 |
| SHA256: | 0B2BB84DBD5B5525FD63F8DD9EE178F17744DE10B4C01EBE9C0A16EF1BCC427F |
| SSDEEP: | 3072:nXKMXR9cJnrMFktIArRJ2lYm9O+w3s8yYh222wvqqhT1rCAlnhB7LfQcUA:nBw3s8yYh222gq8rCsnhB7D |
MALICIOUS
Drops the executable file immediately after the start
- WindowsServices.exe (PID: 2868)
NjRAT is detected
- WindowsServices.exe (PID: 2868)
Create files in the Startup directory
- WindowsServices.exe (PID: 2868)
Changes the autorun value in the registry
- WindowsServices.exe (PID: 2868)
SUSPICIOUS
Uses NETSH.EXE to add a firewall rule or allowed programs
- WindowsServices.exe (PID: 2868)
Connects to unusual port
- WindowsServices.exe (PID: 2868)
INFO
Manual execution by a user
- rundll32.exe (PID: 2784)
Reads Environment values
- WindowsServices.exe (PID: 2868)
Checks supported languages
- WindowsServices.exe (PID: 2868)
Reads the computer name
- WindowsServices.exe (PID: 2868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (45.1) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (19.2) |
| .exe | | | Win64 Executable (generic) (17) |
| .scr | | | Windows screen saver (8) |
| .dll | | | Win32 Dynamic Link Library (generic) (4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:10:22 20:33:03+02:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 157184 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x284ee |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
43
Monitored processes
7
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 992 | "C:\Windows\System32\runas.exe" /user:administrator C:\Users\admin\AppData\Roaming\WindowsServices.exe | C:\Windows\System32\runas.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Run As Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1940 | C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B} | C:\Windows\SysWOW64\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2408 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\WindowsServices.exe" "WindowsServices.exe" ENABLE | C:\Windows\SysWOW64\netsh.exe | — | WindowsServices.exe | |||||||||||
User: Administrator Company: Microsoft Corporation Integrity Level: HIGH Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2488 | C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B} | C:\Windows\SysWOW64\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2732 | C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B} | C:\Windows\SysWOW64\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2784 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl ,1 | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2868 | C:\Users\admin\AppData\Roaming\WindowsServices.exe | C:\Users\admin\AppData\Roaming\WindowsServices.exe | runas.exe | ||||||||||||
User: Administrator Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
Total events
2 060
Read events
1 560
Write events
498
Delete events
2
Modification events
| (PID) Process: | (2784) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2784) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes |
| Operation: | write | Name: | ThemeChangesMousePointers |
Value: 1 | |||
| (PID) Process: | (2784) rundll32.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | Scheme Source |
Value: 0 | |||
| (PID) Process: | (2408) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\2\52C64B7E |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (2408) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\2 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (2408) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2868) WindowsServices.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | 43be8addf8331c6d42e935c786628803 |
Value: "C:\Users\admin\AppData\Roaming\WindowsServices.exe" .. | |||
| (PID) Process: | (2868) WindowsServices.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | 43be8addf8331c6d42e935c786628803 |
Value: "C:\Users\admin\AppData\Roaming\WindowsServices.exe" .. | |||
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2868 | WindowsServices.exe | C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\43be8addf8331c6d42e935c786628803.exe | executable | |
MD5:03B59A3CE57AB30FB8851460BEFA7E0E | SHA256:0B2BB84DBD5B5525FD63F8DD9EE178F17744DE10B4C01EBE9C0A16EF1BCC427F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
14
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
324 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1956 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2868 | WindowsServices.exe | 87.115.166.82:6522 | — | British Telecommunications PLC | GB | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
dns.msftncsi.com |
| shared |