| File name: | runs.rar |
| Full analysis: | https://app.any.run/tasks/2f443e12-8411-4bb5-85b0-078249ce063f |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | January 09, 2025, 21:15:12 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 39E112D6BE79F8A6C5E50B55DC1342A8 |
| SHA1: | 1C02A2E1980683F41797A2AF4D2605556E6E082C |
| SHA256: | 22C2DA181EF0055AADE92B4DC50BB3025B3D428291FA3C67336D93E352B10C17 |
| SSDEEP: | 1536:V2Cdm4mob2gp3KARkVYoY0ZsgnuDo2lYSiZX7gM+4P2G:M2Ggp34VBYE3nWo2lGR0xRG |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 1252)
NjRAT is detected
- 19.exe (PID: 2832)
- 3a.exe (PID: 3016)
- 19.exe (PID: 3168)
- wispris.exe (PID: 1996)
- rundl32 .exe (PID: 3176)
- wispris.exe (PID: 2652)
- wispris.exe (PID: 952)
- rundl32 .exe (PID: 876)
Create files in the Startup directory
- 3a.exe (PID: 3016)
- rundl32 .exe (PID: 876)
Changes the autorun value in the registry
- 3a.exe (PID: 3016)
- rundl32 .exe (PID: 876)
- wispris.exe (PID: 952)
NJRAT has been detected (YARA)
- 3a.exe (PID: 3016)
Changes appearance of the Explorer extensions
- rundl32 .exe (PID: 876)
- wispris.exe (PID: 952)
SUSPICIOUS
Starts itself from another location
- 1eee77.exe (PID: 2076)
- 19.exe (PID: 3168)
- rundl32 .exe (PID: 3176)
- 19.exe (PID: 2832)
Executable content was dropped or overwritten
- 1eee77.exe (PID: 2076)
- 3a.exe (PID: 3016)
- 19.exe (PID: 2832)
- 19.exe (PID: 3168)
- rundl32 .exe (PID: 3176)
- rundl32 .exe (PID: 876)
Reads security settings of Internet Explorer
- 1eee77.exe (PID: 2076)
Reads the Internet Settings
- 1eee77.exe (PID: 2076)
Uses NETSH.EXE to add a firewall rule or allowed programs
- 3a.exe (PID: 3016)
- rundl32 .exe (PID: 876)
- wispris.exe (PID: 952)
Connects to unusual port
- 3a.exe (PID: 3016)
- wispris.exe (PID: 952)
- rundl32 .exe (PID: 876)
INFO
Manual execution by a user
- 1eee77.exe (PID: 2076)
- 19.exe (PID: 2832)
- 19.exe (PID: 3168)
- rundl32 .exe (PID: 3176)
- wispris.exe (PID: 1996)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 1252)
Creates files in the program directory
- 1eee77.exe (PID: 2076)
Checks supported languages
- 1eee77.exe (PID: 2076)
- 3a.exe (PID: 3016)
- 19.exe (PID: 2832)
- 19.exe (PID: 3168)
- rundl32 .exe (PID: 3176)
- wispris.exe (PID: 1996)
- wispris.exe (PID: 2652)
- rundl32 .exe (PID: 876)
- wispris.exe (PID: 952)
The process uses the downloaded file
- 1eee77.exe (PID: 2076)
- WinRAR.exe (PID: 1252)
Reads the computer name
- 19.exe (PID: 2832)
- 1eee77.exe (PID: 2076)
- 19.exe (PID: 3168)
- wispris.exe (PID: 1996)
- rundl32 .exe (PID: 3176)
- 3a.exe (PID: 3016)
- wispris.exe (PID: 2652)
- wispris.exe (PID: 952)
- rundl32 .exe (PID: 876)
Reads the machine GUID from the registry
- 1eee77.exe (PID: 2076)
- 19.exe (PID: 3168)
- wispris.exe (PID: 1996)
- rundl32 .exe (PID: 3176)
- 19.exe (PID: 2832)
- 3a.exe (PID: 3016)
- wispris.exe (PID: 2652)
- wispris.exe (PID: 952)
- rundl32 .exe (PID: 876)
Creates files or folders in the user directory
- 3a.exe (PID: 3016)
- 19.exe (PID: 3168)
- rundl32 .exe (PID: 876)
Reads Environment values
- 3a.exe (PID: 3016)
- rundl32 .exe (PID: 876)
- wispris.exe (PID: 952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
NjRat
(PID) Process(3016) 3a.exe
C2amma.myftp.biz
Ports1177
Botnetجديد ديب فريذ وى هند كافى
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\5a295eb30a8c4bea86741e429f16b791
Splitter|'|'|
Version0.6.4
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
EXIF
ZIP
| FileVersion: | RAR v5 |
|---|---|
| CompressedSize: | 13073 |
| UncompressedSize: | 29696 |
| OperatingSystem: | Win32 |
| ArchivedFileName: | 1eee77.exe |
Total processes
50
Monitored processes
14
Malicious processes
9
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 820 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\rundl32 .exe" "rundl32 .exe" ENABLE | C:\Windows\System32\netsh.exe | — | rundl32 .exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 876 | "C:\Users\admin\AppData\Roaming\rundl32 .exe" | C:\Users\admin\AppData\Roaming\rundl32 .exe | rundl32 .exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 0.0.0.0 Modules
| |||||||||||||||
| 952 | "C:\Users\admin\AppData\Roaming\wispris.exe" | C:\Users\admin\AppData\Roaming\wispris.exe | 19.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 0.0.0.0 Modules
| |||||||||||||||
| 1108 | C:\Windows\system32\svchost.exe -k NetworkService | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1252 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\runs.rar | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1996 | "C:\Users\admin\Desktop\wispris.exe" | C:\Users\admin\Desktop\wispris.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
| 2076 | "C:\Users\admin\Desktop\1eee77.exe" | C:\Users\admin\Desktop\1eee77.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2272 | netsh firewall add allowedprogram "C:\ProgramData\3a.exe" "3a.exe" ENABLE | C:\Windows\System32\netsh.exe | — | 3a.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2652 | "C:\Users\admin\AppData\Roaming\wispris.exe" | C:\Users\admin\AppData\Roaming\wispris.exe | 19.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
| 2832 | "C:\Users\admin\Desktop\19.exe" | C:\Users\admin\Desktop\19.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
Total events
6 173
Read events
5 902
Write events
258
Delete events
13
Modification events
| (PID) Process: | (1252) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1252) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1108) svchost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet |
| Operation: | write | Name: | {4040CF00-1B3E-486A-B407-FA14C56B6FC0} |
Value: 525400363EFF | |||
| (PID) Process: | (1252) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1252) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1252) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (1252) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (1252) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\runs.rar | |||
| (PID) Process: | (1252) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1252) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
Executable files
10
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1252 | WinRAR.exe | C:\Users\admin\Desktop\rundl32 .exe | executable | |
MD5:2336FA395D0B41E23772C0100CBE7CCD | SHA256:D3DBCE9DBE2584705241D037EACD71523920B03AC91B2C9C3F1EDCC9285FAF2F | |||
| 876 | rundl32 .exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\30638a9c1b4ac07951c67b44d4429457.exe | executable | |
MD5:2336FA395D0B41E23772C0100CBE7CCD | SHA256:D3DBCE9DBE2584705241D037EACD71523920B03AC91B2C9C3F1EDCC9285FAF2F | |||
| 1252 | WinRAR.exe | C:\Users\admin\Desktop\19.exe | executable | |
MD5:BE0CCC9FE21D9938F3903955C0D9E1E4 | SHA256:609DF71BA7F236047599B76E4FED8E9D14BA3E7DC97FB76E5A0B57E62D80257E | |||
| 1252 | WinRAR.exe | C:\Users\admin\Desktop\wispris.exe | executable | |
MD5:BE0CCC9FE21D9938F3903955C0D9E1E4 | SHA256:609DF71BA7F236047599B76E4FED8E9D14BA3E7DC97FB76E5A0B57E62D80257E | |||
| 3016 | 3a.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a295eb30a8c4bea86741e429f16b791.exe | executable | |
MD5:760311844C7277C1093B2329A4457B30 | SHA256:A48793DE08E00CBF27BEA2E14C5DFA19CB3A00CF022D5D5AA544C335C411C2CF | |||
| 2076 | 1eee77.exe | C:\ProgramData\3a.exe | executable | |
MD5:760311844C7277C1093B2329A4457B30 | SHA256:A48793DE08E00CBF27BEA2E14C5DFA19CB3A00CF022D5D5AA544C335C411C2CF | |||
| 3168 | 19.exe | C:\Users\admin\AppData\Roaming\wispris.exe | executable | |
MD5:BE0CCC9FE21D9938F3903955C0D9E1E4 | SHA256:609DF71BA7F236047599B76E4FED8E9D14BA3E7DC97FB76E5A0B57E62D80257E | |||
| 3176 | rundl32 .exe | C:\Users\admin\AppData\Roaming\rundl32 .exe | executable | |
MD5:2336FA395D0B41E23772C0100CBE7CCD | SHA256:D3DBCE9DBE2584705241D037EACD71523920B03AC91B2C9C3F1EDCC9285FAF2F | |||
| 1252 | WinRAR.exe | C:\Users\admin\Desktop\1eee77.exe | executable | |
MD5:760311844C7277C1093B2329A4457B30 | SHA256:A48793DE08E00CBF27BEA2E14C5DFA19CB3A00CF022D5D5AA544C335C411C2CF | |||
| 2832 | 19.exe | C:\Users\admin\AppData\Roaming\wispris.exe | executable | |
MD5:BE0CCC9FE21D9938F3903955C0D9E1E4 | SHA256:609DF71BA7F236047599B76E4FED8E9D14BA3E7DC97FB76E5A0B57E62D80257E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
4
Threats
3
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1108 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
3016 | 3a.exe | 102.47.240.94:1177 | amma.myftp.biz | TE-AS | EG | malicious |
952 | wispris.exe | 102.47.240.94:1984 | amma.myftp.biz | TE-AS | EG | malicious |
876 | rundl32 .exe | 102.47.240.94:1984 | amma.myftp.biz | TE-AS | EG | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
amma.myftp.biz |
| malicious |
vpvp.myftp.biz |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1108 | svchost.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious *.myftp.biz Domain |
1108 | svchost.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious *.myftp.biz Domain |
1108 | svchost.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious *.myftp.biz Domain |