Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

ff7c120fbe...12.exe

windows7-x64

10

ff7c120fbe...12.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/04/2023, 02:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012.exe

  • Size

    29KB

  • MD5

    387066fa34cff110387fdef8dd7851f6

  • SHA1

    c88610c2ae895a36a720947c300282b2b5559b4f

  • SHA256

    ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012

  • SHA512

    0b7c4b53ab0aa0ab26acafa85dad1a51853eb3cb1d949e07662126857d69b390d0141a87009f68356fd9bc1dc69de6823a8385b9f0555a92311849f585ad6265

  • SSDEEP

    384:ZSItl77FDFucYfKQCcHN5vljmOmqDIlXHeHNGBsbh0w4wlAokw9OhgOL1vYRGOZD:v77ucYfKQTtzjAqc3eUBKh0p29SgR+Y

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

edge.servep2p.com:69

Mutex

813b829156a6c5f5b4a93593e8548ffd

Attributes
  • reg_key

    813b829156a6c5f5b4a93593e8548ffd

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012.exe
    "C:\Users\Admin\AppData\Local\Temp\ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\vm3dservicex.exe
      "C:\Users\Admin\AppData\Local\Temp\vm3dservicex.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\vm3dservicex.exe" "vm3dservicex.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:4128

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\vm3dservicex.exe
    Filesize

    29KB

    MD5

    387066fa34cff110387fdef8dd7851f6

    SHA1

    c88610c2ae895a36a720947c300282b2b5559b4f

    SHA256

    ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012

    SHA512

    0b7c4b53ab0aa0ab26acafa85dad1a51853eb3cb1d949e07662126857d69b390d0141a87009f68356fd9bc1dc69de6823a8385b9f0555a92311849f585ad6265

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vm3dservicex.exe
    Filesize

    29KB

    MD5

    387066fa34cff110387fdef8dd7851f6

    SHA1

    c88610c2ae895a36a720947c300282b2b5559b4f

    SHA256

    ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012

    SHA512

    0b7c4b53ab0aa0ab26acafa85dad1a51853eb3cb1d949e07662126857d69b390d0141a87009f68356fd9bc1dc69de6823a8385b9f0555a92311849f585ad6265

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vm3dservicex.exe
    Filesize

    29KB

    MD5

    387066fa34cff110387fdef8dd7851f6

    SHA1

    c88610c2ae895a36a720947c300282b2b5559b4f

    SHA256

    ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012

    SHA512

    0b7c4b53ab0aa0ab26acafa85dad1a51853eb3cb1d949e07662126857d69b390d0141a87009f68356fd9bc1dc69de6823a8385b9f0555a92311849f585ad6265

    Download Submit

  • memory/2028-134-0x0000000000F00000-0x0000000000F10000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3340-143-0x0000000001060000-0x0000000001070000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3340-144-0x0000000001060000-0x0000000001070000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3340-145-0x0000000001060000-0x0000000001070000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3340-146-0x0000000001060000-0x0000000001070000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3340-147-0x0000000001060000-0x0000000001070000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3340-148-0x0000000001060000-0x0000000001070000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3340-149-0x0000000001060000-0x0000000001070000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3340-150-0x0000000001060000-0x0000000001070000-memory.dmp

    Filesize

    64KB

    Download