Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2023, 03:11

General

  • Target

    c4cfbb0106571122d1cc4364513e7803.exe

  • Size

    596KB

  • MD5

    c4cfbb0106571122d1cc4364513e7803

  • SHA1

    1a3a7b1357ed56b0183d03ee4b859659cc68f986

  • SHA256

    a54a3ca8ce01f7e9855d4d47d35bc82520ebd8d16a77df24e398b220d86d445d

  • SHA512

    36a13d91a28d051fbf7c611d3c6ef7014ee8bcddc2ce5bca72f094f70bd0dbfb99a50025455203f0fabb60c61afc89aabf2e41f70aac5349372a146500eaefaa

  • SSDEEP

    12288:ugZXEAO/BUdG3gVdt7KT4OIC4J84wHM5Qiu62PJr+ymhm:ugZXoZUTVdt7KTxoSs5QhCymhm

Score
10/10

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

2.tcp.eu.ngrok.io:19328

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4cfbb0106571122d1cc4364513e7803.exe
    "C:\Users\Admin\AppData\Local\Temp\c4cfbb0106571122d1cc4364513e7803.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mrx.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mrx.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Users\Admin\AppData\Local\Temp\mrx.exe
        "C:\Users\Admin\AppData\Local\Temp\mrx.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mrx.exe.log

    Filesize

    507B

    MD5

    25d1b50e7c0d451f3d850eb54d27ca05

    SHA1

    a238807715c70a335f54e80d4855644b21a9e870

    SHA256

    650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5

    SHA512

    4223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mrx.exe

    Filesize

    43KB

    MD5

    7bc43f36b07c8b1de174daf7f4ead29b

    SHA1

    700a9e8e4a8a0cd8f7b3b1c58ebf5e47dfa7ec31

    SHA256

    c28550985ad9088407d8149d7d37155c97f10a461581c8a570bb082436596aff

    SHA512

    54169b096eb83782316ea605c391ee70c00099292fdecffff72656989f9eb0ed2d5448f4eb0374d3426c5c7e1d964d2634cd46beedd70aebf7417c28bcdefe8a

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mrx.exe

    Filesize

    43KB

    MD5

    7bc43f36b07c8b1de174daf7f4ead29b

    SHA1

    700a9e8e4a8a0cd8f7b3b1c58ebf5e47dfa7ec31

    SHA256

    c28550985ad9088407d8149d7d37155c97f10a461581c8a570bb082436596aff

    SHA512

    54169b096eb83782316ea605c391ee70c00099292fdecffff72656989f9eb0ed2d5448f4eb0374d3426c5c7e1d964d2634cd46beedd70aebf7417c28bcdefe8a

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mrx.exe

    Filesize

    43KB

    MD5

    7bc43f36b07c8b1de174daf7f4ead29b

    SHA1

    700a9e8e4a8a0cd8f7b3b1c58ebf5e47dfa7ec31

    SHA256

    c28550985ad9088407d8149d7d37155c97f10a461581c8a570bb082436596aff

    SHA512

    54169b096eb83782316ea605c391ee70c00099292fdecffff72656989f9eb0ed2d5448f4eb0374d3426c5c7e1d964d2634cd46beedd70aebf7417c28bcdefe8a

  • C:\Users\Admin\AppData\Local\Temp\mrx.exe

    Filesize

    43KB

    MD5

    7bc43f36b07c8b1de174daf7f4ead29b

    SHA1

    700a9e8e4a8a0cd8f7b3b1c58ebf5e47dfa7ec31

    SHA256

    c28550985ad9088407d8149d7d37155c97f10a461581c8a570bb082436596aff

    SHA512

    54169b096eb83782316ea605c391ee70c00099292fdecffff72656989f9eb0ed2d5448f4eb0374d3426c5c7e1d964d2634cd46beedd70aebf7417c28bcdefe8a

  • C:\Users\Admin\AppData\Local\Temp\mrx.exe

    Filesize

    43KB

    MD5

    7bc43f36b07c8b1de174daf7f4ead29b

    SHA1

    700a9e8e4a8a0cd8f7b3b1c58ebf5e47dfa7ec31

    SHA256

    c28550985ad9088407d8149d7d37155c97f10a461581c8a570bb082436596aff

    SHA512

    54169b096eb83782316ea605c391ee70c00099292fdecffff72656989f9eb0ed2d5448f4eb0374d3426c5c7e1d964d2634cd46beedd70aebf7417c28bcdefe8a

  • memory/3540-149-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

    Filesize

    64KB

  • memory/3540-148-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

    Filesize

    64KB

  • memory/3540-147-0x0000000004F20000-0x0000000004FB2000-memory.dmp

    Filesize

    584KB

  • memory/3540-146-0x00000000053C0000-0x0000000005964000-memory.dmp

    Filesize

    5.6MB

  • memory/3540-145-0x0000000004B30000-0x0000000004BCC000-memory.dmp

    Filesize

    624KB

  • memory/3540-144-0x0000000000160000-0x0000000000172000-memory.dmp

    Filesize

    72KB

  • memory/4268-160-0x0000000004B10000-0x0000000004B20000-memory.dmp

    Filesize

    64KB

  • memory/4268-161-0x0000000005120000-0x000000000512A000-memory.dmp

    Filesize

    40KB

  • memory/4268-162-0x00000000051D0000-0x0000000005236000-memory.dmp

    Filesize

    408KB

  • memory/4268-163-0x0000000004B10000-0x0000000004B20000-memory.dmp

    Filesize

    64KB