Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2023, 20:26

General

  • Target

    AVI Reader.exe

  • Size

    49KB

  • MD5

    c3ec94cb1c15fbfd213aa5d5854b8e3f

  • SHA1

    65726604b29227377aadef41da87a7306c852f0c

  • SHA256

    87a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4

  • SHA512

    e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf

  • SSDEEP

    1536:a7dS1EAd8II28ca2zhmamGJCKDRMcyEQXGNEPRbw1Rl:igEA6II2Da2zPf/XyEQSiRby

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

Cheats

C2

127.0.0.1:1

Mutex

smss.exe

Attributes
  • reg_key

    smss.exe

  • splitter

    |Ghost|

Extracted

Family

xworm

C2

192.168.2.133:1

217.229.108.168:1

Attributes
  • install_file

    USB.exe

Signatures

  • Xworm

    Xworm is a remote access trojan written in C#.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Deletes itself 1 IoCs
  • Drops startup file 7 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\AVI Reader.exe
    "C:\Users\Admin\AppData\Local\Temp\AVI Reader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Windows\system32\schtasks.exe
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        3⤵
          PID:2852
        • C:\Windows\system32\schtasks.exe
          schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\smss.exe
          3⤵
          • Creates scheduled task(s)
          PID:2668
        • C:\Users\Admin\AppData\Local\Temp\717a6fb1c88b42f0a106d6cc2f4677bb.exe
          "C:\Users\Admin\AppData\Local\Temp\717a6fb1c88b42f0a106d6cc2f4677bb.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2860
          • C:\Users\Admin\AppData\Roaming\Meatspin_v6_FULL_by_LuckyKazya.exe
            "C:\Users\Admin\AppData\Roaming\Meatspin_v6_FULL_by_LuckyKazya.exe"
            4⤵
            • Executes dropped EXE
            PID:940
          • C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe
            "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe"
            4⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1692
          • C:\Users\Admin\AppData\Roaming\MicrosoftEdge.exe
            "C:\Users\Admin\AppData\Roaming\MicrosoftEdge.exe"
            4⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:928
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\AVI Reader.exe"
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 5
          3⤵
            PID:2600
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {5886F1BD-66AA-4FC4-83AA-B5DB94E18FED} S-1-5-21-86725733-3001458681-3405935542-1000:ZWKQHIWB\Admin:Interactive:[1]
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Users\Admin\AppData\Local\Temp\smss.exe
          C:\Users\Admin\AppData\Local\Temp\smss.exe
          2⤵
          • Executes dropped EXE
          PID:2252
        • C:\Users\Admin\AppData\Local\Temp\smss.exe
          C:\Users\Admin\AppData\Local\Temp\smss.exe
          2⤵
          • Executes dropped EXE
          PID:456

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\MicrosoftEdge.exe

        Filesize

        197KB

        MD5

        96567f3ca98a3cf9df86e63eea9e88d9

        SHA1

        e7b0484e22e7aebf974e44ec4d621ebfbdcaa2f4

        SHA256

        7c7b11c8eb786a3dcc9a361605722abfb27450ad0a98a3fd075fcfffce08e7cc

        SHA512

        0d47b044e7f7288b835fc05493dcaeb6778d3af18e63d8d00c0e5e394c4eae28db0aed221da239a3683bb2cfbdbf2655bd0ac3214f02ea204ff243efadc82feb

      • C:\Users\Admin\AppData\Local\MicrosoftEdgeUpdate.exe

        Filesize

        192KB

        MD5

        3bdc1a44fa56047346dd6a7d33f57bfb

        SHA1

        435be4f1307f6d4c45213e27c775bba7c126f2fc

        SHA256

        207d25c9e2548babe4539403c210d9224dd7ada2d223e70168168fafbc49521a

        SHA512

        5f3e6f9f771b64b065d2113330c68ad49309ec2c3d80e67020bf4185852a0cf000239f72c5d9aa12872320070d6ab2b19d91243f5efce69bb2d1ee6ea1a49178

      • C:\Users\Admin\AppData\Local\Temp\717a6fb1c88b42f0a106d6cc2f4677bb.exe

        Filesize

        4.1MB

        MD5

        a0b724a087d8e87aa0571726265153a3

        SHA1

        d645fff92ae60a5fde73e1f62aef82f40cf6a1d2

        SHA256

        9198c970d6b61c1f22b6e2e4065fd99e8fd107c3bb8162c8aef56559459e9ff1

        SHA512

        aad4d75df0c8b5085492450ead420d6e7f7dc498dfbc3290014f2e633fcab069a5e5b0b535e7330b8b5b9267299d52b217630649933e4dbaaed3f37c5ab281dd

      • C:\Users\Admin\AppData\Local\Temp\717a6fb1c88b42f0a106d6cc2f4677bb.exe

        Filesize

        4.1MB

        MD5

        a0b724a087d8e87aa0571726265153a3

        SHA1

        d645fff92ae60a5fde73e1f62aef82f40cf6a1d2

        SHA256

        9198c970d6b61c1f22b6e2e4065fd99e8fd107c3bb8162c8aef56559459e9ff1

        SHA512

        aad4d75df0c8b5085492450ead420d6e7f7dc498dfbc3290014f2e633fcab069a5e5b0b535e7330b8b5b9267299d52b217630649933e4dbaaed3f37c5ab281dd

      • C:\Users\Admin\AppData\Local\Temp\smss.exe

        Filesize

        49KB

        MD5

        c3ec94cb1c15fbfd213aa5d5854b8e3f

        SHA1

        65726604b29227377aadef41da87a7306c852f0c

        SHA256

        87a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4

        SHA512

        e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf

      • C:\Users\Admin\AppData\Local\Temp\smss.exe

        Filesize

        49KB

        MD5

        c3ec94cb1c15fbfd213aa5d5854b8e3f

        SHA1

        65726604b29227377aadef41da87a7306c852f0c

        SHA256

        87a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4

        SHA512

        e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf

      • C:\Users\Admin\AppData\Local\Temp\smss.exe

        Filesize

        49KB

        MD5

        c3ec94cb1c15fbfd213aa5d5854b8e3f

        SHA1

        65726604b29227377aadef41da87a7306c852f0c

        SHA256

        87a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4

        SHA512

        e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf

      • C:\Users\Admin\AppData\Local\Temp\smss.exe

        Filesize

        49KB

        MD5

        c3ec94cb1c15fbfd213aa5d5854b8e3f

        SHA1

        65726604b29227377aadef41da87a7306c852f0c

        SHA256

        87a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4

        SHA512

        e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf

      • C:\Users\Admin\AppData\Roaming\Meatspin_v6_FULL_by_LuckyKazya.exe

        Filesize

        3.8MB

        MD5

        137c1b0243beb35b6a0b6dbe632dc341

        SHA1

        b710da533d9a33f4d7fc78d317bbcee8dc95826d

        SHA256

        86cd8a8dc5228014e559788e7a0f5ed6fef637691bf53111e9eab4187a0652ab

        SHA512

        49ee75b71223ed47ae81a089247ff3002d50f70ede8e57af42f73745bbf7cb8ee7c71c1ab5da9d967fbe0b2f9de5dad70f4a7f4cfe44ba104d5a60be53eccabf

      • C:\Users\Admin\AppData\Roaming\Meatspin_v6_FULL_by_LuckyKazya.exe

        Filesize

        3.8MB

        MD5

        137c1b0243beb35b6a0b6dbe632dc341

        SHA1

        b710da533d9a33f4d7fc78d317bbcee8dc95826d

        SHA256

        86cd8a8dc5228014e559788e7a0f5ed6fef637691bf53111e9eab4187a0652ab

        SHA512

        49ee75b71223ed47ae81a089247ff3002d50f70ede8e57af42f73745bbf7cb8ee7c71c1ab5da9d967fbe0b2f9de5dad70f4a7f4cfe44ba104d5a60be53eccabf

      • C:\Users\Admin\AppData\Roaming\MicrosoftEdge.exe

        Filesize

        197KB

        MD5

        96567f3ca98a3cf9df86e63eea9e88d9

        SHA1

        e7b0484e22e7aebf974e44ec4d621ebfbdcaa2f4

        SHA256

        7c7b11c8eb786a3dcc9a361605722abfb27450ad0a98a3fd075fcfffce08e7cc

        SHA512

        0d47b044e7f7288b835fc05493dcaeb6778d3af18e63d8d00c0e5e394c4eae28db0aed221da239a3683bb2cfbdbf2655bd0ac3214f02ea204ff243efadc82feb

      • C:\Users\Admin\AppData\Roaming\MicrosoftEdge.exe

        Filesize

        197KB

        MD5

        96567f3ca98a3cf9df86e63eea9e88d9

        SHA1

        e7b0484e22e7aebf974e44ec4d621ebfbdcaa2f4

        SHA256

        7c7b11c8eb786a3dcc9a361605722abfb27450ad0a98a3fd075fcfffce08e7cc

        SHA512

        0d47b044e7f7288b835fc05493dcaeb6778d3af18e63d8d00c0e5e394c4eae28db0aed221da239a3683bb2cfbdbf2655bd0ac3214f02ea204ff243efadc82feb

      • C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe

        Filesize

        192KB

        MD5

        3bdc1a44fa56047346dd6a7d33f57bfb

        SHA1

        435be4f1307f6d4c45213e27c775bba7c126f2fc

        SHA256

        207d25c9e2548babe4539403c210d9224dd7ada2d223e70168168fafbc49521a

        SHA512

        5f3e6f9f771b64b065d2113330c68ad49309ec2c3d80e67020bf4185852a0cf000239f72c5d9aa12872320070d6ab2b19d91243f5efce69bb2d1ee6ea1a49178

      • C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe

        Filesize

        192KB

        MD5

        3bdc1a44fa56047346dd6a7d33f57bfb

        SHA1

        435be4f1307f6d4c45213e27c775bba7c126f2fc

        SHA256

        207d25c9e2548babe4539403c210d9224dd7ada2d223e70168168fafbc49521a

        SHA512

        5f3e6f9f771b64b065d2113330c68ad49309ec2c3d80e67020bf4185852a0cf000239f72c5d9aa12872320070d6ab2b19d91243f5efce69bb2d1ee6ea1a49178

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smss.exe

        Filesize

        49KB

        MD5

        c3ec94cb1c15fbfd213aa5d5854b8e3f

        SHA1

        65726604b29227377aadef41da87a7306c852f0c

        SHA256

        87a340c6dc9b2e994fddc7edb764ab197ce3eb576c4456a89b9faddd5f28b0b4

        SHA512

        e9cc11eb5e5e7426f9b8109e73194fccf989bfba3c04b73b78094946e79c5c31f3bb85d75193bc370b192836932a6bd8fdda1f3b5ff7b027a911b9bd7612aebf

      • \Users\Admin\AppData\Roaming\Meatspin_v6_FULL_by_LuckyKazya.exe

        Filesize

        3.8MB

        MD5

        137c1b0243beb35b6a0b6dbe632dc341

        SHA1

        b710da533d9a33f4d7fc78d317bbcee8dc95826d

        SHA256

        86cd8a8dc5228014e559788e7a0f5ed6fef637691bf53111e9eab4187a0652ab

        SHA512

        49ee75b71223ed47ae81a089247ff3002d50f70ede8e57af42f73745bbf7cb8ee7c71c1ab5da9d967fbe0b2f9de5dad70f4a7f4cfe44ba104d5a60be53eccabf

      • memory/456-85-0x0000000001E20000-0x0000000001EA0000-memory.dmp

        Filesize

        512KB

      • memory/456-84-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/456-86-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/928-51-0x000007FEEE150000-0x000007FEEEB3C000-memory.dmp

        Filesize

        9.9MB

      • memory/928-70-0x000000001B260000-0x000000001B2E0000-memory.dmp

        Filesize

        512KB

      • memory/928-47-0x0000000001240000-0x0000000001276000-memory.dmp

        Filesize

        216KB

      • memory/928-72-0x000007FEEE150000-0x000007FEEEB3C000-memory.dmp

        Filesize

        9.9MB

      • memory/928-80-0x000000001B260000-0x000000001B2E0000-memory.dmp

        Filesize

        512KB

      • memory/940-69-0x000007FEEE150000-0x000007FEEEB3C000-memory.dmp

        Filesize

        9.9MB

      • memory/940-77-0x000000001BC40000-0x000000001BCC0000-memory.dmp

        Filesize

        512KB

      • memory/940-46-0x000007FEEE150000-0x000007FEEEB3C000-memory.dmp

        Filesize

        9.9MB

      • memory/940-55-0x000000001BC40000-0x000000001BCC0000-memory.dmp

        Filesize

        512KB

      • memory/940-48-0x000000013F090000-0x000000013F454000-memory.dmp

        Filesize

        3.8MB

      • memory/1692-52-0x0000000000F80000-0x0000000000FB4000-memory.dmp

        Filesize

        208KB

      • memory/1692-79-0x000000001B290000-0x000000001B310000-memory.dmp

        Filesize

        512KB

      • memory/1692-75-0x000007FEEE150000-0x000007FEEEB3C000-memory.dmp

        Filesize

        9.9MB

      • memory/1692-68-0x000000001B290000-0x000000001B310000-memory.dmp

        Filesize

        512KB

      • memory/1692-53-0x000007FEEE150000-0x000007FEEEB3C000-memory.dmp

        Filesize

        9.9MB

      • memory/1752-0-0x0000000000D70000-0x0000000000D7A000-memory.dmp

        Filesize

        40KB

      • memory/1752-1-0x0000000000510000-0x0000000000528000-memory.dmp

        Filesize

        96KB

      • memory/1752-2-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/1752-3-0x0000000000A80000-0x0000000000B00000-memory.dmp

        Filesize

        512KB

      • memory/1752-4-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/1752-10-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2252-73-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2252-78-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2252-76-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2252-74-0x0000000000520000-0x00000000005A0000-memory.dmp

        Filesize

        512KB

      • memory/2644-12-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2644-18-0x00000000002A0000-0x0000000000320000-memory.dmp

        Filesize

        512KB

      • memory/2644-11-0x00000000009E0000-0x00000000009EA000-memory.dmp

        Filesize

        40KB

      • memory/2644-22-0x00000000002A0000-0x0000000000320000-memory.dmp

        Filesize

        512KB

      • memory/2644-23-0x00000000009C0000-0x00000000009CA000-memory.dmp

        Filesize

        40KB

      • memory/2644-13-0x00000000002A0000-0x0000000000320000-memory.dmp

        Filesize

        512KB

      • memory/2644-24-0x00000000002A0000-0x0000000000320000-memory.dmp

        Filesize

        512KB

      • memory/2644-19-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2644-21-0x00000000002A0000-0x0000000000320000-memory.dmp

        Filesize

        512KB

      • memory/2644-14-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2644-20-0x00000000002A0000-0x0000000000320000-memory.dmp

        Filesize

        512KB

      • memory/2860-30-0x0000000000A20000-0x0000000000E4A000-memory.dmp

        Filesize

        4.2MB

      • memory/2860-54-0x000007FEEE150000-0x000007FEEEB3C000-memory.dmp

        Filesize

        9.9MB

      • memory/2860-31-0x000007FEEE150000-0x000007FEEEB3C000-memory.dmp

        Filesize

        9.9MB