Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    176s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 06:08

General

  • Target

    New Client.exe

  • Size

    164KB

  • MD5

    f08772b3bdde7388a4c43b7e41da5684

  • SHA1

    439cd4653ddbdf9d7433a165f5cd4eb6afe82bcb

  • SHA256

    6e0125f382bf828fbff9e7467a227c0584385395c2cb20a06a4c045f9ac6a43d

  • SHA512

    7776c2894397fae7a1934af7d87513d5e25114a10fd9cbb3fbbcc8fb1512dc68cad8b066dbba7c9462ded0d9c5c70f32d9fca42b18a72a0a2a67fd04755945a3

  • SSDEEP

    3072:0ibn/zRv40/9nUx0EpuCRwzzbEcr5+cbet7lo9Wagc:0i3Ux0EjGz4q5jbKz5

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Client.exe
    "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /tn NYAN /F
      2⤵
        PID:4172
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 1
        2⤵
        • Creates scheduled task(s)
        PID:2736
      • C:\Users\Admin\AppData\Local\Temp\Client.exe
        "C:\Users\Admin\AppData\Local\Temp\Client.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /tn NYAN /F
          3⤵
            PID:2352
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 1
            3⤵
            • Creates scheduled task(s)
            PID:4492

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Client.exe

        Filesize

        164KB

        MD5

        f08772b3bdde7388a4c43b7e41da5684

        SHA1

        439cd4653ddbdf9d7433a165f5cd4eb6afe82bcb

        SHA256

        6e0125f382bf828fbff9e7467a227c0584385395c2cb20a06a4c045f9ac6a43d

        SHA512

        7776c2894397fae7a1934af7d87513d5e25114a10fd9cbb3fbbcc8fb1512dc68cad8b066dbba7c9462ded0d9c5c70f32d9fca42b18a72a0a2a67fd04755945a3

      • C:\Users\Admin\AppData\Local\Temp\Client.exe

        Filesize

        164KB

        MD5

        f08772b3bdde7388a4c43b7e41da5684

        SHA1

        439cd4653ddbdf9d7433a165f5cd4eb6afe82bcb

        SHA256

        6e0125f382bf828fbff9e7467a227c0584385395c2cb20a06a4c045f9ac6a43d

        SHA512

        7776c2894397fae7a1934af7d87513d5e25114a10fd9cbb3fbbcc8fb1512dc68cad8b066dbba7c9462ded0d9c5c70f32d9fca42b18a72a0a2a67fd04755945a3

      • C:\Users\Admin\AppData\Local\Temp\Client.exe

        Filesize

        164KB

        MD5

        f08772b3bdde7388a4c43b7e41da5684

        SHA1

        439cd4653ddbdf9d7433a165f5cd4eb6afe82bcb

        SHA256

        6e0125f382bf828fbff9e7467a227c0584385395c2cb20a06a4c045f9ac6a43d

        SHA512

        7776c2894397fae7a1934af7d87513d5e25114a10fd9cbb3fbbcc8fb1512dc68cad8b066dbba7c9462ded0d9c5c70f32d9fca42b18a72a0a2a67fd04755945a3

      • memory/636-3-0x00000000753D0000-0x0000000075981000-memory.dmp

        Filesize

        5.7MB

      • memory/636-4-0x00000000753D0000-0x0000000075981000-memory.dmp

        Filesize

        5.7MB

      • memory/636-6-0x0000000001670000-0x0000000001680000-memory.dmp

        Filesize

        64KB

      • memory/636-0-0x00000000753D0000-0x0000000075981000-memory.dmp

        Filesize

        5.7MB

      • memory/636-2-0x0000000001670000-0x0000000001680000-memory.dmp

        Filesize

        64KB

      • memory/636-1-0x00000000753D0000-0x0000000075981000-memory.dmp

        Filesize

        5.7MB

      • memory/636-15-0x00000000753D0000-0x0000000075981000-memory.dmp

        Filesize

        5.7MB

      • memory/860-16-0x00000000753D0000-0x0000000075981000-memory.dmp

        Filesize

        5.7MB

      • memory/860-17-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

        Filesize

        64KB

      • memory/860-18-0x00000000753D0000-0x0000000075981000-memory.dmp

        Filesize

        5.7MB

      • memory/860-19-0x00000000753D0000-0x0000000075981000-memory.dmp

        Filesize

        5.7MB

      • memory/860-20-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

        Filesize

        64KB