Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 16:33
Behavioral task
behavioral1
Sample
NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe
-
Size
65KB
-
MD5
b1290bf36ae40c7d6ac7dfac9f399848
-
SHA1
fbcfebb104fe31aeae0a24b3bd28d92280f012aa
-
SHA256
20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6
-
SHA512
e76d15ca4fbc01ef955ad08bf5cd8725ce1e709f17ae1929dbc79afba51f77c9d39050d3edbe0757397312b0a75598f569254fb067aec0fb7af537617180e240
-
SSDEEP
1536:lcxR4cEoN36tLQviFw1iW6SBnvb0fLteF3nLrB9z3neaF9bNS9vM:lcxR4cEoN36tLQviFCbhBnYfWl9zuaFn
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:1604
RuntimeBroker.exe
-
reg_key
RuntimeBroker.exe
-
splitter
|Ghost|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\Control Panel\International\Geo\Nation NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe RuntimeBroker.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe RuntimeBroker.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.url RuntimeBroker.exe -
Executes dropped EXE 1 IoCs
pid Process 1532 RuntimeBroker.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeBroker.exe\" .." RuntimeBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeBroker.exe\" .." RuntimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe Token: SeDebugPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe Token: 33 1532 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 1532 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4936 wrote to memory of 1532 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 86 PID 4936 wrote to memory of 1532 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 86 PID 4936 wrote to memory of 1532 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 86 PID 4936 wrote to memory of 1680 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 87 PID 4936 wrote to memory of 1680 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 87 PID 4936 wrote to memory of 1680 4936 NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe 87 PID 1680 wrote to memory of 560 1680 cmd.exe 89 PID 1680 wrote to memory of 560 1680 cmd.exe 89 PID 1680 wrote to memory of 560 1680 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\NEAS.20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6exe_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵PID:560
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5b1290bf36ae40c7d6ac7dfac9f399848
SHA1fbcfebb104fe31aeae0a24b3bd28d92280f012aa
SHA25620b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6
SHA512e76d15ca4fbc01ef955ad08bf5cd8725ce1e709f17ae1929dbc79afba51f77c9d39050d3edbe0757397312b0a75598f569254fb067aec0fb7af537617180e240
-
Filesize
65KB
MD5b1290bf36ae40c7d6ac7dfac9f399848
SHA1fbcfebb104fe31aeae0a24b3bd28d92280f012aa
SHA25620b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6
SHA512e76d15ca4fbc01ef955ad08bf5cd8725ce1e709f17ae1929dbc79afba51f77c9d39050d3edbe0757397312b0a75598f569254fb067aec0fb7af537617180e240
-
Filesize
65KB
MD5b1290bf36ae40c7d6ac7dfac9f399848
SHA1fbcfebb104fe31aeae0a24b3bd28d92280f012aa
SHA25620b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6
SHA512e76d15ca4fbc01ef955ad08bf5cd8725ce1e709f17ae1929dbc79afba51f77c9d39050d3edbe0757397312b0a75598f569254fb067aec0fb7af537617180e240