Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 13:25
Behavioral task
behavioral1
Sample
37eadb2a6a140992e449eabfb0835d8f.exe
Resource
win7-20231129-en
General
-
Target
37eadb2a6a140992e449eabfb0835d8f.exe
-
Size
402KB
-
MD5
37eadb2a6a140992e449eabfb0835d8f
-
SHA1
77cc4134b54cc4a07624e7b332713a08b7efc617
-
SHA256
4a666cb1c605e9318e069c60f68589c67eeb6b30c49975a9189f15f2a6aab463
-
SHA512
d521f6cb1ab2723bafc5093eb69c326ce65f48a6961eddb8107159663e60104cf38d9baaea18013939ced450d0e8b63960619f2a40c7cdb715226da51b769e24
-
SSDEEP
6144:kmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgW:NSmLAuEY71fviagATFmebVQDcYc6
Malware Config
Extracted
njrat
0.6.4
hhhmach.ddns.net:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation test.exe -
Executes dropped EXE 2 IoCs
pid Process 3896 test.exe 1356 Trojan.exe -
resource yara_rule behavioral2/memory/4584-0-0x0000000000400000-0x00000000004FA000-memory.dmp upx behavioral2/memory/4584-1-0x0000000000400000-0x00000000004FA000-memory.dmp upx behavioral2/memory/4584-3-0x0000000000400000-0x00000000004FA000-memory.dmp upx behavioral2/memory/4584-32-0x0000000000400000-0x00000000004FA000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4020 4584 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4584 wrote to memory of 2996 4584 37eadb2a6a140992e449eabfb0835d8f.exe 95 PID 4584 wrote to memory of 2996 4584 37eadb2a6a140992e449eabfb0835d8f.exe 95 PID 4584 wrote to memory of 2996 4584 37eadb2a6a140992e449eabfb0835d8f.exe 95 PID 2996 wrote to memory of 3896 2996 cmd.exe 96 PID 2996 wrote to memory of 3896 2996 cmd.exe 96 PID 2996 wrote to memory of 3896 2996 cmd.exe 96 PID 3896 wrote to memory of 1356 3896 test.exe 101 PID 3896 wrote to memory of 1356 3896 test.exe 101 PID 3896 wrote to memory of 1356 3896 test.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\37eadb2a6a140992e449eabfb0835d8f.exe"C:\Users\Admin\AppData\Local\Temp\37eadb2a6a140992e449eabfb0835d8f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"4⤵
- Executes dropped EXE
PID:1356
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 1642⤵
- Program crash
PID:4020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4584 -ip 45841⤵PID:2888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4584 -ip 45841⤵PID:3196
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD542c5854aa0709d8bf6c28ea82c67b9a5
SHA1124ea473f0572009de85a4a46f361109f4fae7d6
SHA25671e1add662041fee9ff0ddf0139154cf006538559af45f34047aac91efb1b8eb
SHA512c0f4412f2237138b5b66ecc285d7f44bacd67ae23feb0a55561cd4f7850ee6b0fd1b1dac3d2725ed4932aaf155b0fbda284a69b07594789bdb4cbcf0f499d95a