Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/01/2024, 13:33

240117-qtzbhsgge7 10

17/01/2024, 13:28

240117-qq6anagfh5 10

Analysis

  • max time kernel
    299s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2024, 13:33

General

  • Target

    Payload2024.exe

  • Size

    27KB

  • MD5

    248679d7c4c333b7b2fef2c0f092327b

  • SHA1

    d5b18fa3fd68935ab01b25db2813250b9d121dbd

  • SHA256

    239e6fe1ce713f9107e88f9b06877e744bea245a699e837e864a6d2b065e6756

  • SHA512

    27efe089952678727053fffcfe4212d330f55ec5a3eee0f7122a9deeff3dee92600db2f3238ae1d11da1d6d8e0a9bc1e48c02b9b8a71ee3129eff5d11ac06dc9

  • SSDEEP

    384:0LUl2J1dJFKnO4YLJ5zeZsL4E7O4/ChZGPjdx4kM0AQk93vmhm7UMKmIEecKdbXi:ipJFPleeHU0A/vMHTi9bD

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

C2

soon-lp.at.ply.gg:17209

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payload2024.exe
    "C:\Users\Admin\AppData\Local\Temp\Payload2024.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Payload.exe"
      2⤵
      • Views/modifies file attributes
      PID:920
    • C:\Users\Admin\AppData\Roaming\Payload.exe
      "C:\Users\Admin\AppData\Roaming\Payload.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4416
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
        3⤵
        • Views/modifies file attributes
        PID:2836
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
        3⤵
        • Drops startup file
        • Views/modifies file attributes
        PID:2404
      • C:\Users\Admin\AppData\Local\Temp\tmp6CA0.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp6CA0.tmp.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp6CA0.tmp.exe

    Filesize

    29KB

    MD5

    049f20e676c2d8483999cb3111f0debe

    SHA1

    918c02726d22ef390b304ca20057310eefd4d17f

    SHA256

    a2e9a44495e4c8740b74371a8a3499e2ee75cce06512eb3b7c3d2e04be8b7a76

    SHA512

    70b9cae76b3816e3b578558278eba82e05986ac7be07dec190789d9d227125ad69a3f1eb3b5673bf643a4a0e7e3aa65308bbe2bc284693b9514f74b6708fe004

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

    Filesize

    1KB

    MD5

    603069b2b1beac54d0f7ce4019810f04

    SHA1

    333300497fe640e8bec729e54c22c050f9f15282

    SHA256

    1fac9bc75c529d9c7b73b630642c2ae31ebbe983a2dc7a68ef6e50cc1d9cb622

    SHA512

    4033744b5211593645edaeaac09e24614783bdac0468d872ee5104eb42cb06850b98403b32aff1bd373d01f8cdcd8c4d5c102b4d532ba38cb4ede71b4d581047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

    Filesize

    1KB

    MD5

    97024cf693e19efbc26b5fa4986f6f29

    SHA1

    d4d0868afa1b76790b0440af30a245ac12cead9d

    SHA256

    959567471c08b8a526d6a200c60eec296c1860919d8442c4f5fb555af06cc67f

    SHA512

    7cda443def3fdd8c7423c4cc5cc3085c31e8e93995fd89ddb6a3ff36f03b918f727f06bc4006439ed38bdf45c9d0de8e1478a59d46ca4abef06856e6cde86ac9

  • C:\Users\Admin\AppData\Roaming\Payload.exe

    Filesize

    27KB

    MD5

    248679d7c4c333b7b2fef2c0f092327b

    SHA1

    d5b18fa3fd68935ab01b25db2813250b9d121dbd

    SHA256

    239e6fe1ce713f9107e88f9b06877e744bea245a699e837e864a6d2b065e6756

    SHA512

    27efe089952678727053fffcfe4212d330f55ec5a3eee0f7122a9deeff3dee92600db2f3238ae1d11da1d6d8e0a9bc1e48c02b9b8a71ee3129eff5d11ac06dc9

  • memory/1224-2-0x0000000004C50000-0x0000000004CEC000-memory.dmp

    Filesize

    624KB

  • memory/1224-1-0x0000000075050000-0x0000000075800000-memory.dmp

    Filesize

    7.7MB

  • memory/1224-5-0x00000000059B0000-0x0000000005F54000-memory.dmp

    Filesize

    5.6MB

  • memory/1224-0-0x0000000000250000-0x000000000025E000-memory.dmp

    Filesize

    56KB

  • memory/1224-15-0x0000000075050000-0x0000000075800000-memory.dmp

    Filesize

    7.7MB

  • memory/2284-43-0x0000000000D50000-0x0000000000D60000-memory.dmp

    Filesize

    64KB

  • memory/2284-42-0x000000006FE20000-0x00000000703D1000-memory.dmp

    Filesize

    5.7MB

  • memory/2284-50-0x000000006FE20000-0x00000000703D1000-memory.dmp

    Filesize

    5.7MB

  • memory/2284-46-0x0000000000D50000-0x0000000000D60000-memory.dmp

    Filesize

    64KB

  • memory/2284-44-0x000000006FE20000-0x00000000703D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4416-27-0x0000000005B10000-0x0000000005B1A000-memory.dmp

    Filesize

    40KB

  • memory/4416-29-0x0000000005910000-0x0000000005920000-memory.dmp

    Filesize

    64KB

  • memory/4416-30-0x0000000005D10000-0x0000000005D1C000-memory.dmp

    Filesize

    48KB

  • memory/4416-22-0x0000000005910000-0x0000000005920000-memory.dmp

    Filesize

    64KB

  • memory/4416-16-0x0000000075050000-0x0000000075800000-memory.dmp

    Filesize

    7.7MB

  • memory/4416-28-0x0000000075050000-0x0000000075800000-memory.dmp

    Filesize

    7.7MB

  • memory/4416-24-0x0000000005920000-0x00000000059B2000-memory.dmp

    Filesize

    584KB

  • memory/4416-26-0x0000000005B20000-0x0000000005B86000-memory.dmp

    Filesize

    408KB

  • memory/4416-25-0x0000000005900000-0x000000000590A000-memory.dmp

    Filesize

    40KB

  • memory/4416-51-0x0000000000D60000-0x0000000000D6A000-memory.dmp

    Filesize

    40KB

  • memory/4416-52-0x0000000000E30000-0x0000000000E40000-memory.dmp

    Filesize

    64KB