Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    18/01/2024, 07:57

General

  • Target

    64e03ce9d4db10ad22af9fdecf8e750b.exe

  • Size

    230KB

  • MD5

    64e03ce9d4db10ad22af9fdecf8e750b

  • SHA1

    b9fe3564b39f85feac38877320562d345fa31300

  • SHA256

    e9cafe0e597dea98a327b31ceb7bcf8a6a90c90d729b6709c0b8819efb53ceec

  • SHA512

    815d7f97eb088e3dee422b1fdf7ad9fae6796ad1d7648c46942610d48074042d7d6ea2073ca6d65df86d91b6b8e16c5d03d90a042272c5ea74783f3e62c69ec1

  • SSDEEP

    1536:e/gDBnYi9bV1BZV0CbD/csMunng0P5JkcrOGEoUjMJC:e4ZYi9bV1BZV0C3csjnbJkoVBUg8

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

79.224.89.201:5552

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64e03ce9d4db10ad22af9fdecf8e750b.exe
    "C:\Users\Admin\AppData\Local\Temp\64e03ce9d4db10ad22af9fdecf8e750b.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Users\Admin\AppData\Local\Temp\Payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:2440
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
      2⤵
      • Views/modifies file attributes
      PID:2620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

    Filesize

    1KB

    MD5

    406cb5d8884554b910ec2985051e04b9

    SHA1

    6c2caa778ff91890041c687a8f0d7bfb3496c72d

    SHA256

    6f65ea8e387ca72e00d035cd0c38570a196414187ff069577491764e1f601bd1

    SHA512

    2f8418c76878a6e1dec7fe2ce4e7f47734cd01e9a8c812995263e5f57a67adc4761923a2c00a9cffecec73b2080e8f03c6fcd07d6d18b5c0154cd2542f02a182

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

    Filesize

    1018B

    MD5

    7cbc2d82c4f90ff978979a21634aa85e

    SHA1

    cc595afa4a2f17360b23218aa002e3e31e29b408

    SHA256

    21f7e2b15bbe313f5bb49f27e5a11296c63cf26c625e2da423b1e18df0bbb5a0

    SHA512

    3c11f0c560084e7e85183a0d28463308ce9df197616c36b1a6d912657364e9f83730c82b94673c8bab4130c26c417ff668b3a19abccfb360855d2d374ed8ddff

  • \Users\Admin\AppData\Local\Temp\Payload.exe

    Filesize

    230KB

    MD5

    64e03ce9d4db10ad22af9fdecf8e750b

    SHA1

    b9fe3564b39f85feac38877320562d345fa31300

    SHA256

    e9cafe0e597dea98a327b31ceb7bcf8a6a90c90d729b6709c0b8819efb53ceec

    SHA512

    815d7f97eb088e3dee422b1fdf7ad9fae6796ad1d7648c46942610d48074042d7d6ea2073ca6d65df86d91b6b8e16c5d03d90a042272c5ea74783f3e62c69ec1

  • memory/2332-0-0x0000000074280000-0x000000007482B000-memory.dmp

    Filesize

    5.7MB

  • memory/2332-1-0x0000000000670000-0x00000000006B0000-memory.dmp

    Filesize

    256KB

  • memory/2332-2-0x0000000074280000-0x000000007482B000-memory.dmp

    Filesize

    5.7MB

  • memory/2332-13-0x0000000074280000-0x000000007482B000-memory.dmp

    Filesize

    5.7MB

  • memory/2440-14-0x00000000021C0000-0x0000000002200000-memory.dmp

    Filesize

    256KB

  • memory/2440-12-0x0000000074280000-0x000000007482B000-memory.dmp

    Filesize

    5.7MB

  • memory/2440-19-0x0000000074280000-0x000000007482B000-memory.dmp

    Filesize

    5.7MB

  • memory/2440-21-0x0000000074280000-0x000000007482B000-memory.dmp

    Filesize

    5.7MB

  • memory/2440-22-0x00000000021C0000-0x0000000002200000-memory.dmp

    Filesize

    256KB