Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2024, 04:38

General

  • Target

    69817c6819e95aaf0298bec8e390c45e.exe

  • Size

    184KB

  • MD5

    69817c6819e95aaf0298bec8e390c45e

  • SHA1

    b159473871a1a2ea82af6938fbd5bb96e4e59929

  • SHA256

    504120144c29d628d287057fb3ef914ba89b3672c7638af5a104771843a4913f

  • SHA512

    c449e5ebe9748649cfc3cf54ab68af670d88a7ca49062a7832c80959dfee995805c26b64e54b2b5e0002a81c1b5b390e42cafc3b3a59a17ed9acfedcd31b6bc1

  • SSDEEP

    768:xQPeqA6136p6Zr/GH9lOQup0RPxGOHI5QgDgW+GTX3QOF711zNxJl4R:xQGqhKurglfup0jdgDgJ4HQOD1pxJa

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

error404.linkpc.net:1177

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Drops startup file 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69817c6819e95aaf0298bec8e390c45e.exe
    "C:\Users\Admin\AppData\Local\Temp\69817c6819e95aaf0298bec8e390c45e.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\ProgramData\Server.exe
      "C:\ProgramData\Server.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
        3⤵
        • Drops startup file
        • Views/modifies file attributes
        PID:2616
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
        3⤵
        • Views/modifies file attributes
        PID:2760
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\ProgramData\Server.exe"
      2⤵
      • Views/modifies file attributes
      PID:2128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

    Filesize

    1KB

    MD5

    a72d3f825b5516cf7dfe99611ff3fcac

    SHA1

    e0d6bbef34026b64c4a067673dea6828ab3ba069

    SHA256

    0320bf2481016958396ed3b08c7f0dfc979802e2ff0910a465528b853c5c8aa5

    SHA512

    e9279d36550a2d6866ef01545698b8b121b9beb1ad5a2070760430987359b44ae097f8aa328b9ff486c7c58e5c37dd5601e38daa462fb9ca5d0a9aabcf820e9a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

    Filesize

    1022B

    MD5

    90a12727a154fc49455c961d5dc018f2

    SHA1

    d89f852c112055ee01733db832dc96a5fb9d8c15

    SHA256

    79589616b2fb1ea3334af190a2a6faa8b86a62e640d2e7970769da76b20eb0c7

    SHA512

    0b5934f5d9313e11972a650c681d0e076dbd7a81fb4e5b32078ca52a71994878100cd528f8de80e11172546998591b09b1cd03e0609b2c7f91b5d3bd3840ab5f

  • \ProgramData\Server.exe

    Filesize

    184KB

    MD5

    69817c6819e95aaf0298bec8e390c45e

    SHA1

    b159473871a1a2ea82af6938fbd5bb96e4e59929

    SHA256

    504120144c29d628d287057fb3ef914ba89b3672c7638af5a104771843a4913f

    SHA512

    c449e5ebe9748649cfc3cf54ab68af670d88a7ca49062a7832c80959dfee995805c26b64e54b2b5e0002a81c1b5b390e42cafc3b3a59a17ed9acfedcd31b6bc1

  • memory/2512-0-0x0000000001380000-0x00000000013B4000-memory.dmp

    Filesize

    208KB

  • memory/2512-1-0x0000000074D90000-0x000000007547E000-memory.dmp

    Filesize

    6.9MB

  • memory/2512-2-0x0000000004C90000-0x0000000004CD0000-memory.dmp

    Filesize

    256KB

  • memory/2512-3-0x0000000000310000-0x000000000031E000-memory.dmp

    Filesize

    56KB

  • memory/2512-16-0x0000000074D90000-0x000000007547E000-memory.dmp

    Filesize

    6.9MB

  • memory/2916-13-0x00000000013B0000-0x00000000013E4000-memory.dmp

    Filesize

    208KB

  • memory/2916-14-0x0000000074D90000-0x000000007547E000-memory.dmp

    Filesize

    6.9MB

  • memory/2916-15-0x0000000001310000-0x0000000001350000-memory.dmp

    Filesize

    256KB

  • memory/2916-23-0x0000000074D90000-0x000000007547E000-memory.dmp

    Filesize

    6.9MB