Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 02:56

General

  • Target

    885f4a8ee6ccb6e9bbe48581fcc31b35.exe

  • Size

    180KB

  • MD5

    885f4a8ee6ccb6e9bbe48581fcc31b35

  • SHA1

    3efe1ac183c5a5409a1e64149db5b951d69291ff

  • SHA256

    937e47ee0d3c308cfa1c64248db4d12c67ed97259b3d7706020a3759937648ec

  • SHA512

    16941acb8d10a0a9acb3ce64e8db34a1090218b80dd45753d21b389d78beb5f81b63fe4f17cdb6f8ef7305ed6584c88d4ec2ac955b528e203cf9254e32757ab5

  • SSDEEP

    3072:M1HqkyWxsFhpTgqDYVlkUEgdqw+TO3LSQPBobM5RDoSlogQB:OK3dNEzkvVQ5oARsX

Score
10/10

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 440
    1⤵
      PID:2140
    • C:\Users\Admin\AppData\Local\Temp\885f4a8ee6ccb6e9bbe48581fcc31b35.exe
      "C:\Users\Admin\AppData\Local\Temp\885f4a8ee6ccb6e9bbe48581fcc31b35.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2288

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2140-281-0x0000000000370000-0x0000000000371000-memory.dmp

      Filesize

      4KB

    • memory/2140-284-0x0000000000370000-0x0000000000371000-memory.dmp

      Filesize

      4KB

    • memory/2288-28-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-26-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-60-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-58-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-56-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-54-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-52-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-50-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-48-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-24-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-44-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-42-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-40-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-38-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-36-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-34-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-32-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-30-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-62-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-64-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-46-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-22-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-20-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-18-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-16-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-14-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-12-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-10-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-8-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-6-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-4-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-3-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB

    • memory/2288-2-0x00000000004A0000-0x00000000004E0000-memory.dmp

      Filesize

      256KB

    • memory/2288-1-0x0000000074A70000-0x000000007501B000-memory.dmp

      Filesize

      5.7MB

    • memory/2288-0-0x0000000074A70000-0x000000007501B000-memory.dmp

      Filesize

      5.7MB

    • memory/2288-282-0x0000000074A70000-0x000000007501B000-memory.dmp

      Filesize

      5.7MB

    • memory/2288-283-0x00000000004A0000-0x00000000004E0000-memory.dmp

      Filesize

      256KB

    • memory/2288-66-0x0000000000450000-0x0000000000479000-memory.dmp

      Filesize

      164KB