Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    59s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 14:20

General

  • Target

    NjRat 0.7D Green Edition by im523.exe

  • Size

    2.5MB

  • MD5

    db03ed78b35220d0a178d0c4cba27e76

  • SHA1

    ba576c67c78c680e2f8c5375d294b5dbd7c3250e

  • SHA256

    42b9c295089c7cf9141f5d0a40a1155cfd3627888579473f8c9b80e8e3ea1c48

  • SHA512

    c272cfef5199450c903443ae3259191d1ecfd8795854e297aef36c819af8887233419b98bb54e5e5894846a1454c398991487547191c66de00881c31e6d1ae93

  • SSDEEP

    49152:LJNiJe3T1/rgMVwPpIGGHgoQhLL2RWNbftLLQPFfO5SSOp:LJNReMVmILHg3gMQSjO

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe
    "C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4176
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WAPQYYAB"
      2⤵
      • Launches sc.exe
      PID:3296
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WAPQYYAB" binpath= "C:\ProgramData\evhjkmhsccca\ffhzguglhicn.exe" start= "auto"
      2⤵
      • Launches sc.exe
      PID:3496
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      2⤵
      • Launches sc.exe
      PID:2508
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WAPQYYAB"
      2⤵
      • Launches sc.exe
      PID:3564
  • C:\ProgramData\evhjkmhsccca\ffhzguglhicn.exe
    C:\ProgramData\evhjkmhsccca\ffhzguglhicn.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Windows\system32\conhost.exe
      C:\Windows\system32\conhost.exe
      2⤵
        PID:1380
      • C:\Windows\explorer.exe
        explorer.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3444

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\evhjkmhsccca\ffhzguglhicn.exe

      Filesize

      2.5MB

      MD5

      db03ed78b35220d0a178d0c4cba27e76

      SHA1

      ba576c67c78c680e2f8c5375d294b5dbd7c3250e

      SHA256

      42b9c295089c7cf9141f5d0a40a1155cfd3627888579473f8c9b80e8e3ea1c48

      SHA512

      c272cfef5199450c903443ae3259191d1ecfd8795854e297aef36c819af8887233419b98bb54e5e5894846a1454c398991487547191c66de00881c31e6d1ae93

    • memory/1380-7-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/1380-6-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/1380-5-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/1380-4-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/1380-3-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/1380-10-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/3444-11-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-23-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-13-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-12-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-16-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-18-0x0000000001180000-0x00000000011A0000-memory.dmp

      Filesize

      128KB

    • memory/3444-17-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-14-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-22-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-21-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-20-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-19-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-15-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-24-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-25-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/3444-26-0x00007FFF8E8E0000-0x00007FFF8EA81000-memory.dmp

      Filesize

      1.6MB