Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 03:12
Behavioral task
behavioral1
Sample
notavape.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
notavape.exe
Resource
win10v2004-20240802-en
General
-
Target
notavape.exe
-
Size
43KB
-
MD5
5b1db6df4c09fe3922d1b94abbbfa111
-
SHA1
5fe5932a084e787f610d2174a170fc9e39a45076
-
SHA256
96fd6b69b8b737d541f0de01124ada1ae2c2c07504a7c75749927108ccef553d
-
SHA512
52d640083367ba3435a92761fcf3a566ad5089bf824d20e65c76f08046625194a412f2ecbde9b52efd2d66e2fa8513bb6b057c16904d82c532e1f46135bca196
-
SSDEEP
384:3vZySBHIe1z1yzMDyjdDIM5NveqEGmS2DkzZqIij+ZsNO3PlpJKkkjh/TzF7pWnj:3RVVIe1zE4+hEM5NG8mSJuXQ/o43+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
138.197.139.130:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation notavape.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe NotAVapeLMAO.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe NotAVapeLMAO.exe -
Executes dropped EXE 3 IoCs
pid Process 2540 NotAVapeLMAO.exe 4592 Server.exe 3568 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\NotAVapeLMAO.exe\" .." NotAVapeLMAO.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\NotAVapeLMAO.exe\" .." NotAVapeLMAO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NotAVapeLMAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notavape.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1836 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1780 notavape.exe 2540 NotAVapeLMAO.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe Token: 33 2540 NotAVapeLMAO.exe Token: SeIncBasePriorityPrivilege 2540 NotAVapeLMAO.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2540 1780 notavape.exe 86 PID 1780 wrote to memory of 2540 1780 notavape.exe 86 PID 1780 wrote to memory of 2540 1780 notavape.exe 86 PID 2540 wrote to memory of 1836 2540 NotAVapeLMAO.exe 90 PID 2540 wrote to memory of 1836 2540 NotAVapeLMAO.exe 90 PID 2540 wrote to memory of 1836 2540 NotAVapeLMAO.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\notavape.exe"C:\Users\Admin\AppData\Local\Temp\notavape.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Roaming\NotAVapeLMAO.exe"C:\Users\Admin\AppData\Roaming\NotAVapeLMAO.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1836
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4592
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3568
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
507B
MD525d1b50e7c0d451f3d850eb54d27ca05
SHA1a238807715c70a335f54e80d4855644b21a9e870
SHA256650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5
SHA5124223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5
-
Filesize
43KB
MD55b1db6df4c09fe3922d1b94abbbfa111
SHA15fe5932a084e787f610d2174a170fc9e39a45076
SHA25696fd6b69b8b737d541f0de01124ada1ae2c2c07504a7c75749927108ccef553d
SHA51252d640083367ba3435a92761fcf3a566ad5089bf824d20e65c76f08046625194a412f2ecbde9b52efd2d66e2fa8513bb6b057c16904d82c532e1f46135bca196