Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2024, 16:32

General

  • Target

    DLLINJECTWORK.exe

  • Size

    43KB

  • MD5

    75f876f184505cc110923210adf581cc

  • SHA1

    2670bf9724001fd9ba1370682c8deddb22d1a35c

  • SHA256

    18d57def8a8508e9767383a47b26a31d30b4ed1d4fadc260d61810f32ea14a13

  • SHA512

    345c6cbeba7d3db55dee9a4717dea12b32693b19f8588920e2841330ba821fe0fb85769c26cb4b3050d1f851b3bfd26ea14b3dae24be095658243141ae151f74

  • SSDEEP

    384:GZy8tFgpWfxyiihvhAhjEhHSLizYIij+ZsNO3PlpJKkkjh/TzF7pWnD/greT0pqD:c7tWofYiYhcYy4uXQ/oO/+L

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

assault

C2

pro-fundraising.gl.at.ply.gg:43768

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DLLINJECTWORK.exe
    "C:\Users\Admin\AppData\Local\Temp\DLLINJECTWORK.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Roaming\ChromeUpdater.exe
      "C:\Users\Admin\AppData\Roaming\ChromeUpdater.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2800
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {3CB49672-CE3D-43F8-A8C6-C7D335D60FF2} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:316
    • C:\Users\Admin\AppData\Local\Temp\Server.exe
      C:\Users\Admin\AppData\Local\Temp/Server.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1928
    • C:\Users\Admin\AppData\Local\Temp\Server.exe
      C:\Users\Admin\AppData\Local\Temp/Server.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\ChromeUpdater.exe

    Filesize

    43KB

    MD5

    75f876f184505cc110923210adf581cc

    SHA1

    2670bf9724001fd9ba1370682c8deddb22d1a35c

    SHA256

    18d57def8a8508e9767383a47b26a31d30b4ed1d4fadc260d61810f32ea14a13

    SHA512

    345c6cbeba7d3db55dee9a4717dea12b32693b19f8588920e2841330ba821fe0fb85769c26cb4b3050d1f851b3bfd26ea14b3dae24be095658243141ae151f74

  • memory/572-22-0x00000000000C0000-0x00000000000D2000-memory.dmp

    Filesize

    72KB

  • memory/1928-20-0x00000000000D0000-0x00000000000E2000-memory.dmp

    Filesize

    72KB

  • memory/2640-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

    Filesize

    4KB

  • memory/2640-1-0x0000000000C90000-0x0000000000CA2000-memory.dmp

    Filesize

    72KB

  • memory/2640-2-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/2640-11-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/2776-10-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/2776-12-0x0000000000040000-0x0000000000052000-memory.dmp

    Filesize

    72KB

  • memory/2776-13-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/2776-16-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/2776-17-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB