Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25/10/2024, 19:02

General

  • Target

    98f649cb49b476d4446f2305e67c5394dd6e28b168683d8f9995d0a1c1eb61dfN.exe

  • Size

    117KB

  • MD5

    6eefb4f44dfecd1aff72270ce996d260

  • SHA1

    ca44fdb831b46dfee3ceb04a52bb111d9cfec7a7

  • SHA256

    98f649cb49b476d4446f2305e67c5394dd6e28b168683d8f9995d0a1c1eb61df

  • SHA512

    8bcf0f60850a2a3c1808eeff9350cd4249a8156495c61c9af2ccaa049a9506cc0a0b1b5db9cd09b31399f0ba47eb50969f4f215be13aa6a26927ebbb63696bd1

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLVH:P5eznsjsguGDFqGZ2rDLt

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98f649cb49b476d4446f2305e67c5394dd6e28b168683d8f9995d0a1c1eb61dfN.exe
    "C:\Users\Admin\AppData\Local\Temp\98f649cb49b476d4446f2305e67c5394dd6e28b168683d8f9995d0a1c1eb61dfN.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
      "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
        C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    32aa66aeb9040c8455e72e3ecc52485d

    SHA1

    94e13b5ddf0d3c4a3de369085c5b58f517ff4c8b

    SHA256

    fa55ac7db9aef9573806d7597582772b612f5fc30d33ade68eb418491220ced2

    SHA512

    adf4955a301b41d432aff393445e2976d08e4f3364f5a7e85f73f263d8494e56435009d8c1c4573c601e3ed089bd2ab108d020cb6550af3bbbfc4149d4f86a2b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7a9c9d411b7e6013ab215d6f4f56dc21

    SHA1

    872d84bf2f7c9cd96e8216ded144bb56b6829f98

    SHA256

    72acac576f13cfa761e4d2bb038a36d01fc634f1667f0698ebc04ec1e6e52fb6

    SHA512

    36be309288647fdf51d51f5018c9bea7e32b8079881916a393b5daa79f4e3747d628ad3731ec6b4bf997542367be3095d36ea069efbe1c028fdd020a3148c57a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b5843ea652a43d4dd5d1bde4f66d28c0

    SHA1

    fa566b2e330fb7fd6fed32dd95f7deb1556d27cd

    SHA256

    7597ebd1f16ffda8dd25622187aa90b081f0f28c2eba967c46221d1763443a62

    SHA512

    adaba5a5c6ed3db24d8883ad3412d86d8fe571539d0fd95425454b0bb1f61fe46c23543bab3a2b2842b5e99c7b10cbf4d7bc83b8431ac55c3378bb65cdafa994

  • C:\Users\Admin\AppData\Local\Temp\Cab60E7.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar6148.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Roaming\confuse\chargeable.exe

    Filesize

    117KB

    MD5

    b440cfded63fdd7cc852c5c2f95deb59

    SHA1

    30208727f42865946d1ab11b0c8b2b3269df717a

    SHA256

    b535aa9aec6438935ad894b8143d63e5cb69f168f906d70207f7de6415a01ecf

    SHA512

    561b0330b404bd8a2c156d4ed6c1b80a8cb7c9477d076e4fc43d50fa002d11c8b0f8b72b1953b79c7f5b5429cc945488613358502a8f4527960aac5e3b68f1c0

  • memory/2476-167-0x00000000740A0000-0x000000007464B000-memory.dmp

    Filesize

    5.7MB

  • memory/2476-169-0x00000000740A0000-0x000000007464B000-memory.dmp

    Filesize

    5.7MB

  • memory/2476-0-0x00000000740A1000-0x00000000740A2000-memory.dmp

    Filesize

    4KB

  • memory/2476-179-0x00000000740A0000-0x000000007464B000-memory.dmp

    Filesize

    5.7MB

  • memory/2476-9-0x00000000740A0000-0x000000007464B000-memory.dmp

    Filesize

    5.7MB

  • memory/2476-1-0x00000000740A0000-0x000000007464B000-memory.dmp

    Filesize

    5.7MB

  • memory/2828-343-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2828-345-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2828-346-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB