Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2024, 01:07 UTC

General

  • Target

    a3c7eabd9cfb545adb2731670d97fe9ec7d8afe29db7f7a31827bdc13e0e4a85.exe

  • Size

    42KB

  • MD5

    25a9a70e860bdd43873f8423b2573785

  • SHA1

    0eea71569c308368f8f424ef48b67da8a352a7ba

  • SHA256

    a3c7eabd9cfb545adb2731670d97fe9ec7d8afe29db7f7a31827bdc13e0e4a85

  • SHA512

    cc8228c6c78db64286132c90cac8148eee2a4c534bb50cf89e02a1909f8ef389dc5c196f739225d221593a2407dc28889074411939f337cdf27e9763e13cd3db

  • SSDEEP

    768:zb6BvdySY94ns6gWLr+naiEeOnhpP7MnpVICSGLRUaN4FOdTCcUgKw:zb6BFU94rGLohpPQnLILGLR74uCcUgK

Malware Config

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3c7eabd9cfb545adb2731670d97fe9ec7d8afe29db7f7a31827bdc13e0e4a85.exe
    "C:\Users\Admin\AppData\Local\Temp\a3c7eabd9cfb545adb2731670d97fe9ec7d8afe29db7f7a31827bdc13e0e4a85.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3932
    • C:\Users\Admin\AppData\Local\Temp\msgedge.exe
      "C:\Users\Admin\AppData\Local\Temp\msgedge.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\msgedge.exe" "msgedge.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:824

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    165.131.228.49.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    165.131.228.49.in-addr.arpa
    IN PTR
    Response
    165.131.228.49.in-addr.arpa
    IN PTR
    49-228-131-024ddns tls1a-bbj myaisfibrecom
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    92.16.208.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    92.16.208.104.in-addr.arpa
    IN PTR
    Response
  • 49.228.131.165:2424
    msgedge.exe
    822 B
    408 B
    10
    10
  • 49.228.131.165:2424
    msgedge.exe
    822 B
    408 B
    10
    10
  • 49.228.131.165:2424
    msgedge.exe
    684 B
    328 B
    7
    8
  • 49.228.131.165:2424
    msgedge.exe
    1.1kB
    908 B
    17
    22
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    165.131.228.49.in-addr.arpa
    dns
    73 B
    132 B
    1
    1

    DNS Request

    165.131.228.49.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    92.16.208.104.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    92.16.208.104.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\msgedge.exe

    Filesize

    42KB

    MD5

    25a9a70e860bdd43873f8423b2573785

    SHA1

    0eea71569c308368f8f424ef48b67da8a352a7ba

    SHA256

    a3c7eabd9cfb545adb2731670d97fe9ec7d8afe29db7f7a31827bdc13e0e4a85

    SHA512

    cc8228c6c78db64286132c90cac8148eee2a4c534bb50cf89e02a1909f8ef389dc5c196f739225d221593a2407dc28889074411939f337cdf27e9763e13cd3db

  • memory/3932-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

    Filesize

    4KB

  • memory/3932-1-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

    Filesize

    64KB

  • memory/3932-2-0x00000000030C0000-0x00000000030D6000-memory.dmp

    Filesize

    88KB

  • memory/3932-3-0x0000000007C60000-0x0000000007CFC000-memory.dmp

    Filesize

    624KB

  • memory/3932-4-0x00000000082B0000-0x0000000008854000-memory.dmp

    Filesize

    5.6MB

  • memory/3932-5-0x0000000005720000-0x0000000005726000-memory.dmp

    Filesize

    24KB

  • memory/3932-17-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

    Filesize

    4KB

  • memory/4928-16-0x0000000074D00000-0x00000000754B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4928-15-0x00000000028D0000-0x00000000028E6000-memory.dmp

    Filesize

    88KB

  • memory/4928-19-0x0000000005210000-0x00000000052A2000-memory.dmp

    Filesize

    584KB

  • memory/4928-20-0x0000000074D00000-0x00000000754B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4928-21-0x00000000051D0000-0x00000000051DA000-memory.dmp

    Filesize

    40KB

  • memory/4928-22-0x0000000005430000-0x0000000005496000-memory.dmp

    Filesize

    408KB

  • memory/4928-23-0x0000000005D80000-0x0000000005D98000-memory.dmp

    Filesize

    96KB

  • memory/4928-24-0x0000000074D00000-0x00000000754B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4928-25-0x0000000074D00000-0x00000000754B0000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.