Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2024, 02:33 UTC

General

  • Target

    dcf024f3359c3a752e582c5a6a2efdb0748aa87f8ef168f623f4140b184d320fN.exe

  • Size

    31KB

  • MD5

    d1fff5d5b5661647fd95a87e497fbd10

  • SHA1

    68563815edb3943b69e446dc0643cc39059819b5

  • SHA256

    dcf024f3359c3a752e582c5a6a2efdb0748aa87f8ef168f623f4140b184d320f

  • SHA512

    c9d8bb48d934fcbe8a3e95e9e02e188f0c372e549816297b86d3f05d284c2dc443bded37fb5176fc585f5e42ffb56475737d6a961f59d7646ac16e98ca4bd63c

  • SSDEEP

    768:zDMXZwpJbb2zxxO5oaqHhisfvagQmIDUu0tiicj:UkKZisrQVkaj

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

192.168.199.2:6522

Mutex

266d34e804b5bdc8c81bfaefe4d0b785

Attributes
  • reg_key

    266d34e804b5bdc8c81bfaefe4d0b785

  • splitter

    Y262SUCZ4UJJ

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcf024f3359c3a752e582c5a6a2efdb0748aa87f8ef168f623f4140b184d320fN.exe
    "C:\Users\Admin\AppData\Local\Temp\dcf024f3359c3a752e582c5a6a2efdb0748aa87f8ef168f623f4140b184d320fN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2852

Network

    No results found
  • 192.168.199.2:6522
    WindowsServices.exe
    152 B
    3
  • 192.168.199.2:6522
    WindowsServices.exe
    152 B
    3
  • 192.168.199.2:6522
    WindowsServices.exe
    152 B
    3
  • 192.168.199.2:6522
    WindowsServices.exe
    152 B
    3
  • 192.168.199.2:6522
    WindowsServices.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\WindowsServices.exe

    Filesize

    31KB

    MD5

    d1fff5d5b5661647fd95a87e497fbd10

    SHA1

    68563815edb3943b69e446dc0643cc39059819b5

    SHA256

    dcf024f3359c3a752e582c5a6a2efdb0748aa87f8ef168f623f4140b184d320f

    SHA512

    c9d8bb48d934fcbe8a3e95e9e02e188f0c372e549816297b86d3f05d284c2dc443bded37fb5176fc585f5e42ffb56475737d6a961f59d7646ac16e98ca4bd63c

  • memory/2012-0-0x00000000748C1000-0x00000000748C2000-memory.dmp

    Filesize

    4KB

  • memory/2012-1-0x00000000748C0000-0x0000000074E6B000-memory.dmp

    Filesize

    5.7MB

  • memory/2012-2-0x00000000748C0000-0x0000000074E6B000-memory.dmp

    Filesize

    5.7MB

  • memory/2012-10-0x00000000748C0000-0x0000000074E6B000-memory.dmp

    Filesize

    5.7MB

  • memory/2328-11-0x00000000748C0000-0x0000000074E6B000-memory.dmp

    Filesize

    5.7MB

  • memory/2328-12-0x00000000748C0000-0x0000000074E6B000-memory.dmp

    Filesize

    5.7MB

  • memory/2328-14-0x00000000748C0000-0x0000000074E6B000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.