Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2024, 19:05

General

  • Target

    Payload.exe

  • Size

    55KB

  • MD5

    843cc097164266c5c152f19a41fc5be9

  • SHA1

    21cda33595dff7a078f2a9c57ddeebc798cb18a3

  • SHA256

    3a769894ceb07a4c0e334562acc0d1c3e1523afee2b74bb8f0e794099889b379

  • SHA512

    0130baf712d324b65fd60ca83a6e9931ff13c1a520cc40e77ac7222da3939cd258e314a06f8294a85c6f9c693ed79231649752bf1abf8d1e5db14e39632ed915

  • SSDEEP

    1536:BWoADn8fLNG/SbrKDD3wsNMDbXExI3pm4Nm:zADncsqbeDD3wsNMDbXExI3pm

Score
10/10

Malware Config

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payload.exe
    "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2460
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2460-0-0x0000000074D01000-0x0000000074D02000-memory.dmp

    Filesize

    4KB

  • memory/2460-1-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2460-2-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2460-3-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2460-4-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2460-5-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2460-6-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2560-7-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

  • memory/2560-8-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

  • memory/2560-9-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

  • memory/2560-10-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB