Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2024, 20:08

General

  • Target

    Payload.exe

  • Size

    55KB

  • MD5

    29a02cd1fb2226905da5a34ac62595b9

  • SHA1

    a0c85edb2b9decb53291485acd64f36dbf5a6999

  • SHA256

    7aca902f9e7493dbf4f53a4cd3a4a9e5858eb825ef0141bf2e30150b416a070e

  • SHA512

    2e3000bdf30fe332f2923563a5266ada0201473fa999382aeced2cbb09951179ed2e7278314b97e1852dc8e300cd182632481f508f65b4aa629beecdb14993b3

  • SSDEEP

    1536:1KksDnHNwZ8Cam8LDdwsNMD2XExI3pmym:fsDn6SKiDdwsNMD2XExI3pm

Malware Config

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payload.exe
    "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2680-0-0x0000000074E71000-0x0000000074E72000-memory.dmp

    Filesize

    4KB

  • memory/2680-1-0x0000000074E70000-0x000000007541B000-memory.dmp

    Filesize

    5.7MB

  • memory/2680-2-0x0000000074E70000-0x000000007541B000-memory.dmp

    Filesize

    5.7MB

  • memory/2680-4-0x0000000074E70000-0x000000007541B000-memory.dmp

    Filesize

    5.7MB

  • memory/2680-5-0x0000000074E70000-0x000000007541B000-memory.dmp

    Filesize

    5.7MB

  • memory/2680-6-0x0000000074E70000-0x000000007541B000-memory.dmp

    Filesize

    5.7MB

  • memory/2680-7-0x0000000074E70000-0x000000007541B000-memory.dmp

    Filesize

    5.7MB