Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/01/2025, 08:19 UTC

General

  • Target

    dayum.exe

  • Size

    23KB

  • MD5

    aa6a3fbb8d78e21710da58d6e7b87f86

  • SHA1

    09c8e4815c16a732d9842ef97fda4e347ad0ee27

  • SHA256

    9af4cf4b24bdb010ba408a9c9b3f26e0c52dd6d6dd3c0a9bd12180dd9028210a

  • SHA512

    724a7d8799acf7680ce0ea65e3902a0650aa9f2c635013d1e86a0dbd2ccba6ece5ab7981c8c71b4510d0cfa5a2e3160a722c2aa584f488e181f5f5cbd9479bb6

  • SSDEEP

    384:6cqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZzcr:930py6vhxaRpcnuWC

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

89.156.24.108:1738

Mutex

af0aa29f43924811e1101d2b844fbfd3

Attributes
  • reg_key

    af0aa29f43924811e1101d2b844fbfd3

  • splitter

    |'|'|

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dayum.exe
    "C:\Users\Admin\AppData\Local\Temp\dayum.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2844

Network

    No results found
  • 89.156.24.108:1738
    server.exe
    152 B
    3
  • 89.156.24.108:1738
    server.exe
    152 B
    3
  • 89.156.24.108:1738
    server.exe
    152 B
    3
  • 89.156.24.108:1738
    server.exe
    152 B
    3
  • 89.156.24.108:1738
    server.exe
    152 B
    3
  • 89.156.24.108:1738
    server.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\server.exe

    Filesize

    23KB

    MD5

    aa6a3fbb8d78e21710da58d6e7b87f86

    SHA1

    09c8e4815c16a732d9842ef97fda4e347ad0ee27

    SHA256

    9af4cf4b24bdb010ba408a9c9b3f26e0c52dd6d6dd3c0a9bd12180dd9028210a

    SHA512

    724a7d8799acf7680ce0ea65e3902a0650aa9f2c635013d1e86a0dbd2ccba6ece5ab7981c8c71b4510d0cfa5a2e3160a722c2aa584f488e181f5f5cbd9479bb6

  • memory/1804-0-0x0000000074BC1000-0x0000000074BC2000-memory.dmp

    Filesize

    4KB

  • memory/1804-1-0x0000000074BC0000-0x000000007516B000-memory.dmp

    Filesize

    5.7MB

  • memory/1804-2-0x0000000074BC0000-0x000000007516B000-memory.dmp

    Filesize

    5.7MB

  • memory/1804-11-0x0000000074BC0000-0x000000007516B000-memory.dmp

    Filesize

    5.7MB

  • memory/2540-10-0x0000000074BC0000-0x000000007516B000-memory.dmp

    Filesize

    5.7MB

  • memory/2540-13-0x0000000074BC0000-0x000000007516B000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.