Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

New Project 1.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24/01/2025, 20:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Project 1.exe

  • Size

    25.8MB

  • MD5

    62790fdc3f6c5f9f39ff7ebda6f39dbc

  • SHA1

    83c77e11d19a2a9112aa6e0949b1fce818626116

  • SHA256

    413a21a22075b24b4d3874c42b7d558ab874b9155b4f9a2ae164737fb0d4c0ff

  • SHA512

    842930b471b88be82fe535666517e4b39b73e12f7fc0bead3abfe6a791fdcf2e45f5766b7af8c2341e41f9413314bd3d72d79af67c894e5d52d72abb28f3804d

  • SSDEEP

    393216:i05l6ltjvQ9zsDsxDWXHuiqYZH1nhrpSW0i3RhKNku8E+:+lt7QxxDW+jYvhWy678E

Score
10/10
njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Project 1.exe
    "C:\Users\Admin\AppData\Local\Temp\New Project 1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe
      "C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Windows\system32\attrib.exe
        attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
        3⤵
        • Views/modifies file attributes
        PID:716
    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3952
    • C:\Users\Admin\AppData\Local\Temp\Lammer.exe
      "C:\Users\Admin\AppData\Local\Temp\Lammer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\ProgramData\Windows Session Manager.exe
        "C:\ProgramData\Windows Session Manager.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3436
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\ProgramData\Windows Session Manager.exe" "Windows Session Manager.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Lammer.exe
    Filesize

    23KB

    MD5

    b9f38f2155893e8bf7dc7bc228071ad9

    SHA1

    bc0e543367083e74259e8c0dcbf44b69b9796509

    SHA256

    a04ccff48b9983e37e657d467a413f883021e32beb03baaa9c43516f0e6b6d05

    SHA512

    e89df5d50ab4d1a22dce7308efec88da2f6b5e85ae9aeab788cdbca23158cc042a011fa9e51ba5322796abbd19b9d545f4671f482a5e38e19be2a865219143eb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
    Filesize

    14.6MB

    MD5

    df0950532119769bcd0aced1faaabbc7

    SHA1

    0ac1d43bcadc03b871234649338707981083a376

    SHA256

    1825d2387cd90678f54ad6a50a484f3b6854c99e2909e2ef3efa73b2f521821b

    SHA512

    43cf4f51c3c94bf4c323f82d949b1bb1ce8f6271696177b191799be6b0e44b7e9f77991578c842a2c7c938a707bbe99de09db29b54e2488eb1bc22b007e33dba

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe
    Filesize

    2.6MB

    MD5

    7145358dc4b4908c33481df669f6a0f4

    SHA1

    87f13e788bd0bc105f1a9e992166ac819488d9c5

    SHA256

    d1035e2bc6fe5b8450d60f6c45c4d9479a014cec0f15cfd00a23a65a5e10634a

    SHA512

    164c6506b0df97877e15f1b2a668f06521b510817575d9c6df716bdf51e6deac20e2c78eb4ca1f42f4337aec7b747f7ebbcc5d7821a3ce92ac68aca8bd0c184a

    Download Submit

  • C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
    Filesize

    2KB

    MD5

    9758656bbe8589c66bb241b052490c72

    SHA1

    b73da83fb3ae6b86c6365769a04de9845d5c602c

    SHA256

    e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

    SHA512

    da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

    Download Submit

  • memory/1252-0-0x0000000000400000-0x0000000001DCD000-memory.dmp

    Filesize

    25.8MB

    Download