Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    116s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2025, 10:22

General

  • Target

    5086e1530caa10af3e26539b10a107047f70901625962000f66373417ad3637fN.exe

  • Size

    237KB

  • MD5

    284078d25010e8a2f1bf524cf8bdae00

  • SHA1

    57d3c47af3b14bb08bcca7231257ee231e9114b1

  • SHA256

    5086e1530caa10af3e26539b10a107047f70901625962000f66373417ad3637f

  • SHA512

    3534ba34461b6d6d43b4d04cb4084fc0bc8ab4d621fe157d9ae60e0a1efbc97b7303acce88c26aaefb48a6e631055dadd0a8a328708dc04dee405d724354cf9f

  • SSDEEP

    3072:F/ItRZp06PJHbIxs+VGSYzlg+lAMSpBV4W/E+z1IQwqznHpYQ5czMWDBoWkb7RKO:zs+V7s6+l+yWD+QwqzHqQk27PJE

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

payment-rivers.gl.at.ply.gg:15267

Mutex

392725c4d836f07a62148783f8b913f2

Attributes
  • reg_key

    392725c4d836f07a62148783f8b913f2

  • splitter

    |'|'|

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5086e1530caa10af3e26539b10a107047f70901625962000f66373417ad3637fN.exe
    "C:\Users\Admin\AppData\Local\Temp\5086e1530caa10af3e26539b10a107047f70901625962000f66373417ad3637fN.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Host.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Host.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\system32\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Microsoft Host.exe" "Microsoft Host.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Microsoft Host.exe

    Filesize

    237KB

    MD5

    284078d25010e8a2f1bf524cf8bdae00

    SHA1

    57d3c47af3b14bb08bcca7231257ee231e9114b1

    SHA256

    5086e1530caa10af3e26539b10a107047f70901625962000f66373417ad3637f

    SHA512

    3534ba34461b6d6d43b4d04cb4084fc0bc8ab4d621fe157d9ae60e0a1efbc97b7303acce88c26aaefb48a6e631055dadd0a8a328708dc04dee405d724354cf9f

  • memory/2444-24-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-27-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-34-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-33-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-32-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-31-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-30-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-29-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-28-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-26-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-20-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-22-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-18-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-19-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-0-0x000007FEF56CE000-0x000007FEF56CF000-memory.dmp

    Filesize

    4KB

  • memory/2612-1-0x0000000000540000-0x0000000000550000-memory.dmp

    Filesize

    64KB

  • memory/2612-2-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-23-0x000007FEF56CE000-0x000007FEF56CF000-memory.dmp

    Filesize

    4KB

  • memory/2612-9-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-25-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-10-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-8-0x0000000000550000-0x000000000055E000-memory.dmp

    Filesize

    56KB

  • memory/2612-21-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-13-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-12-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-5-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-7-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-6-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-4-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2612-3-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

    Filesize

    9.6MB