Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/02/2025, 14:17
250211-rl745awmbw 10Analysis
-
max time kernel
20s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2025, 14:17
Behavioral task
behavioral1
Sample
AJProxy.exe
Resource
win7-20241010-en
General
-
Target
AJProxy.exe
-
Size
638KB
-
MD5
6dbf1564024546cf0da4bf8f35936265
-
SHA1
ec7b401b5222590e9116d36fb454108a09c7d6a7
-
SHA256
af01b25f7db087fe50e3deebf5e55f8cdf9c3588d223471b4f71d9aa82fc92fd
-
SHA512
0a4194bbea2b895306a505ca7e27a22fd79589b3c8e6eeae3f747a184f720e87f586d77b5fb88ed24d1447b467f972873150db92f18139d0c5f3d278b304b72d
-
SSDEEP
12288:h32/lChV9mf/2QRXDD1yed0fsU4GSWaOvPESGj4s32xEdRCS:h3yChVA2Q9NXw2/wPOjdGxY
Malware Config
Signatures
-
Growtopia family
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/1144-1-0x0000000000F90000-0x0000000001036000-memory.dmp net_reactor -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 icanhazip.com -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJProxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5000 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1144 AJProxy.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1144 wrote to memory of 3688 1144 AJProxy.exe 89 PID 1144 wrote to memory of 3688 1144 AJProxy.exe 89 PID 1144 wrote to memory of 3688 1144 AJProxy.exe 89 PID 3688 wrote to memory of 5000 3688 cmd.exe 91 PID 3688 wrote to memory of 5000 3688 cmd.exe 91 PID 3688 wrote to memory of 5000 3688 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\AJProxy.exe"C:\Users\Admin\AppData\Local\Temp\AJProxy.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c timeout /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\AJProxy.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5000
-
-