Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:13

General

  • Target

    7c8b7f048ddf08182db2824fff38e73e.exe

  • Size

    65KB

  • MD5

    7c8b7f048ddf08182db2824fff38e73e

  • SHA1

    06426325c605afd5fa123d9c68d8c8af32ce6b56

  • SHA256

    7fcac21f046d9490d9b97aa9fbc30cd0a8d64348eb0911d1b90ebbbea15d87fa

  • SHA512

    8f98d7ad8ba08d1b136e3dd97fb19670c58fa79dad4a82eb293b24f2898b9c952a8247527a95e40a38418994f966d79d1c93521bf6bd69332fb91af9b5b02c33

  • SSDEEP

    1536:/vY8boN36tdQviFw1awamBnvbrfLteF3nLrB9z3nwaF9bt4S9vM:/vY8boN36tdQviFC19BnHfWl9zgaF9b+

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:9509

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c8b7f048ddf08182db2824fff38e73e.exe
    "C:\Users\Admin\AppData\Local\Temp\7c8b7f048ddf08182db2824fff38e73e.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\Client.exe
      "C:\Users\Admin\AppData\Local\Temp\Client.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2964
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\Client.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2836
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:668
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\Client.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:804
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1244
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\Client.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:376
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2876
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\Client.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2880
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2272
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\Client.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:940
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:888
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\Client.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3008
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\7c8b7f048ddf08182db2824fff38e73e.exe"
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Windows\SysWOW64\choice.exe
        choice /C Y /N /D Y /T 5
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1408
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {33B19CA2-3F97-4FC7-9A14-2302C080EEA0} S-1-5-21-677481364-2238709445-1347953534-1000:JXXXDSWS\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Local\Temp\Client.exe
      C:\Users\Admin\AppData\Local\Temp\Client.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2364
    • C:\Users\Admin\AppData\Local\Temp\Client.exe
      C:\Users\Admin\AppData\Local\Temp\Client.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Client.exe

    Filesize

    65KB

    MD5

    7c8b7f048ddf08182db2824fff38e73e

    SHA1

    06426325c605afd5fa123d9c68d8c8af32ce6b56

    SHA256

    7fcac21f046d9490d9b97aa9fbc30cd0a8d64348eb0911d1b90ebbbea15d87fa

    SHA512

    8f98d7ad8ba08d1b136e3dd97fb19670c58fa79dad4a82eb293b24f2898b9c952a8247527a95e40a38418994f966d79d1c93521bf6bd69332fb91af9b5b02c33

  • memory/1952-11-0x0000000077880000-0x0000000077A29000-memory.dmp

    Filesize

    1.7MB

  • memory/1952-12-0x0000000000D70000-0x0000000000D86000-memory.dmp

    Filesize

    88KB

  • memory/2380-0-0x0000000077880000-0x0000000077A29000-memory.dmp

    Filesize

    1.7MB

  • memory/2380-1-0x00000000008E0000-0x00000000008F6000-memory.dmp

    Filesize

    88KB