Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 06:53
Behavioral task
behavioral1
Sample
f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe
Resource
win10v2004-20220812-en
General
-
Target
f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe
-
Size
29KB
-
MD5
2109d7f585d7ef8f87dd579ec8ae04c0
-
SHA1
684fd5e4ec10f7d9f5e580702ce898bfa0a01753
-
SHA256
f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2
-
SHA512
54001d62ba9baa8e03f6f37e99ac56a8c4612373e66b02b95f66ab2626ea8bd6ae9082bf49ce367ec0e93560a84ef2a70fd4ca769f53a605925b7e56b7d5b215
-
SSDEEP
768:1rD71oGc1FRVp74q8HesBKh0p29SgRpk:FD71IPkpZKhG29jpk
Malware Config
Extracted
njrat
0.6.4
HacKed
zahro2013.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1364 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1288 netsh.exe -
Loads dropped DLL 1 IoCs
pid Process 1776 f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe 1364 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1364 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1364 1776 f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe 27 PID 1776 wrote to memory of 1364 1776 f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe 27 PID 1776 wrote to memory of 1364 1776 f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe 27 PID 1776 wrote to memory of 1364 1776 f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe 27 PID 1364 wrote to memory of 1288 1364 Trojan.exe 28 PID 1364 wrote to memory of 1288 1364 Trojan.exe 28 PID 1364 wrote to memory of 1288 1364 Trojan.exe 28 PID 1364 wrote to memory of 1288 1364 Trojan.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe"C:\Users\Admin\AppData\Local\Temp\f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1288
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD52109d7f585d7ef8f87dd579ec8ae04c0
SHA1684fd5e4ec10f7d9f5e580702ce898bfa0a01753
SHA256f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2
SHA51254001d62ba9baa8e03f6f37e99ac56a8c4612373e66b02b95f66ab2626ea8bd6ae9082bf49ce367ec0e93560a84ef2a70fd4ca769f53a605925b7e56b7d5b215
-
Filesize
29KB
MD52109d7f585d7ef8f87dd579ec8ae04c0
SHA1684fd5e4ec10f7d9f5e580702ce898bfa0a01753
SHA256f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2
SHA51254001d62ba9baa8e03f6f37e99ac56a8c4612373e66b02b95f66ab2626ea8bd6ae9082bf49ce367ec0e93560a84ef2a70fd4ca769f53a605925b7e56b7d5b215
-
Filesize
29KB
MD52109d7f585d7ef8f87dd579ec8ae04c0
SHA1684fd5e4ec10f7d9f5e580702ce898bfa0a01753
SHA256f411781b00d4ae06f2efb6f47cae7a3af72adff3cc24abb42a4546749da18ce2
SHA51254001d62ba9baa8e03f6f37e99ac56a8c4612373e66b02b95f66ab2626ea8bd6ae9082bf49ce367ec0e93560a84ef2a70fd4ca769f53a605925b7e56b7d5b215