Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 12:56
Behavioral task
behavioral1
Sample
3e90f4aa1725740f32d8c6a7c7ed77db.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
3e90f4aa1725740f32d8c6a7c7ed77db.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
3e90f4aa1725740f32d8c6a7c7ed77db.exe
-
Size
37KB
-
MD5
3e90f4aa1725740f32d8c6a7c7ed77db
-
SHA1
a42f5985580e647dbd491d2b7e1f54bdd967883f
-
SHA256
1ade6c3079bf4457f862540f2f378e1758111482c207da32d3fecae5f1f9e275
-
SHA512
64b1f0322bb07e854ff5d50527462519bc2bde05b582b62e809c5e0d80f3e3a1dba9808902ca4abaf7299614de5fd06028026594dc20e0d28d554f26b6d715ec
-
SSDEEP
384:WcmBkiy1nDNGRn5IyUv8IR/hh0/aKVEcrAF+rMRTyN/0L+EcoinblneHQM3epzXi:Jd5M5jUvxRoCKWcrM+rMRa8Nuzd+t
Malware Config
Extracted
njrat
im523
HacKed
37.144.68.25:8080
1bca132747fbbbf8717bb4a20e6daa6d
-
reg_key
1bca132747fbbbf8717bb4a20e6daa6d
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 372 dllhost.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1424 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 3e90f4aa1725740f32d8c6a7c7ed77db.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1bca132747fbbbf8717bb4a20e6daa6d = "\"C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe\" .." dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1bca132747fbbbf8717bb4a20e6daa6d = "\"C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe\" .." dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 372 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe Token: 33 372 dllhost.exe Token: SeIncBasePriorityPrivilege 372 dllhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4956 wrote to memory of 372 4956 3e90f4aa1725740f32d8c6a7c7ed77db.exe 85 PID 4956 wrote to memory of 372 4956 3e90f4aa1725740f32d8c6a7c7ed77db.exe 85 PID 4956 wrote to memory of 372 4956 3e90f4aa1725740f32d8c6a7c7ed77db.exe 85 PID 372 wrote to memory of 1424 372 dllhost.exe 89 PID 372 wrote to memory of 1424 372 dllhost.exe 89 PID 372 wrote to memory of 1424 372 dllhost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e90f4aa1725740f32d8c6a7c7ed77db.exe"C:\Users\Admin\AppData\Local\Temp\3e90f4aa1725740f32d8c6a7c7ed77db.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Roaming\dllhost.exe"C:\Users\Admin\AppData\Roaming\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\dllhost.exe" "dllhost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1424
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD53e90f4aa1725740f32d8c6a7c7ed77db
SHA1a42f5985580e647dbd491d2b7e1f54bdd967883f
SHA2561ade6c3079bf4457f862540f2f378e1758111482c207da32d3fecae5f1f9e275
SHA51264b1f0322bb07e854ff5d50527462519bc2bde05b582b62e809c5e0d80f3e3a1dba9808902ca4abaf7299614de5fd06028026594dc20e0d28d554f26b6d715ec
-
Filesize
37KB
MD53e90f4aa1725740f32d8c6a7c7ed77db
SHA1a42f5985580e647dbd491d2b7e1f54bdd967883f
SHA2561ade6c3079bf4457f862540f2f378e1758111482c207da32d3fecae5f1f9e275
SHA51264b1f0322bb07e854ff5d50527462519bc2bde05b582b62e809c5e0d80f3e3a1dba9808902ca4abaf7299614de5fd06028026594dc20e0d28d554f26b6d715ec