Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 05:00
Behavioral task
behavioral1
Sample
6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef.exe
Resource
win10v2004-20221111-en
General
-
Target
6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef.exe
-
Size
264KB
-
MD5
19403c2cd224dc7a4a97dfd7178a2956
-
SHA1
b764f2d45a2232c9fea85cd897eac7bc1893862a
-
SHA256
6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef
-
SHA512
16cea4e4111c3750d1572899d1993321de9608662c0e3092bfe4344339e78fc2a7d602d934cc32a30aac395ace982564afc08adf466ec9bf848d6fd762423eba
-
SSDEEP
6144:39547uj9LbZR2lGM9jyPgkGOmKSU9Oo2EL:34y9xTohTLE
Malware Config
Extracted
njrat
0.6.4
HacKed
naceurhackerz.no-ip.biz:5552
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4788 LocalHwLbneffYw.exe 3052 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 3252 netsh.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation LocalHwLbneffYw.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3052 Trojan.exe 3052 Trojan.exe 3052 Trojan.exe 3052 Trojan.exe 3052 Trojan.exe 3052 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3052 Trojan.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3800 wrote to memory of 4788 3800 6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef.exe 81 PID 3800 wrote to memory of 4788 3800 6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef.exe 81 PID 3800 wrote to memory of 4788 3800 6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef.exe 81 PID 4788 wrote to memory of 3052 4788 LocalHwLbneffYw.exe 83 PID 4788 wrote to memory of 3052 4788 LocalHwLbneffYw.exe 83 PID 4788 wrote to memory of 3052 4788 LocalHwLbneffYw.exe 83 PID 3052 wrote to memory of 3252 3052 Trojan.exe 84 PID 3052 wrote to memory of 3252 3052 Trojan.exe 84 PID 3052 wrote to memory of 3252 3052 Trojan.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef.exe"C:\Users\Admin\AppData\Local\Temp\6f7e51b74ffee64a15bfc6adbb2df5198b98941199f22795992e3727c2e1beef.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\LocalHwLbneffYw.exe"C:\Users\Admin\AppData\LocalHwLbneffYw.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:3252
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5d95890d8b39ece123cab2a757edbf6ca
SHA12ae55d38ac129af05a94c217a8cf05a8fb137087
SHA25630529640d9a167c5a20b6e5398c21eaa98469cceb32829d6a5df5e224a38cee0
SHA5121a609e483291c329798691c2152b966d4f959fca40e4dc28246d98e06c5099192e2319923b0e7827c343074bbd0facdec6d3d52edb4c68debee6f4c89b5d34db
-
Filesize
29KB
MD5d95890d8b39ece123cab2a757edbf6ca
SHA12ae55d38ac129af05a94c217a8cf05a8fb137087
SHA25630529640d9a167c5a20b6e5398c21eaa98469cceb32829d6a5df5e224a38cee0
SHA5121a609e483291c329798691c2152b966d4f959fca40e4dc28246d98e06c5099192e2319923b0e7827c343074bbd0facdec6d3d52edb4c68debee6f4c89b5d34db
-
Filesize
29KB
MD5d95890d8b39ece123cab2a757edbf6ca
SHA12ae55d38ac129af05a94c217a8cf05a8fb137087
SHA25630529640d9a167c5a20b6e5398c21eaa98469cceb32829d6a5df5e224a38cee0
SHA5121a609e483291c329798691c2152b966d4f959fca40e4dc28246d98e06c5099192e2319923b0e7827c343074bbd0facdec6d3d52edb4c68debee6f4c89b5d34db
-
Filesize
29KB
MD5d95890d8b39ece123cab2a757edbf6ca
SHA12ae55d38ac129af05a94c217a8cf05a8fb137087
SHA25630529640d9a167c5a20b6e5398c21eaa98469cceb32829d6a5df5e224a38cee0
SHA5121a609e483291c329798691c2152b966d4f959fca40e4dc28246d98e06c5099192e2319923b0e7827c343074bbd0facdec6d3d52edb4c68debee6f4c89b5d34db