Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 20:58
Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20220901-en
General
-
Target
Server.exe
-
Size
29KB
-
MD5
f7d0b25c3115647720776246e58f066a
-
SHA1
7126e6a1e589245a84733375c25c598ad79c6d17
-
SHA256
9f45c1e83903345f6e2327b3efa04767549b5732a80d9a67374182c65f110660
-
SHA512
10c5188f4e583cea6e3c098de19db1a3a2fe7b3be14e5fc61e1c5d447f1b16333c174862b47a6cca41a5e7c2cb7067cc172b9e56bf6954c100f721210dcb8654
-
SSDEEP
768:aQv/27NYsDkfZPoIqlHepBKh0p29SgRru:Pm7N143wEKhG29jru
Malware Config
Extracted
njrat
0.6.4
hacked
niras.no-ip.org:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1376 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1636 netsh.exe -
Loads dropped DLL 1 IoCs
pid Process 1720 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe 1376 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1376 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1376 1720 Server.exe 27 PID 1720 wrote to memory of 1376 1720 Server.exe 27 PID 1720 wrote to memory of 1376 1720 Server.exe 27 PID 1720 wrote to memory of 1376 1720 Server.exe 27 PID 1376 wrote to memory of 1636 1376 Trojan.exe 28 PID 1376 wrote to memory of 1636 1376 Trojan.exe 28 PID 1376 wrote to memory of 1636 1376 Trojan.exe 28 PID 1376 wrote to memory of 1636 1376 Trojan.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1636
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5f7d0b25c3115647720776246e58f066a
SHA17126e6a1e589245a84733375c25c598ad79c6d17
SHA2569f45c1e83903345f6e2327b3efa04767549b5732a80d9a67374182c65f110660
SHA51210c5188f4e583cea6e3c098de19db1a3a2fe7b3be14e5fc61e1c5d447f1b16333c174862b47a6cca41a5e7c2cb7067cc172b9e56bf6954c100f721210dcb8654
-
Filesize
29KB
MD5f7d0b25c3115647720776246e58f066a
SHA17126e6a1e589245a84733375c25c598ad79c6d17
SHA2569f45c1e83903345f6e2327b3efa04767549b5732a80d9a67374182c65f110660
SHA51210c5188f4e583cea6e3c098de19db1a3a2fe7b3be14e5fc61e1c5d447f1b16333c174862b47a6cca41a5e7c2cb7067cc172b9e56bf6954c100f721210dcb8654
-
Filesize
29KB
MD5f7d0b25c3115647720776246e58f066a
SHA17126e6a1e589245a84733375c25c598ad79c6d17
SHA2569f45c1e83903345f6e2327b3efa04767549b5732a80d9a67374182c65f110660
SHA51210c5188f4e583cea6e3c098de19db1a3a2fe7b3be14e5fc61e1c5d447f1b16333c174862b47a6cca41a5e7c2cb7067cc172b9e56bf6954c100f721210dcb8654