Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
194s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 10:42
Behavioral task
behavioral1
Sample
716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe
Resource
win10v2004-20220812-en
General
-
Target
716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe
-
Size
23KB
-
MD5
0d4530f3d79ac68215858c445326f2e5
-
SHA1
39a65a53d21b8b9d5df30888900c8a8484acac5a
-
SHA256
716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692
-
SHA512
60c90d547fae29556badbddef8ffeb6c68e2fcc841be9c406bbe6bcb25452183f3dcee176a42591494b06539129590708a6582243951523ac43dec55ad9bf4bc
-
SSDEEP
384:tcqbCK0l4h7o9SVyDGvENxh461gJkOmMSW38mRvR6JZlbw8hqIusZzZNv:+30py6vYxaRpcnu6
Malware Config
Extracted
njrat
0.7d
SAM
samhkr13.ddns.net:5552
b5b7c5b511866ccc1b4ee34756a8ec79
-
reg_key
b5b7c5b511866ccc1b4ee34756a8ec79
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1772 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1408 netsh.exe -
Loads dropped DLL 1 IoCs
pid Process 1768 716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\b5b7c5b511866ccc1b4ee34756a8ec79 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b5b7c5b511866ccc1b4ee34756a8ec79 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1772 server.exe Token: 33 1772 server.exe Token: SeIncBasePriorityPrivilege 1772 server.exe Token: 33 1772 server.exe Token: SeIncBasePriorityPrivilege 1772 server.exe Token: 33 1772 server.exe Token: SeIncBasePriorityPrivilege 1772 server.exe Token: 33 1772 server.exe Token: SeIncBasePriorityPrivilege 1772 server.exe Token: 33 1772 server.exe Token: SeIncBasePriorityPrivilege 1772 server.exe Token: 33 1772 server.exe Token: SeIncBasePriorityPrivilege 1772 server.exe Token: 33 1772 server.exe Token: SeIncBasePriorityPrivilege 1772 server.exe Token: 33 1772 server.exe Token: SeIncBasePriorityPrivilege 1772 server.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1772 1768 716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe 28 PID 1768 wrote to memory of 1772 1768 716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe 28 PID 1768 wrote to memory of 1772 1768 716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe 28 PID 1768 wrote to memory of 1772 1768 716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe 28 PID 1772 wrote to memory of 1408 1772 server.exe 29 PID 1772 wrote to memory of 1408 1772 server.exe 29 PID 1772 wrote to memory of 1408 1772 server.exe 29 PID 1772 wrote to memory of 1408 1772 server.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe"C:\Users\Admin\AppData\Local\Temp\716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1408
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD50d4530f3d79ac68215858c445326f2e5
SHA139a65a53d21b8b9d5df30888900c8a8484acac5a
SHA256716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692
SHA51260c90d547fae29556badbddef8ffeb6c68e2fcc841be9c406bbe6bcb25452183f3dcee176a42591494b06539129590708a6582243951523ac43dec55ad9bf4bc
-
Filesize
23KB
MD50d4530f3d79ac68215858c445326f2e5
SHA139a65a53d21b8b9d5df30888900c8a8484acac5a
SHA256716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692
SHA51260c90d547fae29556badbddef8ffeb6c68e2fcc841be9c406bbe6bcb25452183f3dcee176a42591494b06539129590708a6582243951523ac43dec55ad9bf4bc
-
Filesize
23KB
MD50d4530f3d79ac68215858c445326f2e5
SHA139a65a53d21b8b9d5df30888900c8a8484acac5a
SHA256716ccff99841ebfadb22084138249b9a99f368d0ca123ab413cab5108468e692
SHA51260c90d547fae29556badbddef8ffeb6c68e2fcc841be9c406bbe6bcb25452183f3dcee176a42591494b06539129590708a6582243951523ac43dec55ad9bf4bc