Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2023, 10:36
Behavioral task
behavioral1
Sample
a84f13afc66598bc51a2a5fa77633a67.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
a84f13afc66598bc51a2a5fa77633a67.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
a84f13afc66598bc51a2a5fa77633a67.exe
-
Size
37KB
-
MD5
a84f13afc66598bc51a2a5fa77633a67
-
SHA1
188de3787a2ef16e57062ab794920f9d3957e4f5
-
SHA256
d854634ea4a92c5775d1edaf805c7a754d45e8e568bcda853ddcbde2b891a8e3
-
SHA512
045bd70f7de1d604b3f5fee700658ffe8347b09e2437e16652c0f58078e33a148750a59f581b043fc190bb63e4a8217340f26e476a211b2d6aea741cba416d06
-
SSDEEP
384:i8KvEiTbHvpWNcZ0y8f7CTvvrdLkCwE3rAF+rMRTyN/0L+EcoinblneHQM3epzXg:dKXTZ38f7CTvpFwKrM+rMRa8NusTt
Malware Config
Extracted
njrat
im523
HacKed
6.tcp.eu.ngrok.io:11553
99c4d82f0922d38c6f975842331ad8f5
-
reg_key
99c4d82f0922d38c6f975842331ad8f5
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 504 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2256 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation a84f13afc66598bc51a2a5fa77633a67.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\99c4d82f0922d38c6f975842331ad8f5.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\99c4d82f0922d38c6f975842331ad8f5.exe server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\99c4d82f0922d38c6f975842331ad8f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\99c4d82f0922d38c6f975842331ad8f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 3808 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe 504 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 504 server.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 504 server.exe Token: SeDebugPrivilege 3808 taskkill.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe Token: 33 504 server.exe Token: SeIncBasePriorityPrivilege 504 server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1368 wrote to memory of 504 1368 a84f13afc66598bc51a2a5fa77633a67.exe 83 PID 1368 wrote to memory of 504 1368 a84f13afc66598bc51a2a5fa77633a67.exe 83 PID 1368 wrote to memory of 504 1368 a84f13afc66598bc51a2a5fa77633a67.exe 83 PID 504 wrote to memory of 2256 504 server.exe 86 PID 504 wrote to memory of 2256 504 server.exe 86 PID 504 wrote to memory of 2256 504 server.exe 86 PID 504 wrote to memory of 3808 504 server.exe 88 PID 504 wrote to memory of 3808 504 server.exe 88 PID 504 wrote to memory of 3808 504 server.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a84f13afc66598bc51a2a5fa77633a67.exe"C:\Users\Admin\AppData\Local\Temp\a84f13afc66598bc51a2a5fa77633a67.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2256
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5a84f13afc66598bc51a2a5fa77633a67
SHA1188de3787a2ef16e57062ab794920f9d3957e4f5
SHA256d854634ea4a92c5775d1edaf805c7a754d45e8e568bcda853ddcbde2b891a8e3
SHA512045bd70f7de1d604b3f5fee700658ffe8347b09e2437e16652c0f58078e33a148750a59f581b043fc190bb63e4a8217340f26e476a211b2d6aea741cba416d06
-
Filesize
37KB
MD5a84f13afc66598bc51a2a5fa77633a67
SHA1188de3787a2ef16e57062ab794920f9d3957e4f5
SHA256d854634ea4a92c5775d1edaf805c7a754d45e8e568bcda853ddcbde2b891a8e3
SHA512045bd70f7de1d604b3f5fee700658ffe8347b09e2437e16652c0f58078e33a148750a59f581b043fc190bb63e4a8217340f26e476a211b2d6aea741cba416d06