Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/01/2023, 05:56
Behavioral task
behavioral1
Sample
b8f529f21da8c2911d16d1f449e032b9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b8f529f21da8c2911d16d1f449e032b9.exe
Resource
win10v2004-20220812-en
General
-
Target
b8f529f21da8c2911d16d1f449e032b9.exe
-
Size
37KB
-
MD5
b8f529f21da8c2911d16d1f449e032b9
-
SHA1
001e8f2ac0d2564d7705968963e96066094b1df5
-
SHA256
88e3bab355b6b571d1a5d1da2b80d8e1d5f769f39f0b9d2189a6e432eaa031b1
-
SHA512
0b727c878743ba7fdac95c30033b705e45966734a14c63959a78a09429f8cd72cd32d09ed89b8fb2fe0fe84cd75680a1a498c07bdd752bf53412e8ba9d62b350
-
SSDEEP
768:1IPrJ/cPFon04M9udrM+rMRa8Nuf1btQ:1orJ0NoxMoG+gRJN41
Malware Config
Extracted
njrat
im523
Dibil
7.tcp.eu.ngrok.io:16592
ed673d626997c5d6f8f983c3110e8aab
-
reg_key
ed673d626997c5d6f8f983c3110e8aab
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2036 Realtek HD Audio Universal Windows.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 524 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ed673d626997c5d6f8f983c3110e8aab.exe Realtek HD Audio Universal Windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ed673d626997c5d6f8f983c3110e8aab.exe Realtek HD Audio Universal Windows.exe -
Loads dropped DLL 1 IoCs
pid Process 1292 b8f529f21da8c2911d16d1f449e032b9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ed673d626997c5d6f8f983c3110e8aab = "\"C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Windows.exe\" .." Realtek HD Audio Universal Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ed673d626997c5d6f8f983c3110e8aab = "\"C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Windows.exe\" .." Realtek HD Audio Universal Windows.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf Realtek HD Audio Universal Windows.exe File created D:\autorun.inf Realtek HD Audio Universal Windows.exe File created C:\autorun.inf Realtek HD Audio Universal Windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe 2036 Realtek HD Audio Universal Windows.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2036 Realtek HD Audio Universal Windows.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 2036 Realtek HD Audio Universal Windows.exe Token: 33 2036 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 2036 Realtek HD Audio Universal Windows.exe Token: 33 2036 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 2036 Realtek HD Audio Universal Windows.exe Token: 33 2036 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 2036 Realtek HD Audio Universal Windows.exe Token: 33 2036 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 2036 Realtek HD Audio Universal Windows.exe Token: 33 2036 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 2036 Realtek HD Audio Universal Windows.exe Token: 33 2036 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 2036 Realtek HD Audio Universal Windows.exe Token: 33 2036 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 2036 Realtek HD Audio Universal Windows.exe Token: 33 2036 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 2036 Realtek HD Audio Universal Windows.exe Token: 33 2036 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 2036 Realtek HD Audio Universal Windows.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2036 1292 b8f529f21da8c2911d16d1f449e032b9.exe 27 PID 1292 wrote to memory of 2036 1292 b8f529f21da8c2911d16d1f449e032b9.exe 27 PID 1292 wrote to memory of 2036 1292 b8f529f21da8c2911d16d1f449e032b9.exe 27 PID 1292 wrote to memory of 2036 1292 b8f529f21da8c2911d16d1f449e032b9.exe 27 PID 2036 wrote to memory of 524 2036 Realtek HD Audio Universal Windows.exe 28 PID 2036 wrote to memory of 524 2036 Realtek HD Audio Universal Windows.exe 28 PID 2036 wrote to memory of 524 2036 Realtek HD Audio Universal Windows.exe 28 PID 2036 wrote to memory of 524 2036 Realtek HD Audio Universal Windows.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8f529f21da8c2911d16d1f449e032b9.exe"C:\Users\Admin\AppData\Local\Temp\b8f529f21da8c2911d16d1f449e032b9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe"C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe" "Realtek HD Audio Universal Windows.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:524
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5b8f529f21da8c2911d16d1f449e032b9
SHA1001e8f2ac0d2564d7705968963e96066094b1df5
SHA25688e3bab355b6b571d1a5d1da2b80d8e1d5f769f39f0b9d2189a6e432eaa031b1
SHA5120b727c878743ba7fdac95c30033b705e45966734a14c63959a78a09429f8cd72cd32d09ed89b8fb2fe0fe84cd75680a1a498c07bdd752bf53412e8ba9d62b350
-
Filesize
37KB
MD5b8f529f21da8c2911d16d1f449e032b9
SHA1001e8f2ac0d2564d7705968963e96066094b1df5
SHA25688e3bab355b6b571d1a5d1da2b80d8e1d5f769f39f0b9d2189a6e432eaa031b1
SHA5120b727c878743ba7fdac95c30033b705e45966734a14c63959a78a09429f8cd72cd32d09ed89b8fb2fe0fe84cd75680a1a498c07bdd752bf53412e8ba9d62b350
-
Filesize
37KB
MD5b8f529f21da8c2911d16d1f449e032b9
SHA1001e8f2ac0d2564d7705968963e96066094b1df5
SHA25688e3bab355b6b571d1a5d1da2b80d8e1d5f769f39f0b9d2189a6e432eaa031b1
SHA5120b727c878743ba7fdac95c30033b705e45966734a14c63959a78a09429f8cd72cd32d09ed89b8fb2fe0fe84cd75680a1a498c07bdd752bf53412e8ba9d62b350