Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1801s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13/07/2023, 14:36
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win7-20230712-en
windows7-x64
8 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Payload.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
Payload.exe
-
Size
27KB
-
MD5
8ab054d88fcdce1bc76e2ae57464a09b
-
SHA1
9995afbba5a6b346fcfd66eee2f335130a1311c0
-
SHA256
7e0116704c18518cb8f6a60fb00aa9440e61c079701bf816b52c155c748eda48
-
SHA512
5944fb371c6d70b97c9325a057e1b741f00db8dfbf43f3366c1cdf13c7f9fd8acda67f77e329394444f8fe4d6a45eae55bb77084d869eba8c33940cd3cf591ce
-
SSDEEP
384:qLLQKJ3buZjmgERA40DwoyumGPiJRjMFAQk93vmhm7UMKmIEecKdbXTzm9bVhcag:0MK5buQE40fLFA/vMHTi9bD
Score
10/10
Malware Config
Extracted
Family
njrat
Version
v2.0
Botnet
Victim
C2
147.185.221.181:51752
Mutex
Windows
Attributes
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Payload.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Payload.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe attrib.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Payload.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2096 Payload.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe Token: SeIncBasePriorityPrivilege 2096 Payload.exe Token: 33 2096 Payload.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2932 2096 Payload.exe 28 PID 2096 wrote to memory of 2932 2096 Payload.exe 28 PID 2096 wrote to memory of 2932 2096 Payload.exe 28 PID 2096 wrote to memory of 2932 2096 Payload.exe 28 PID 2096 wrote to memory of 2936 2096 Payload.exe 29 PID 2096 wrote to memory of 2936 2096 Payload.exe 29 PID 2096 wrote to memory of 2936 2096 Payload.exe 29 PID 2096 wrote to memory of 2936 2096 Payload.exe 29 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2932 attrib.exe 2936 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"2⤵
- Drops startup file
- Views/modifies file attributes
PID:2932
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"2⤵
- Views/modifies file attributes
PID:2936
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD58ab054d88fcdce1bc76e2ae57464a09b
SHA19995afbba5a6b346fcfd66eee2f335130a1311c0
SHA2567e0116704c18518cb8f6a60fb00aa9440e61c079701bf816b52c155c748eda48
SHA5125944fb371c6d70b97c9325a057e1b741f00db8dfbf43f3366c1cdf13c7f9fd8acda67f77e329394444f8fe4d6a45eae55bb77084d869eba8c33940cd3cf591ce
-
Filesize
27KB
MD58ab054d88fcdce1bc76e2ae57464a09b
SHA19995afbba5a6b346fcfd66eee2f335130a1311c0
SHA2567e0116704c18518cb8f6a60fb00aa9440e61c079701bf816b52c155c748eda48
SHA5125944fb371c6d70b97c9325a057e1b741f00db8dfbf43f3366c1cdf13c7f9fd8acda67f77e329394444f8fe4d6a45eae55bb77084d869eba8c33940cd3cf591ce