Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4011c945eab342dfa34f753fb98a8903
-
Size
65KB
-
Sample
240104-gm2zdshhek
-
MD5
4011c945eab342dfa34f753fb98a8903
-
SHA1
abdf5d45451977d0aa451b34947de4459fe01c2e
-
SHA256
af5fd63b145516de0fe79e709e30099e24f5099d0415c5ecff07b94e5f03ae7b
-
SHA512
fada3b5a3370ac17194f9646e933c4c00735ba5ec30ae6abc7546bcc506d4ddc8474155add6ab6b4faf4963080d51791ecb25c05a677b3c042fa7b980dbc609a
-
SSDEEP
1536:sEikUQ5Ke31oeYUnqmc/5arJpG96UzodEtp6ARiOm6Ozx:sE5rl/Nq9QIz8A8OmRx
Static task
static1
Behavioral task
behavioral1
Sample
4011c945eab342dfa34f753fb98a8903.exe
Resource
win7-20231215-en
Malware Config
Extracted
njrat
0.7d
⋘A♆A⋙
hakim32.ddns.net:2000
a5b3fa3acb0104014f92c69f9ef455a8
-
reg_key
a5b3fa3acb0104014f92c69f9ef455a8
-
splitter
|'|'|
Targets
-
-
Target
4011c945eab342dfa34f753fb98a8903
-
Size
65KB
-
MD5
4011c945eab342dfa34f753fb98a8903
-
SHA1
abdf5d45451977d0aa451b34947de4459fe01c2e
-
SHA256
af5fd63b145516de0fe79e709e30099e24f5099d0415c5ecff07b94e5f03ae7b
-
SHA512
fada3b5a3370ac17194f9646e933c4c00735ba5ec30ae6abc7546bcc506d4ddc8474155add6ab6b4faf4963080d51791ecb25c05a677b3c042fa7b980dbc609a
-
SSDEEP
1536:sEikUQ5Ke31oeYUnqmc/5arJpG96UzodEtp6ARiOm6Ozx:sE5rl/Nq9QIz8A8OmRx
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1