Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17/01/2024, 18:22
Static task
static1
Behavioral task
behavioral1
Sample
63495c938c53f7d9fa71024ac479045d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
63495c938c53f7d9fa71024ac479045d.exe
Resource
win10v2004-20231215-en
General
-
Target
63495c938c53f7d9fa71024ac479045d.exe
-
Size
124KB
-
MD5
63495c938c53f7d9fa71024ac479045d
-
SHA1
6f3c331b43d0cba0b859cb49274b11afc0f73398
-
SHA256
20fde3ceeab30299f1ec9ffee1d9314de41d59b7faaf1c4b2e64a58f507b3518
-
SHA512
0a9445fcd7ce75129601c171479e1e683fbfaf01b0d05fdcb36428f657aaecbfe81973ec8eb32e88469e782108cc1308a17d5f6cdc9111e40f53fe5cc349ac4d
-
SSDEEP
3072:0cIamlzZLkWwhsA6kjqIVwuup9T8pjy/W7:DNmlVLMhsA6k2I8XTGjy
Malware Config
Extracted
njrat
0.7d
HacKed
11aabb.ddns.net:5552
a5a8981207e642f9c714e6e4bd25fa08
-
reg_key
a5a8981207e642f9c714e6e4bd25fa08
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 3872 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 63495c938c53f7d9fa71024ac479045d.exe -
Executes dropped EXE 1 IoCs
pid Process 4000 taskhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a5a8981207e642f9c714e6e4bd25fa08 = "\"C:\\Users\\Admin\\AppData\\Roaming\\taskhost.exe\" .." taskhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a5a8981207e642f9c714e6e4bd25fa08 = "\"C:\\Users\\Admin\\AppData\\Roaming\\taskhost.exe\" .." taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe Token: 33 4000 taskhost.exe Token: SeIncBasePriorityPrivilege 4000 taskhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4924 wrote to memory of 4000 4924 63495c938c53f7d9fa71024ac479045d.exe 94 PID 4924 wrote to memory of 4000 4924 63495c938c53f7d9fa71024ac479045d.exe 94 PID 4924 wrote to memory of 4000 4924 63495c938c53f7d9fa71024ac479045d.exe 94 PID 4000 wrote to memory of 3872 4000 taskhost.exe 97 PID 4000 wrote to memory of 3872 4000 taskhost.exe 97 PID 4000 wrote to memory of 3872 4000 taskhost.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\63495c938c53f7d9fa71024ac479045d.exe"C:\Users\Admin\AppData\Local\Temp\63495c938c53f7d9fa71024ac479045d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Roaming\taskhost.exe"C:\Users\Admin\AppData\Roaming\taskhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\taskhost.exe" "taskhost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:3872
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD563495c938c53f7d9fa71024ac479045d
SHA16f3c331b43d0cba0b859cb49274b11afc0f73398
SHA25620fde3ceeab30299f1ec9ffee1d9314de41d59b7faaf1c4b2e64a58f507b3518
SHA5120a9445fcd7ce75129601c171479e1e683fbfaf01b0d05fdcb36428f657aaecbfe81973ec8eb32e88469e782108cc1308a17d5f6cdc9111e40f53fe5cc349ac4d