Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21/01/2024, 11:22
Behavioral task
behavioral1
Sample
6d2dd997fba6f32224da79bffe045408.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6d2dd997fba6f32224da79bffe045408.exe
Resource
win10v2004-20231215-en
General
-
Target
6d2dd997fba6f32224da79bffe045408.exe
-
Size
43KB
-
MD5
6d2dd997fba6f32224da79bffe045408
-
SHA1
bb1e4b50edac6717d8c750a40532eb31a2560a41
-
SHA256
59957e041167865b2bd399f65f382246b60837905dca819cb736b50f66f59c7e
-
SHA512
b4e9925b668fab559fd436350855f8fa6ca613e2a2271312f70b0790c71233a09542d54afd3aa504e65ee908a64ccd4b4dcd74047b04a09ee66f11561358169b
-
SSDEEP
384:AZypJE1STss7yKSDzAS+qE1LpS2FzsIij+ZsNO3PlpJKkkjh/TzF7pWn50reT0pe:mu2k4smKSPAhrLkguXQ/oE+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe WindowsServices.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe WindowsServices.exe -
Executes dropped EXE 3 IoCs
pid Process 1180 WindowsServices.exe 1812 Server.exe 2500 Server.exe -
Loads dropped DLL 1 IoCs
pid Process 2224 6d2dd997fba6f32224da79bffe045408.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .." WindowsServices.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .." WindowsServices.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2700 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2224 6d2dd997fba6f32224da79bffe045408.exe 1180 WindowsServices.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe Token: 33 1180 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1180 WindowsServices.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1180 2224 6d2dd997fba6f32224da79bffe045408.exe 28 PID 2224 wrote to memory of 1180 2224 6d2dd997fba6f32224da79bffe045408.exe 28 PID 2224 wrote to memory of 1180 2224 6d2dd997fba6f32224da79bffe045408.exe 28 PID 2224 wrote to memory of 1180 2224 6d2dd997fba6f32224da79bffe045408.exe 28 PID 1180 wrote to memory of 2700 1180 WindowsServices.exe 29 PID 1180 wrote to memory of 2700 1180 WindowsServices.exe 29 PID 1180 wrote to memory of 2700 1180 WindowsServices.exe 29 PID 1180 wrote to memory of 2700 1180 WindowsServices.exe 29 PID 2288 wrote to memory of 1812 2288 taskeng.exe 34 PID 2288 wrote to memory of 1812 2288 taskeng.exe 34 PID 2288 wrote to memory of 1812 2288 taskeng.exe 34 PID 2288 wrote to memory of 1812 2288 taskeng.exe 34 PID 2288 wrote to memory of 2500 2288 taskeng.exe 35 PID 2288 wrote to memory of 2500 2288 taskeng.exe 35 PID 2288 wrote to memory of 2500 2288 taskeng.exe 35 PID 2288 wrote to memory of 2500 2288 taskeng.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d2dd997fba6f32224da79bffe045408.exe"C:\Users\Admin\AppData\Local\Temp\6d2dd997fba6f32224da79bffe045408.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
PID:2700
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E525224F-EDFE-488F-B66E-BD69B7038C2C} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
PID:1812
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD56d2dd997fba6f32224da79bffe045408
SHA1bb1e4b50edac6717d8c750a40532eb31a2560a41
SHA25659957e041167865b2bd399f65f382246b60837905dca819cb736b50f66f59c7e
SHA512b4e9925b668fab559fd436350855f8fa6ca613e2a2271312f70b0790c71233a09542d54afd3aa504e65ee908a64ccd4b4dcd74047b04a09ee66f11561358169b