Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21/01/2024, 11:22
Behavioral task
behavioral1
Sample
6d2dd997fba6f32224da79bffe045408.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6d2dd997fba6f32224da79bffe045408.exe
Resource
win10v2004-20231215-en
General
-
Target
6d2dd997fba6f32224da79bffe045408.exe
-
Size
43KB
-
MD5
6d2dd997fba6f32224da79bffe045408
-
SHA1
bb1e4b50edac6717d8c750a40532eb31a2560a41
-
SHA256
59957e041167865b2bd399f65f382246b60837905dca819cb736b50f66f59c7e
-
SHA512
b4e9925b668fab559fd436350855f8fa6ca613e2a2271312f70b0790c71233a09542d54afd3aa504e65ee908a64ccd4b4dcd74047b04a09ee66f11561358169b
-
SSDEEP
384:AZypJE1STss7yKSDzAS+qE1LpS2FzsIij+ZsNO3PlpJKkkjh/TzF7pWn50reT0pe:mu2k4smKSPAhrLkguXQ/oE+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 6d2dd997fba6f32224da79bffe045408.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe WindowsServices.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe WindowsServices.exe -
Executes dropped EXE 4 IoCs
pid Process 3876 WindowsServices.exe 2324 Server.exe 2788 Server.exe 4692 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .." WindowsServices.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .." WindowsServices.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 872 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4512 6d2dd997fba6f32224da79bffe045408.exe 3876 WindowsServices.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe Token: 33 3876 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3876 WindowsServices.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4512 wrote to memory of 3876 4512 6d2dd997fba6f32224da79bffe045408.exe 93 PID 4512 wrote to memory of 3876 4512 6d2dd997fba6f32224da79bffe045408.exe 93 PID 4512 wrote to memory of 3876 4512 6d2dd997fba6f32224da79bffe045408.exe 93 PID 3876 wrote to memory of 872 3876 WindowsServices.exe 98 PID 3876 wrote to memory of 872 3876 WindowsServices.exe 98 PID 3876 wrote to memory of 872 3876 WindowsServices.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d2dd997fba6f32224da79bffe045408.exe"C:\Users\Admin\AppData\Local\Temp\6d2dd997fba6f32224da79bffe045408.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
PID:872
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
PID:2324
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
PID:2788
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
PID:4692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
507B
MD525d1b50e7c0d451f3d850eb54d27ca05
SHA1a238807715c70a335f54e80d4855644b21a9e870
SHA256650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5
SHA5124223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5
-
Filesize
43KB
MD56d2dd997fba6f32224da79bffe045408
SHA1bb1e4b50edac6717d8c750a40532eb31a2560a41
SHA25659957e041167865b2bd399f65f382246b60837905dca819cb736b50f66f59c7e
SHA512b4e9925b668fab559fd436350855f8fa6ca613e2a2271312f70b0790c71233a09542d54afd3aa504e65ee908a64ccd4b4dcd74047b04a09ee66f11561358169b