Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 01:08
Behavioral task
behavioral1
Sample
554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe
Resource
win7-20231129-en
General
-
Target
554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe
-
Size
158KB
-
MD5
3eb8c476c0abcd01fdb799de83503e12
-
SHA1
138aa012bb3b20a79aaf016af172a1b3106a7304
-
SHA256
554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986
-
SHA512
ed277e52d5348d1401a51f002e9f03bfada6481b2cab827f13fa39d54f5c42d4e4ac6627ced47f98fbc22010b044fb0d09b55c6133fc2746e9e78234975c2f85
-
SSDEEP
3072:tf/J2ULiTehI8FrkZTFieSzoSUYSziUP0ZMJG:32UL2i9FKFHd4SziUP0
Malware Config
Extracted
njrat
0.7d
MyBot
asero23.ddns.net:5552
863290bfb622fdfe0ad4e1b97536ae62
-
reg_key
863290bfb622fdfe0ad4e1b97536ae62
-
splitter
Y262SUCZ4UJJ
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2716 netsh.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe -
Loads dropped DLL 1 IoCs
pid Process 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe -
resource yara_rule behavioral1/memory/2216-0-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/files/0x0008000000015cce-2.dat upx behavioral1/memory/2548-37-0x0000000002400000-0x0000000002440000-memory.dmp upx behavioral1/memory/2216-35-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2216 set thread context of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: 33 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe Token: SeIncBasePriorityPrivilege 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2232 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 28 PID 2216 wrote to memory of 2232 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 28 PID 2216 wrote to memory of 2232 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 28 PID 2216 wrote to memory of 2232 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 28 PID 2216 wrote to memory of 3016 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 30 PID 2216 wrote to memory of 3016 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 30 PID 2216 wrote to memory of 3016 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 30 PID 2216 wrote to memory of 3016 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 30 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 2216 wrote to memory of 2548 2216 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 31 PID 3016 wrote to memory of 2588 3016 cmd.exe 33 PID 3016 wrote to memory of 2588 3016 cmd.exe 33 PID 3016 wrote to memory of 2588 3016 cmd.exe 33 PID 3016 wrote to memory of 2588 3016 cmd.exe 33 PID 2588 wrote to memory of 3024 2588 net.exe 34 PID 2588 wrote to memory of 3024 2588 net.exe 34 PID 2588 wrote to memory of 3024 2588 net.exe 34 PID 2588 wrote to memory of 3024 2588 net.exe 34 PID 2548 wrote to memory of 2716 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 35 PID 2548 wrote to memory of 2716 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 35 PID 2548 wrote to memory of 2716 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 35 PID 2548 wrote to memory of 2716 2548 554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe"C:\Users\Admin\AppData\Local\Temp\554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:2232
-
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:3024
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exeC:\Users\Admin\AppData\Local\Temp\554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe" "554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2716
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe
Filesize104KB
MD542ccd69a3be9618d329de0ea0fde3a81
SHA147e9897f303496eb9cd5883f9cdb283b6eee65d3
SHA25614137fcc8697e967b251fd0fafbdf79af8db4c1a67f2eafe53756e3ad80a9bef
SHA51233d95b20ce606441c89dbc575c8e884196a19db056ffd9d54a5e0c57f3928b0d064b6270e4abf033046606e0456156faba3f3a8e6a353e924a7461e61e46bfae
-
\Users\Admin\AppData\Local\Temp\554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986.exe
Filesize158KB
MD53eb8c476c0abcd01fdb799de83503e12
SHA1138aa012bb3b20a79aaf016af172a1b3106a7304
SHA256554f40d4d4e6d80d96c5fc1b41afb7268a0b09b375adc3bcb1e10b1ff2eed986
SHA512ed277e52d5348d1401a51f002e9f03bfada6481b2cab827f13fa39d54f5c42d4e4ac6627ced47f98fbc22010b044fb0d09b55c6133fc2746e9e78234975c2f85