Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3NingaliNET...or.dll
windows7-x64
1NingaliNET...or.dll
windows10-2004-x64
1NingaliNET...ib.dll
windows7-x64
1NingaliNET...ib.dll
windows10-2004-x64
1NingaliNET...il.dll
windows7-x64
1NingaliNET...il.dll
windows10-2004-x64
1NingaliNET...ET.exe
windows7-x64
1NingaliNET...ET.exe
windows10-2004-x64
1NingaliNET...er.exe
windows7-x64
1NingaliNET...er.exe
windows10-2004-x64
1NingaliNET...er.exe
windows7-x64
1NingaliNET...er.exe
windows10-2004-x64
1NingaliNET...nt.exe
windows7-x64
1NingaliNET...nt.exe
windows10-2004-x64
1NingaliNET...al.exe
windows7-x64
1NingaliNET...al.exe
windows10-2004-x64
1NingaliNET...es.exe
windows7-x64
1NingaliNET...es.exe
windows10-2004-x64
1NingaliNET...er.exe
windows7-x64
7NingaliNET...er.exe
windows10-2004-x64
7NingaliNET...er.dll
windows7-x64
1NingaliNET...er.dll
windows10-2004-x64
1NingaliNET...er.rtf
windows7-x64
1NingaliNET...er.rtf
windows10-2004-x64
1NingaliNET...np.dll
windows7-x64
1NingaliNET...np.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 19:36
Static task
static1
Behavioral task
behavioral1
Sample
NingaliNET 1.0.2.1/IconInjector.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
NingaliNET 1.0.2.1/IconInjector.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
NingaliNET 1.0.2.1/Interop.NATUPNPLib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
NingaliNET 1.0.2.1/Interop.NATUPNPLib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
NingaliNET 1.0.2.1/Mono.Cecil.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
NingaliNET 1.0.2.1/Mono.Cecil.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
NingaliNET 1.0.2.1/NingaliNET.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
NingaliNET 1.0.2.1/NingaliNET.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
NingaliNET 1.0.2.1/Plugins/Filebinder.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
NingaliNET 1.0.2.1/Plugins/Filebinder.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
NingaliNET 1.0.2.1/Plugins/Server.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
NingaliNET 1.0.2.1/Plugins/Server.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
NingaliNET 1.0.2.1/Plugins/dlentrypoint.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
NingaliNET 1.0.2.1/Plugins/dlentrypoint.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
NingaliNET 1.0.2.1/Plugins/dlnormal.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
NingaliNET 1.0.2.1/Plugins/dlnormal.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
NingaliNET 1.0.2.1/Res/res.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
NingaliNET 1.0.2.1/Res/res.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
NingaliNET 1.0.2.1/Server.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral20
Sample
NingaliNET 1.0.2.1/Server.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
NingaliNET 1.0.2.1/SocketServer.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
NingaliNET 1.0.2.1/SocketServer.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
NingaliNET 1.0.2.1/Users/SERVER_IE11WIN7_IEUser_5612398/Logger.rtf
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral24
Sample
NingaliNET 1.0.2.1/Users/SERVER_IE11WIN7_IEUser_5612398/Logger.rtf
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
NingaliNET 1.0.2.1/upnp.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral26
Sample
NingaliNET 1.0.2.1/upnp.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
General
-
Target
NingaliNET 1.0.2.1/Server.exe
-
Size
149KB
-
MD5
23886459c4790697a4f0bf60b8d9235f
-
SHA1
072e005df5322bb3b094be6fc5366ba223bf3849
-
SHA256
de60420ce7dfbf87168d5124dfd82c16c2d5f54362d2775ec8136a17acb6ab76
-
SHA512
a6ef16716a755d419a1ad9fbb584256c1e6d3e1aed50b2732ff9b84dfe21d1a1d2aed6d4b8c7aea026e864a1397595b5e66517944a624cf5c68b26910d6aaa12
-
SSDEEP
3072:q/yjqpkbQBYYppJT3UJwi7RA7tkHIO6AtDbbTU0P7tepGgvJbVf:qp7T3UJwipHIVAFbTBP7tepG8R
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Server.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5612398.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5612398.exe Server.exe -
Executes dropped EXE 1 IoCs
pid Process 448 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5612398 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .." Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5612398 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .." Server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Server.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Server.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Server.exe -
Kills process with taskkill 24 IoCs
pid Process 3704 taskkill.exe 3956 taskkill.exe 4396 taskkill.exe 5028 taskkill.exe 2124 taskkill.exe 2944 taskkill.exe 4896 taskkill.exe 2288 taskkill.exe 1060 taskkill.exe 1580 taskkill.exe 2812 taskkill.exe 3148 taskkill.exe 2324 taskkill.exe 4112 taskkill.exe 3824 taskkill.exe 2992 taskkill.exe 1540 taskkill.exe 4544 taskkill.exe 1404 taskkill.exe 2932 taskkill.exe 828 taskkill.exe 2880 taskkill.exe 3928 taskkill.exe 1936 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 448 Server.exe Token: SeDebugPrivilege 5028 taskkill.exe Token: SeDebugPrivilege 2124 taskkill.exe Token: SeDebugPrivilege 2932 taskkill.exe Token: SeDebugPrivilege 2324 taskkill.exe Token: SeDebugPrivilege 3148 taskkill.exe Token: SeDebugPrivilege 2944 taskkill.exe Token: SeDebugPrivilege 3704 taskkill.exe Token: SeDebugPrivilege 4112 taskkill.exe Token: SeDebugPrivilege 828 taskkill.exe Token: SeDebugPrivilege 4896 taskkill.exe Token: SeDebugPrivilege 2288 taskkill.exe Token: SeDebugPrivilege 3928 taskkill.exe Token: SeDebugPrivilege 1060 taskkill.exe Token: SeDebugPrivilege 3956 taskkill.exe Token: SeDebugPrivilege 1580 taskkill.exe Token: SeDebugPrivilege 1540 taskkill.exe Token: SeDebugPrivilege 2880 taskkill.exe Token: SeDebugPrivilege 2812 taskkill.exe Token: SeDebugPrivilege 3824 taskkill.exe Token: SeDebugPrivilege 4544 taskkill.exe Token: SeDebugPrivilege 4396 taskkill.exe Token: SeDebugPrivilege 1936 taskkill.exe Token: SeDebugPrivilege 1404 taskkill.exe Token: SeDebugPrivilege 2992 taskkill.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4244 Server.exe 448 Server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4244 wrote to memory of 448 4244 Server.exe 90 PID 4244 wrote to memory of 448 4244 Server.exe 90 PID 4244 wrote to memory of 448 4244 Server.exe 90 PID 448 wrote to memory of 5028 448 Server.exe 94 PID 448 wrote to memory of 5028 448 Server.exe 94 PID 448 wrote to memory of 5028 448 Server.exe 94 PID 448 wrote to memory of 2124 448 Server.exe 95 PID 448 wrote to memory of 2124 448 Server.exe 95 PID 448 wrote to memory of 2124 448 Server.exe 95 PID 448 wrote to memory of 2932 448 Server.exe 96 PID 448 wrote to memory of 2932 448 Server.exe 96 PID 448 wrote to memory of 2932 448 Server.exe 96 PID 448 wrote to memory of 3148 448 Server.exe 105 PID 448 wrote to memory of 3148 448 Server.exe 105 PID 448 wrote to memory of 3148 448 Server.exe 105 PID 448 wrote to memory of 2944 448 Server.exe 106 PID 448 wrote to memory of 2944 448 Server.exe 106 PID 448 wrote to memory of 2944 448 Server.exe 106 PID 448 wrote to memory of 2324 448 Server.exe 107 PID 448 wrote to memory of 2324 448 Server.exe 107 PID 448 wrote to memory of 2324 448 Server.exe 107 PID 448 wrote to memory of 3704 448 Server.exe 113 PID 448 wrote to memory of 3704 448 Server.exe 113 PID 448 wrote to memory of 3704 448 Server.exe 113 PID 448 wrote to memory of 4112 448 Server.exe 114 PID 448 wrote to memory of 4112 448 Server.exe 114 PID 448 wrote to memory of 4112 448 Server.exe 114 PID 448 wrote to memory of 828 448 Server.exe 115 PID 448 wrote to memory of 828 448 Server.exe 115 PID 448 wrote to memory of 828 448 Server.exe 115 PID 448 wrote to memory of 4896 448 Server.exe 119 PID 448 wrote to memory of 4896 448 Server.exe 119 PID 448 wrote to memory of 4896 448 Server.exe 119 PID 448 wrote to memory of 2288 448 Server.exe 120 PID 448 wrote to memory of 2288 448 Server.exe 120 PID 448 wrote to memory of 2288 448 Server.exe 120 PID 448 wrote to memory of 3928 448 Server.exe 121 PID 448 wrote to memory of 3928 448 Server.exe 121 PID 448 wrote to memory of 3928 448 Server.exe 121 PID 448 wrote to memory of 1060 448 Server.exe 130 PID 448 wrote to memory of 1060 448 Server.exe 130 PID 448 wrote to memory of 1060 448 Server.exe 130 PID 448 wrote to memory of 3956 448 Server.exe 131 PID 448 wrote to memory of 3956 448 Server.exe 131 PID 448 wrote to memory of 3956 448 Server.exe 131 PID 448 wrote to memory of 1580 448 Server.exe 132 PID 448 wrote to memory of 1580 448 Server.exe 132 PID 448 wrote to memory of 1580 448 Server.exe 132 PID 448 wrote to memory of 2880 448 Server.exe 137 PID 448 wrote to memory of 2880 448 Server.exe 137 PID 448 wrote to memory of 2880 448 Server.exe 137 PID 448 wrote to memory of 2812 448 Server.exe 138 PID 448 wrote to memory of 2812 448 Server.exe 138 PID 448 wrote to memory of 2812 448 Server.exe 138 PID 448 wrote to memory of 1540 448 Server.exe 139 PID 448 wrote to memory of 1540 448 Server.exe 139 PID 448 wrote to memory of 1540 448 Server.exe 139 PID 448 wrote to memory of 4544 448 Server.exe 150 PID 448 wrote to memory of 4544 448 Server.exe 150 PID 448 wrote to memory of 4544 448 Server.exe 150 PID 448 wrote to memory of 3824 448 Server.exe 151 PID 448 wrote to memory of 3824 448 Server.exe 151 PID 448 wrote to memory of 3824 448 Server.exe 151 PID 448 wrote to memory of 4396 448 Server.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\NingaliNET 1.0.2.1\Server.exe"C:\Users\Admin\AppData\Local\Temp\NingaliNET 1.0.2.1\Server.exe"1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ProcessHacker.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Antilogger.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ProcessHacker.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Antilogger.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ProcessHacker.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3704
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Antilogger.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ProcessHacker.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Antilogger.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ProcessHacker.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Antilogger.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ProcessHacker.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Antilogger.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ProcessHacker.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3824
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Antilogger.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4396
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ProcessHacker.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Antilogger.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149KB
MD523886459c4790697a4f0bf60b8d9235f
SHA1072e005df5322bb3b094be6fc5366ba223bf3849
SHA256de60420ce7dfbf87168d5124dfd82c16c2d5f54362d2775ec8136a17acb6ab76
SHA512a6ef16716a755d419a1ad9fbb584256c1e6d3e1aed50b2732ff9b84dfe21d1a1d2aed6d4b8c7aea026e864a1397595b5e66517944a624cf5c68b26910d6aaa12