Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
98s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 04:04
Behavioral task
behavioral1
Sample
svClienta.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
svClienta.exe
-
Size
93KB
-
MD5
bc34c0b11293cdfc0a863882711c20ad
-
SHA1
4dd697ae2aea7a84ca121f0653cb2772d3ef63e6
-
SHA256
a16a68d2299311841391fcbe1437b28b7380af5d38f9b3a4893c0e9b42734a09
-
SHA512
743c14f978996cff8374ccea1352fa19c1707306df101896dd3ccd2d5b88dbe985f3be43597246768bbd7dabcd9dbbe815bb82fc14d3379aa9f96c143a013980
-
SSDEEP
1536:hxaw0gMX6BbNrnYsS7JjEwzGi1dDqD7gS:hxwX6BbNrlS7Gi1dU0
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
HacKed
C2
hakim32.ddns.net:2000
maximum-blame.gl.at.ply.gg:61297
Mutex
6e5aa09e9ccce5c567086a02eb08282e
Attributes
-
reg_key
6e5aa09e9ccce5c567086a02eb08282e
-
splitter
|'|'|
Signatures
-
Njrat family
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5048 netsh.exe -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6e5aa09e9ccce5c567086a02eb08282esvClienta.exe svClienta.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6e5aa09e9ccce5c567086a02eb08282esvClienta.exe svClienta.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\6e5aa09e9ccce5c567086a02eb08282esvclienta.exe taskmgr.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svClienta.exe svClienta.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svClienta.exe svClienta.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svClienta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4708 svClienta.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 560 taskmgr.exe Token: SeSystemProfilePrivilege 560 taskmgr.exe Token: SeCreateGlobalPrivilege 560 taskmgr.exe Token: SeDebugPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe Token: 33 4708 svClienta.exe Token: SeIncBasePriorityPrivilege 4708 svClienta.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe 560 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4708 wrote to memory of 5048 4708 svClienta.exe 86 PID 4708 wrote to memory of 5048 4708 svClienta.exe 86 PID 4708 wrote to memory of 5048 4708 svClienta.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\svClienta.exe"C:\Users\Admin\AppData\Local\Temp\svClienta.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svClienta.exe" "svClienta.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5048
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:560
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\6e5aa09e9ccce5c567086a02eb08282esvclienta.exe
Filesize93KB
MD5bc34c0b11293cdfc0a863882711c20ad
SHA14dd697ae2aea7a84ca121f0653cb2772d3ef63e6
SHA256a16a68d2299311841391fcbe1437b28b7380af5d38f9b3a4893c0e9b42734a09
SHA512743c14f978996cff8374ccea1352fa19c1707306df101896dd3ccd2d5b88dbe985f3be43597246768bbd7dabcd9dbbe815bb82fc14d3379aa9f96c143a013980