Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 00:48
Behavioral task
behavioral1
Sample
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe
Resource
win10v2004-20241007-en
General
-
Target
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe
-
Size
903KB
-
MD5
bd5494546a6eeb7543f728c32b23eca6
-
SHA1
a7269d4e1357a79aac11f8b670122b943cf2c137
-
SHA256
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512
-
SHA512
f3b691414f913c83011ae165287bba1211195489724dd69448a8f53d70f30510a34a377278ad1d373dcba317bd8516afd97911a8d3f09f3f669da4cad5ba0f05
-
SSDEEP
3072:HEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEAZ:HRRRRRRRRRRRRRRRRRRRRJ
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
com-elephant.gl.at.ply.gg:63355
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Executes dropped EXE 3 IoCs
pid Process 2788 Dllhost.exe 2104 Server.exe 2908 Server.exe -
Loads dropped DLL 1 IoCs
pid Process 2312 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2688 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 2312 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe 2788 Dllhost.exe 2104 Server.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe Token: 33 2788 Dllhost.exe Token: SeIncBasePriorityPrivilege 2788 Dllhost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2788 2312 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe 30 PID 2312 wrote to memory of 2788 2312 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe 30 PID 2312 wrote to memory of 2788 2312 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe 30 PID 2312 wrote to memory of 2788 2312 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe 30 PID 2788 wrote to memory of 2688 2788 Dllhost.exe 31 PID 2788 wrote to memory of 2688 2788 Dllhost.exe 31 PID 2788 wrote to memory of 2688 2788 Dllhost.exe 31 PID 2788 wrote to memory of 2688 2788 Dllhost.exe 31 PID 1492 wrote to memory of 2104 1492 taskeng.exe 35 PID 1492 wrote to memory of 2104 1492 taskeng.exe 35 PID 1492 wrote to memory of 2104 1492 taskeng.exe 35 PID 1492 wrote to memory of 2104 1492 taskeng.exe 35 PID 1492 wrote to memory of 2908 1492 taskeng.exe 36 PID 1492 wrote to memory of 2908 1492 taskeng.exe 36 PID 1492 wrote to memory of 2908 1492 taskeng.exe 36 PID 1492 wrote to memory of 2908 1492 taskeng.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe"C:\Users\Admin\AppData\Local\Temp\709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2688
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A16B3144-8A93-409B-ACE3-2F50E1998D6C} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2104
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
903KB
MD5bd5494546a6eeb7543f728c32b23eca6
SHA1a7269d4e1357a79aac11f8b670122b943cf2c137
SHA256709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512
SHA512f3b691414f913c83011ae165287bba1211195489724dd69448a8f53d70f30510a34a377278ad1d373dcba317bd8516afd97911a8d3f09f3f669da4cad5ba0f05