Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 00:48
Behavioral task
behavioral1
Sample
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe
Resource
win10v2004-20241007-en
General
-
Target
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe
-
Size
903KB
-
MD5
bd5494546a6eeb7543f728c32b23eca6
-
SHA1
a7269d4e1357a79aac11f8b670122b943cf2c137
-
SHA256
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512
-
SHA512
f3b691414f913c83011ae165287bba1211195489724dd69448a8f53d70f30510a34a377278ad1d373dcba317bd8516afd97911a8d3f09f3f669da4cad5ba0f05
-
SSDEEP
3072:HEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEAZ:HRRRRRRRRRRRRRRRRRRRRJ
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
com-elephant.gl.at.ply.gg:63355
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Executes dropped EXE 3 IoCs
pid Process 3512 Dllhost.exe 3084 Server.exe 5056 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3008 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4024 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe 3512 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe Token: 33 3512 Dllhost.exe Token: SeIncBasePriorityPrivilege 3512 Dllhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4024 wrote to memory of 3512 4024 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe 83 PID 4024 wrote to memory of 3512 4024 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe 83 PID 4024 wrote to memory of 3512 4024 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe 83 PID 3512 wrote to memory of 3008 3512 Dllhost.exe 88 PID 3512 wrote to memory of 3008 3512 Dllhost.exe 88 PID 3512 wrote to memory of 3008 3512 Dllhost.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe"C:\Users\Admin\AppData\Local\Temp\709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3008
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3084
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5056
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
507B
MD525d1b50e7c0d451f3d850eb54d27ca05
SHA1a238807715c70a335f54e80d4855644b21a9e870
SHA256650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5
SHA5124223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5
-
Filesize
903KB
MD5bd5494546a6eeb7543f728c32b23eca6
SHA1a7269d4e1357a79aac11f8b670122b943cf2c137
SHA256709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512
SHA512f3b691414f913c83011ae165287bba1211195489724dd69448a8f53d70f30510a34a377278ad1d373dcba317bd8516afd97911a8d3f09f3f669da4cad5ba0f05