Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/12/2024, 13:46
Behavioral task
behavioral1
Sample
HWIDSpoofer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
HWIDSpoofer.exe
Resource
win10v2004-20241007-en
General
-
Target
HWIDSpoofer.exe
-
Size
357KB
-
MD5
c9b25c1bc4eb54124dad046b3b9e4241
-
SHA1
9e075389a2f34e224a68f84a1c5bb4d665077180
-
SHA256
620b80bcb9f45c4f6f8a0f2c503b4c639deb22c8b2d46d53261f695b51c2b0be
-
SHA512
75daa5a302e7faa1bca08b5f3101b757c07fe844945557b656143b85d37cf1fb0c45e51592d41a50827c0a2871bb9dfeaed502b5971efa4a307f7ade39bdd52d
-
SSDEEP
6144:XYn5fNz3b/DKgUff6zxXINL8AlskBgw+uAVJK25HZ56Bk:XYn5fBGn6z9CABkG
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
127.0.0.1:5552
c3deeffb05c4fa7f233694e4990d7e74
-
reg_key
c3deeffb05c4fa7f233694e4990d7e74
-
splitter
|'|'|
Signatures
-
Njrat family
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 108 netsh.exe 2192 netsh.exe 2924 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe HWIDSpoofer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe HWIDSpoofer.exe -
Executes dropped EXE 3 IoCs
pid Process 2524 StUpdate.exe 2780 StUpdate.exe 1172 StUpdate.exe -
Loads dropped DLL 9 IoCs
pid Process 2524 StUpdate.exe 2524 StUpdate.exe 2524 StUpdate.exe 2780 StUpdate.exe 2780 StUpdate.exe 2780 StUpdate.exe 1172 StUpdate.exe 1172 StUpdate.exe 1172 StUpdate.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWIDSpoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2808 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe 944 HWIDSpoofer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 944 HWIDSpoofer.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe Token: 33 944 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 944 HWIDSpoofer.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 944 wrote to memory of 108 944 HWIDSpoofer.exe 31 PID 944 wrote to memory of 108 944 HWIDSpoofer.exe 31 PID 944 wrote to memory of 108 944 HWIDSpoofer.exe 31 PID 944 wrote to memory of 108 944 HWIDSpoofer.exe 31 PID 944 wrote to memory of 2192 944 HWIDSpoofer.exe 33 PID 944 wrote to memory of 2192 944 HWIDSpoofer.exe 33 PID 944 wrote to memory of 2192 944 HWIDSpoofer.exe 33 PID 944 wrote to memory of 2192 944 HWIDSpoofer.exe 33 PID 944 wrote to memory of 2924 944 HWIDSpoofer.exe 34 PID 944 wrote to memory of 2924 944 HWIDSpoofer.exe 34 PID 944 wrote to memory of 2924 944 HWIDSpoofer.exe 34 PID 944 wrote to memory of 2924 944 HWIDSpoofer.exe 34 PID 944 wrote to memory of 2808 944 HWIDSpoofer.exe 37 PID 944 wrote to memory of 2808 944 HWIDSpoofer.exe 37 PID 944 wrote to memory of 2808 944 HWIDSpoofer.exe 37 PID 944 wrote to memory of 2808 944 HWIDSpoofer.exe 37 PID 2168 wrote to memory of 2524 2168 taskeng.exe 40 PID 2168 wrote to memory of 2524 2168 taskeng.exe 40 PID 2168 wrote to memory of 2524 2168 taskeng.exe 40 PID 2168 wrote to memory of 2524 2168 taskeng.exe 40 PID 2168 wrote to memory of 2524 2168 taskeng.exe 40 PID 2168 wrote to memory of 2524 2168 taskeng.exe 40 PID 2168 wrote to memory of 2524 2168 taskeng.exe 40 PID 2168 wrote to memory of 2780 2168 taskeng.exe 41 PID 2168 wrote to memory of 2780 2168 taskeng.exe 41 PID 2168 wrote to memory of 2780 2168 taskeng.exe 41 PID 2168 wrote to memory of 2780 2168 taskeng.exe 41 PID 2168 wrote to memory of 2780 2168 taskeng.exe 41 PID 2168 wrote to memory of 2780 2168 taskeng.exe 41 PID 2168 wrote to memory of 2780 2168 taskeng.exe 41 PID 2168 wrote to memory of 1172 2168 taskeng.exe 43 PID 2168 wrote to memory of 1172 2168 taskeng.exe 43 PID 2168 wrote to memory of 1172 2168 taskeng.exe 43 PID 2168 wrote to memory of 1172 2168 taskeng.exe 43 PID 2168 wrote to memory of 1172 2168 taskeng.exe 43 PID 2168 wrote to memory of 1172 2168 taskeng.exe 43 PID 2168 wrote to memory of 1172 2168 taskeng.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe" "HWIDSpoofer.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:108
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2192
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe" "HWIDSpoofer.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2924
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2808
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {11C4DDC4-288A-474E-9195-FAF32D049809} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1172
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357KB
MD5c9b25c1bc4eb54124dad046b3b9e4241
SHA19e075389a2f34e224a68f84a1c5bb4d665077180
SHA256620b80bcb9f45c4f6f8a0f2c503b4c639deb22c8b2d46d53261f695b51c2b0be
SHA51275daa5a302e7faa1bca08b5f3101b757c07fe844945557b656143b85d37cf1fb0c45e51592d41a50827c0a2871bb9dfeaed502b5971efa4a307f7ade39bdd52d
-
Filesize
4B
MD54d853d9c7197ee7fa81c6535b1f7d655
SHA1eac3d866e991967b385f3dd22da25e410d8f7f49
SHA2565abdb6175f820f0ac3d8647fbb1f7a0bcc91757a782a8a145570944ca6a00c96
SHA512dc5a09d8586eb9f591f6e00187817c19f693e9328a1b2e5838c61c0b234e9608eecc45bbf7f4a90912e9a456d0ab469ed2503bafb4988b276cec8d5f0b18fda7