Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2024, 13:46
Behavioral task
behavioral1
Sample
HWIDSpoofer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
HWIDSpoofer.exe
Resource
win10v2004-20241007-en
General
-
Target
HWIDSpoofer.exe
-
Size
357KB
-
MD5
c9b25c1bc4eb54124dad046b3b9e4241
-
SHA1
9e075389a2f34e224a68f84a1c5bb4d665077180
-
SHA256
620b80bcb9f45c4f6f8a0f2c503b4c639deb22c8b2d46d53261f695b51c2b0be
-
SHA512
75daa5a302e7faa1bca08b5f3101b757c07fe844945557b656143b85d37cf1fb0c45e51592d41a50827c0a2871bb9dfeaed502b5971efa4a307f7ade39bdd52d
-
SSDEEP
6144:XYn5fNz3b/DKgUff6zxXINL8AlskBgw+uAVJK25HZ56Bk:XYn5fBGn6z9CABkG
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
127.0.0.1:5552
c3deeffb05c4fa7f233694e4990d7e74
-
reg_key
c3deeffb05c4fa7f233694e4990d7e74
-
splitter
|'|'|
Signatures
-
Njrat family
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 2008 netsh.exe 2116 netsh.exe 3388 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe HWIDSpoofer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe HWIDSpoofer.exe -
Executes dropped EXE 3 IoCs
pid Process 4028 StUpdate.exe 1240 StUpdate.exe 2088 StUpdate.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWIDSpoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4232 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe 3320 HWIDSpoofer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3320 HWIDSpoofer.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe Token: 33 3320 HWIDSpoofer.exe Token: SeIncBasePriorityPrivilege 3320 HWIDSpoofer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3320 wrote to memory of 2008 3320 HWIDSpoofer.exe 84 PID 3320 wrote to memory of 2008 3320 HWIDSpoofer.exe 84 PID 3320 wrote to memory of 2008 3320 HWIDSpoofer.exe 84 PID 3320 wrote to memory of 2116 3320 HWIDSpoofer.exe 87 PID 3320 wrote to memory of 2116 3320 HWIDSpoofer.exe 87 PID 3320 wrote to memory of 2116 3320 HWIDSpoofer.exe 87 PID 3320 wrote to memory of 3388 3320 HWIDSpoofer.exe 88 PID 3320 wrote to memory of 3388 3320 HWIDSpoofer.exe 88 PID 3320 wrote to memory of 3388 3320 HWIDSpoofer.exe 88 PID 3320 wrote to memory of 4232 3320 HWIDSpoofer.exe 90 PID 3320 wrote to memory of 4232 3320 HWIDSpoofer.exe 90 PID 3320 wrote to memory of 4232 3320 HWIDSpoofer.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe" "HWIDSpoofer.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2008
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2116
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe" "HWIDSpoofer.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3388
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4232
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4028
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2088
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD5661cab77d3b907e8057f2e689e995af3
SHA15d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c
SHA2568f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
SHA5122523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67
-
Filesize
357KB
MD5c9b25c1bc4eb54124dad046b3b9e4241
SHA19e075389a2f34e224a68f84a1c5bb4d665077180
SHA256620b80bcb9f45c4f6f8a0f2c503b4c639deb22c8b2d46d53261f695b51c2b0be
SHA51275daa5a302e7faa1bca08b5f3101b757c07fe844945557b656143b85d37cf1fb0c45e51592d41a50827c0a2871bb9dfeaed502b5971efa4a307f7ade39bdd52d
-
Filesize
4B
MD54d853d9c7197ee7fa81c6535b1f7d655
SHA1eac3d866e991967b385f3dd22da25e410d8f7f49
SHA2565abdb6175f820f0ac3d8647fbb1f7a0bcc91757a782a8a145570944ca6a00c96
SHA512dc5a09d8586eb9f591f6e00187817c19f693e9328a1b2e5838c61c0b234e9608eecc45bbf7f4a90912e9a456d0ab469ed2503bafb4988b276cec8d5f0b18fda7