Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/12/2024, 11:22
Behavioral task
behavioral1
Sample
SearchUII.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SearchUII.exe
Resource
win10v2004-20241007-en
General
-
Target
SearchUII.exe
-
Size
27KB
-
MD5
24453759fc86d34383bd0ffc722bbfb5
-
SHA1
495fa07508f0e79d9ce26f9179285d41303ce402
-
SHA256
ff4bc7221036ee331d8b913f12aec34493c11b6c2655dc15cf4281a6306126ab
-
SHA512
aad86f8232a676e1705319f0da2c45a89b533ecf5e8bcbc95d610683247f028b57ae7bf8b791468f6ce9b34962778cec205b48c4612c95c82967bb223ad30db9
-
SSDEEP
768:wMSHQDF42Ko1dtSHP+ycnzLOhTErXjHc:tB9Ko1b7OBErXj8
Malware Config
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2396 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SearchUII.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 2364 SearchUII.exe Token: 33 2364 SearchUII.exe Token: SeIncBasePriorityPrivilege 2364 SearchUII.exe Token: 33 2364 SearchUII.exe Token: SeIncBasePriorityPrivilege 2364 SearchUII.exe Token: 33 2364 SearchUII.exe Token: SeIncBasePriorityPrivilege 2364 SearchUII.exe Token: 33 2364 SearchUII.exe Token: SeIncBasePriorityPrivilege 2364 SearchUII.exe Token: 33 2364 SearchUII.exe Token: SeIncBasePriorityPrivilege 2364 SearchUII.exe Token: 33 2364 SearchUII.exe Token: SeIncBasePriorityPrivilege 2364 SearchUII.exe Token: 33 2364 SearchUII.exe Token: SeIncBasePriorityPrivilege 2364 SearchUII.exe Token: 33 2364 SearchUII.exe Token: SeIncBasePriorityPrivilege 2364 SearchUII.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2396 2364 SearchUII.exe 31 PID 2364 wrote to memory of 2396 2364 SearchUII.exe 31 PID 2364 wrote to memory of 2396 2364 SearchUII.exe 31 PID 2364 wrote to memory of 2396 2364 SearchUII.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\SearchUII.exe"C:\Users\Admin\AppData\Local\Temp\SearchUII.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\SearchUII.exe" "SearchUII.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2396
-