Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 18:42
Behavioral task
behavioral1
Sample
8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe
Resource
win10v2004-20241007-en
General
-
Target
8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe
-
Size
27KB
-
MD5
47bea8a28b1e81e3342d594fc57acd8e
-
SHA1
d301e8985e53b7baabf9b45df087a017e3817742
-
SHA256
8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4
-
SHA512
d5f2bfa425fa0c8d7fe2531b57ed9dbe5ca9b8bb8b7a868e39b251182446a22bcf01c3181d17b3362bc2a76b56cda1e504db2436fafbf922ee2120f76e8d00b6
-
SSDEEP
384:2LBH6uj/+AU9038hfOexuaP39hRnMYAQk93vmhm7UMKmIEecKdbXTzm9bVhcaL62:wBa0mkspJtyYA/vMHTi9bD
Malware Config
Extracted
njrat
v4.0
HacKed
216.250.251.104:2028
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Njrat family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Payload.exe -
Executes dropped EXE 1 IoCs
pid Process 2528 Payload.exe -
Loads dropped DLL 1 IoCs
pid Process 1076 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Payload.exe" 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe Token: 33 2528 Payload.exe Token: SeIncBasePriorityPrivilege 2528 Payload.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2528 1076 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe 30 PID 1076 wrote to memory of 2528 1076 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe 30 PID 1076 wrote to memory of 2528 1076 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe 30 PID 1076 wrote to memory of 2528 1076 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe 30 PID 1076 wrote to memory of 2936 1076 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe 31 PID 1076 wrote to memory of 2936 1076 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe 31 PID 1076 wrote to memory of 2936 1076 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe 31 PID 1076 wrote to memory of 2936 1076 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe 31 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2936 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe"C:\Users\Admin\AppData\Local\Temp\8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Roaming\Payload.exe"C:\Users\Admin\AppData\Roaming\Payload.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Payload.exe"2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5020a8f7f990c7833dfb049254ca77b0f
SHA133f0e4024396f2c293be10ea3183c46bc33af3c0
SHA256c7671aa49a19aeee5d5f69e8042485374fd3940b87f7c012fea69bb28b896322
SHA512d9feb210b8f6baf979c653ef18a6b2fbc8ccf0790b9757c2bc9d401dde585e3372ff58513e4f4bfcd174d83cefdfa3b6ca8ca43ee311dacc9ffd890a882fc326
-
Filesize
1022B
MD5ad5e17fccd06112e5e3cdf9893b80bcf
SHA1e1b52f2bf185cc25dfd0ca22f52e88ceab593a40
SHA2569bd06589c70ef5778a0785805c1f7be0144b355d2cae3fea4bc36d27ae61376e
SHA512dd87f467c339cace45e3c3b0ebbc4912dafa299b3229ff7053f4fb930aa817a3ddf81c58b1837aa1f9ad2afce552326a97110ec11cf1c7852d404e00ad5ea9fd
-
Filesize
27KB
MD547bea8a28b1e81e3342d594fc57acd8e
SHA1d301e8985e53b7baabf9b45df087a017e3817742
SHA2568f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4
SHA512d5f2bfa425fa0c8d7fe2531b57ed9dbe5ca9b8bb8b7a868e39b251182446a22bcf01c3181d17b3362bc2a76b56cda1e504db2436fafbf922ee2120f76e8d00b6