Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05/02/2025, 07:58
Behavioral task
behavioral1
Sample
am.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
am.exe
Resource
win10v2004-20250129-en
General
-
Target
am.exe
-
Size
93KB
-
MD5
59b40a406af1b307f204b246371db9bf
-
SHA1
8448937d6dcd4868082a2e09fd6ff582d9c73c70
-
SHA256
5f1eaaa7781758b4830a2c576234d1687f95c1b058b48d833a4d71f2fa970d6b
-
SHA512
1c392cda14f386a45b20f08f2f5ec3a6fcfd06f649cfe21c1f3f9ce6a31e4485cb5598c41c2b4cbcf312bc67ca0db41e1dc887caeeabd325f6259ee85cf49fec
-
SSDEEP
768:WY3TmdD9O/pBcxYsbae6GIXb9pDX2KC98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3Y7E:hm3Ox6baIa9R/j00ljEwzGi1dDuD6gS
Malware Config
Extracted
njrat
0.7d
bavilla
hakim32.ddns.net:2000
192.168.1.15:5552
522259726718d1753f479b9af3c0b6f5
-
reg_key
522259726718d1753f479b9af3c0b6f5
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 1624 netsh.exe 2868 netsh.exe 2888 netsh.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\522259726718d1753f479b9af3c0b6f5Windows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\522259726718d1753f479b9af3c0b6f5Windows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe -
Executes dropped EXE 4 IoCs
pid Process 2200 server.exe 1816 StUpdate.exe 2924 StUpdate.exe 1876 StUpdate.exe -
Loads dropped DLL 11 IoCs
pid Process 2448 am.exe 2448 am.exe 1816 StUpdate.exe 1816 StUpdate.exe 1816 StUpdate.exe 2924 StUpdate.exe 2924 StUpdate.exe 2924 StUpdate.exe 1876 StUpdate.exe 1876 StUpdate.exe 1876 StUpdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language am.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe 2200 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2200 server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe Token: 33 2200 server.exe Token: SeIncBasePriorityPrivilege 2200 server.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2200 2448 am.exe 30 PID 2448 wrote to memory of 2200 2448 am.exe 30 PID 2448 wrote to memory of 2200 2448 am.exe 30 PID 2448 wrote to memory of 2200 2448 am.exe 30 PID 2200 wrote to memory of 1624 2200 server.exe 31 PID 2200 wrote to memory of 1624 2200 server.exe 31 PID 2200 wrote to memory of 1624 2200 server.exe 31 PID 2200 wrote to memory of 1624 2200 server.exe 31 PID 2200 wrote to memory of 2888 2200 server.exe 33 PID 2200 wrote to memory of 2888 2200 server.exe 33 PID 2200 wrote to memory of 2888 2200 server.exe 33 PID 2200 wrote to memory of 2888 2200 server.exe 33 PID 2200 wrote to memory of 2868 2200 server.exe 34 PID 2200 wrote to memory of 2868 2200 server.exe 34 PID 2200 wrote to memory of 2868 2200 server.exe 34 PID 2200 wrote to memory of 2868 2200 server.exe 34 PID 2200 wrote to memory of 2720 2200 server.exe 36 PID 2200 wrote to memory of 2720 2200 server.exe 36 PID 2200 wrote to memory of 2720 2200 server.exe 36 PID 2200 wrote to memory of 2720 2200 server.exe 36 PID 2088 wrote to memory of 1816 2088 taskeng.exe 41 PID 2088 wrote to memory of 1816 2088 taskeng.exe 41 PID 2088 wrote to memory of 1816 2088 taskeng.exe 41 PID 2088 wrote to memory of 1816 2088 taskeng.exe 41 PID 2088 wrote to memory of 1816 2088 taskeng.exe 41 PID 2088 wrote to memory of 1816 2088 taskeng.exe 41 PID 2088 wrote to memory of 1816 2088 taskeng.exe 41 PID 2088 wrote to memory of 2924 2088 taskeng.exe 42 PID 2088 wrote to memory of 2924 2088 taskeng.exe 42 PID 2088 wrote to memory of 2924 2088 taskeng.exe 42 PID 2088 wrote to memory of 2924 2088 taskeng.exe 42 PID 2088 wrote to memory of 2924 2088 taskeng.exe 42 PID 2088 wrote to memory of 2924 2088 taskeng.exe 42 PID 2088 wrote to memory of 2924 2088 taskeng.exe 42 PID 2088 wrote to memory of 1876 2088 taskeng.exe 43 PID 2088 wrote to memory of 1876 2088 taskeng.exe 43 PID 2088 wrote to memory of 1876 2088 taskeng.exe 43 PID 2088 wrote to memory of 1876 2088 taskeng.exe 43 PID 2088 wrote to memory of 1876 2088 taskeng.exe 43 PID 2088 wrote to memory of 1876 2088 taskeng.exe 43 PID 2088 wrote to memory of 1876 2088 taskeng.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\am.exe"C:\Users\Admin\AppData\Local\Temp\am.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1624
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2888
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2868
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2720
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E15B7B95-5E08-4E33-94CA-C00EC1364F5A} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1816
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2924
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1876
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5c6bdbc9d86009ccf7e8de878c9603213
SHA12a4b8716f978f2d107bcd8294b486a5ee45afe6e
SHA25636a067fdfcee95eb270f0b72e3b9e40d52c907d749fb9a8490d82f8ee56b29eb
SHA512c42a52cd8837e2533b3d5ec97639f0c94287e3d7a6c73635c21df50eba8483b60df15bf262a308836875cd9afed504e7f98a2f6b254e4181fe548b1853d42256
-
Filesize
93KB
MD559b40a406af1b307f204b246371db9bf
SHA18448937d6dcd4868082a2e09fd6ff582d9c73c70
SHA2565f1eaaa7781758b4830a2c576234d1687f95c1b058b48d833a4d71f2fa970d6b
SHA5121c392cda14f386a45b20f08f2f5ec3a6fcfd06f649cfe21c1f3f9ce6a31e4485cb5598c41c2b4cbcf312bc67ca0db41e1dc887caeeabd325f6259ee85cf49fec