Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
897s -
max time network
842s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 06:32
General
-
Target
ذذ.exe
-
Size
164KB
-
MD5
cbe6a897963577c8f625c46aad47f24c
-
SHA1
d827c1de67b4fc4488ec7b7d9c40db7e5bcb1b84
-
SHA256
4910f0abbfe81bce56d8fe7870eb7566a3f6df50c147e7b83c51f15f119a3159
-
SHA512
68de8766c4d058ede7f6f4e7a3d67956fa56c6bffef74324a6df851ba889ad98d8db6568d38c5db27c5518d07a5c24ff06e712182aeff2c5f56fbbc898268086
-
SSDEEP
3072:ASDYy/KQEmsHeSIrR5s2D8CT5uf1jsOEE7yFXdbTRwKkzKDn:ASLrACT5uf1jsO3ONbR7
Malware Config
Signatures
-
Njrat family
-
Executes dropped EXE 1 IoCs
pid Process 2284 Client.exe -
Loads dropped DLL 1 IoCs
pid Process 1872 ذذ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ذذ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2284 Client.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe Token: SeIncBasePriorityPrivilege 2284 Client.exe Token: 33 2284 Client.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2284 1872 ذذ.exe 28 PID 1872 wrote to memory of 2284 1872 ذذ.exe 28 PID 1872 wrote to memory of 2284 1872 ذذ.exe 28 PID 1872 wrote to memory of 2284 1872 ذذ.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ذذ.exe"C:\Users\Admin\AppData\Local\Temp\ذذ.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Roaming\Client.exe"C:\Users\Admin\AppData\Roaming\Client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5cbe6a897963577c8f625c46aad47f24c
SHA1d827c1de67b4fc4488ec7b7d9c40db7e5bcb1b84
SHA2564910f0abbfe81bce56d8fe7870eb7566a3f6df50c147e7b83c51f15f119a3159
SHA51268de8766c4d058ede7f6f4e7a3d67956fa56c6bffef74324a6df851ba889ad98d8db6568d38c5db27c5518d07a5c24ff06e712182aeff2c5f56fbbc898268086