Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
895s -
max time network
901s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 06:41
General
-
Target
Test.exe
-
Size
165KB
-
MD5
89bb71a10666ea7e3a9270cf0fd83edf
-
SHA1
acef4b4f60da3eea5ef3af52910a603196be7515
-
SHA256
f5fa74671c7f2a5893d6d1bbee66dd0ac4fdd70d0cd15fda7dc70c935461ac08
-
SHA512
f437c03612d963f1fa9d9c4a286ca4807606040a78fc911bafa1e49a7096d7cd963cbd2b094ba3e7ea7c3493801af3f4ccac3c4b006d3a9299b8b21682a36a87
-
SSDEEP
3072:sii5/VEmP0IfLk65SK+JJLJ99EGLOE3bM2tophtWUO:si2ZiTF9+gOCbw
Malware Config
Signatures
-
Njrat family
-
Executes dropped EXE 1 IoCs
pid Process 2172 Client.exe -
Loads dropped DLL 1 IoCs
pid Process 636 Test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2172 Client.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe Token: SeIncBasePriorityPrivilege 2172 Client.exe Token: 33 2172 Client.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 636 wrote to memory of 2172 636 Test.exe 29 PID 636 wrote to memory of 2172 636 Test.exe 29 PID 636 wrote to memory of 2172 636 Test.exe 29 PID 636 wrote to memory of 2172 636 Test.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Test.exe"C:\Users\Admin\AppData\Local\Temp\Test.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Roaming\Client.exe"C:\Users\Admin\AppData\Roaming\Client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165KB
MD589bb71a10666ea7e3a9270cf0fd83edf
SHA1acef4b4f60da3eea5ef3af52910a603196be7515
SHA256f5fa74671c7f2a5893d6d1bbee66dd0ac4fdd70d0cd15fda7dc70c935461ac08
SHA512f437c03612d963f1fa9d9c4a286ca4807606040a78fc911bafa1e49a7096d7cd963cbd2b094ba3e7ea7c3493801af3f4ccac3c4b006d3a9299b8b21682a36a87