Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
893s -
max time network
891s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 06:45
General
-
Target
Test 1.exe
-
Size
164KB
-
MD5
53cd002afbbb65a11515704f6e18bfe3
-
SHA1
3d8d6d56539eb250dea302d863cc7c69c02b23a3
-
SHA256
f3bbae36cbd8b197ff0073b295c730674150a18aa7cb32bdd4aad76a250ab66d
-
SHA512
6414fb60e857ca368879db4fefa9267c26aaf4bc7b39fbfbb6fdb3bdefdbfa688fe024df1d45fe3e93ee440801b63b735d8efd2759f22f2cd5ba479a5fe429e9
-
SSDEEP
3072:Z6+5/MJvJ7VXVM64gb2dPHELcYyPdYb7EINhn:Z6ZbhCdMtyOboIX
Malware Config
Signatures
-
Njrat family
-
Executes dropped EXE 1 IoCs
pid Process 2944 Client.exe -
Loads dropped DLL 1 IoCs
pid Process 1316 Test 1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Test 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2944 Client.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe Token: SeIncBasePriorityPrivilege 2944 Client.exe Token: 33 2944 Client.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1316 wrote to memory of 2944 1316 Test 1.exe 30 PID 1316 wrote to memory of 2944 1316 Test 1.exe 30 PID 1316 wrote to memory of 2944 1316 Test 1.exe 30 PID 1316 wrote to memory of 2944 1316 Test 1.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Test 1.exe"C:\Users\Admin\AppData\Local\Temp\Test 1.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Roaming\Client.exe"C:\Users\Admin\AppData\Roaming\Client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD553cd002afbbb65a11515704f6e18bfe3
SHA13d8d6d56539eb250dea302d863cc7c69c02b23a3
SHA256f3bbae36cbd8b197ff0073b295c730674150a18aa7cb32bdd4aad76a250ab66d
SHA5126414fb60e857ca368879db4fefa9267c26aaf4bc7b39fbfbb6fdb3bdefdbfa688fe024df1d45fe3e93ee440801b63b735d8efd2759f22f2cd5ba479a5fe429e9