Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
899s -
max time network
900s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 06:47
General
-
Target
Testt.exe
-
Size
164KB
-
MD5
d587342b1215b330dbc927ab76372bea
-
SHA1
9e0f7137e72d794145a4ac4058d659854437257a
-
SHA256
716c7f5a754c9da82e23dede4895222165549218c076c5f23ab7b47f23b691f5
-
SHA512
36409d54c73c4441d3270017d50d1e02a9277c4f63f284a21b0c42cb584bc3e960719ad85ffdc097afbfe8cbc3dc60a162c7c936c1fbca87121f17ede0ba4b5b
-
SSDEEP
3072:4ibX/uarE3+q3orkovuvH3KnULEbKrSN3zbFLwbKu8B9a:4iX2/3KtS2bNPn
Malware Config
Signatures
-
Njrat family
-
Executes dropped EXE 1 IoCs
pid Process 2320 Client.exe -
Loads dropped DLL 1 IoCs
pid Process 2520 Testt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Testt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2320 Client.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe Token: SeIncBasePriorityPrivilege 2320 Client.exe Token: 33 2320 Client.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2320 2520 Testt.exe 30 PID 2520 wrote to memory of 2320 2520 Testt.exe 30 PID 2520 wrote to memory of 2320 2520 Testt.exe 30 PID 2520 wrote to memory of 2320 2520 Testt.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Testt.exe"C:\Users\Admin\AppData\Local\Temp\Testt.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Roaming\Client.exe"C:\Users\Admin\AppData\Roaming\Client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5d587342b1215b330dbc927ab76372bea
SHA19e0f7137e72d794145a4ac4058d659854437257a
SHA256716c7f5a754c9da82e23dede4895222165549218c076c5f23ab7b47f23b691f5
SHA51236409d54c73c4441d3270017d50d1e02a9277c4f63f284a21b0c42cb584bc3e960719ad85ffdc097afbfe8cbc3dc60a162c7c936c1fbca87121f17ede0ba4b5b