Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 16:15
Behavioral task
behavioral1
Sample
d1fb6ce7c73ac96ff29f78bc528e156b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1fb6ce7c73ac96ff29f78bc528e156b.exe
Resource
win10v2004-20250129-en
General
-
Target
d1fb6ce7c73ac96ff29f78bc528e156b.exe
-
Size
43KB
-
MD5
d1fb6ce7c73ac96ff29f78bc528e156b
-
SHA1
b330247292007e08115001a357b8e9d8ae23366b
-
SHA256
21a3e6f76e41c01ebc3193eef929486e2302fb05382251cf94c942291dad4ab9
-
SHA512
3209c3ce29fc6771b628e819abb645015c79c385b0b11d810028330c044556173cb8914bf1eedb278226bd745ddc7545bad8892f2f2dca0befb3d92dc1a97d4d
-
SSDEEP
384:LZyexy1STss7yKSVB8YYkEhrpS2dzsIij+ZsNO3PlpJKkkjh/TzF7pWnWygreT0k:ltQk4smKSn8hlrkYuXQ/ofm+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
rusjc
185.79.132.175:8000
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
Executes dropped EXE 1 IoCs
pid Process 2868 dllhost.exe -
Loads dropped DLL 1 IoCs
pid Process 2468 d1fb6ce7c73ac96ff29f78bc528e156b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1fb6ce7c73ac96ff29f78bc528e156b.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2468 d1fb6ce7c73ac96ff29f78bc528e156b.exe 2868 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe Token: 33 2868 dllhost.exe Token: SeIncBasePriorityPrivilege 2868 dllhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2868 2468 d1fb6ce7c73ac96ff29f78bc528e156b.exe 30 PID 2468 wrote to memory of 2868 2468 d1fb6ce7c73ac96ff29f78bc528e156b.exe 30 PID 2468 wrote to memory of 2868 2468 d1fb6ce7c73ac96ff29f78bc528e156b.exe 30 PID 2468 wrote to memory of 2868 2468 d1fb6ce7c73ac96ff29f78bc528e156b.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1fb6ce7c73ac96ff29f78bc528e156b.exe"C:\Users\Admin\AppData\Local\Temp\d1fb6ce7c73ac96ff29f78bc528e156b.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5d1fb6ce7c73ac96ff29f78bc528e156b
SHA1b330247292007e08115001a357b8e9d8ae23366b
SHA25621a3e6f76e41c01ebc3193eef929486e2302fb05382251cf94c942291dad4ab9
SHA5123209c3ce29fc6771b628e819abb645015c79c385b0b11d810028330c044556173cb8914bf1eedb278226bd745ddc7545bad8892f2f2dca0befb3d92dc1a97d4d