Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
06/02/2025, 16:15
Behavioral task
behavioral1
Sample
d1fb6ce7c73ac96ff29f78bc528e156b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1fb6ce7c73ac96ff29f78bc528e156b.exe
Resource
win10v2004-20250129-en
General
-
Target
d1fb6ce7c73ac96ff29f78bc528e156b.exe
-
Size
43KB
-
MD5
d1fb6ce7c73ac96ff29f78bc528e156b
-
SHA1
b330247292007e08115001a357b8e9d8ae23366b
-
SHA256
21a3e6f76e41c01ebc3193eef929486e2302fb05382251cf94c942291dad4ab9
-
SHA512
3209c3ce29fc6771b628e819abb645015c79c385b0b11d810028330c044556173cb8914bf1eedb278226bd745ddc7545bad8892f2f2dca0befb3d92dc1a97d4d
-
SSDEEP
384:LZyexy1STss7yKSVB8YYkEhrpS2dzsIij+ZsNO3PlpJKkkjh/TzF7pWnWygreT0k:ltQk4smKSn8hlrkYuXQ/ofm+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
rusjc
185.79.132.175:8000
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation d1fb6ce7c73ac96ff29f78bc528e156b.exe -
Executes dropped EXE 1 IoCs
pid Process 5004 dllhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1fb6ce7c73ac96ff29f78bc528e156b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4512 d1fb6ce7c73ac96ff29f78bc528e156b.exe 5004 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe Token: 33 5004 dllhost.exe Token: SeIncBasePriorityPrivilege 5004 dllhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4512 wrote to memory of 5004 4512 d1fb6ce7c73ac96ff29f78bc528e156b.exe 94 PID 4512 wrote to memory of 5004 4512 d1fb6ce7c73ac96ff29f78bc528e156b.exe 94 PID 4512 wrote to memory of 5004 4512 d1fb6ce7c73ac96ff29f78bc528e156b.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1fb6ce7c73ac96ff29f78bc528e156b.exe"C:\Users\Admin\AppData\Local\Temp\d1fb6ce7c73ac96ff29f78bc528e156b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5d1fb6ce7c73ac96ff29f78bc528e156b
SHA1b330247292007e08115001a357b8e9d8ae23366b
SHA25621a3e6f76e41c01ebc3193eef929486e2302fb05382251cf94c942291dad4ab9
SHA5123209c3ce29fc6771b628e819abb645015c79c385b0b11d810028330c044556173cb8914bf1eedb278226bd745ddc7545bad8892f2f2dca0befb3d92dc1a97d4d