Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
-.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
-.exe
Resource
win10v2004-20250129-en
General
-
Target
-.exe
-
Size
293KB
-
MD5
f06c6102d8eed12fa80b65b770e588e2
-
SHA1
718557418828ee4b3ef339e1c60c336c7596b9f5
-
SHA256
f63b594918769824db79881c51639de7de00dedd298f5852fe3f7ff301f2e7c8
-
SHA512
747cadee10bf202b39d84031cdc173af0ab07830249777e81d7a8d24c3e456d79160be40e99817b9c92ac033a57a97259d0a78cbc23f4760d6a6f03d0368dc66
-
SSDEEP
6144:ANtJxpaifYUc9UbvpUXjCzyz+wgzOuxOFe5HPSwusGcuI:EpaQ0UzpLyqwOOuOe5Hfudc
Malware Config
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
F9t family
package-foods.gl.at.ply.gg:41749
e3a50f6652cdfc171e08492715312126
-
reg_key
e3a50f6652cdfc171e08492715312126
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
-
Executes dropped EXE 1 IoCs
pid Process 1200 .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language .exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe 1200 .exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1888 -.exe Token: SeDebugPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe Token: 33 1200 .exe Token: SeIncBasePriorityPrivilege 1200 .exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1200 1888 -.exe 30 PID 1888 wrote to memory of 1200 1888 -.exe 30 PID 1888 wrote to memory of 1200 1888 -.exe 30 PID 1888 wrote to memory of 1200 1888 -.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\-.exe"C:\Users\Admin\AppData\Local\Temp\-.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5479e476b8afa5633dd44cb2c0380f18d
SHA1b985cd125613f47b4e0ae07fec6ef29d2622d113
SHA25647abbe32c53b67302656d86e2510968255ea5fec4118e309f9d2dea2168507e7
SHA512459a12db199d5ec4e506770ca9ff3a8eadde95f43d9680386f862f8b65cbf4fcb0cda249e542430de413a6b1fe3e862ad10af967c1fdbfcb9a4b405d92546aac