Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
825s -
max time network
830s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08/02/2025, 11:38
Behavioral task
behavioral1
Sample
nkth.exe
Resource
win10ltsc2021-20250207-en
windows10-ltsc 2021-x64
28 signatures
900 seconds
Behavioral task
behavioral2
Sample
nkth.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
900 seconds
Behavioral task
behavioral3
Sample
nkth.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
23 signatures
900 seconds
Behavioral task
behavioral4
Sample
nkth.exe
Resource
win10ltsc2021-20250207-en
windows10-ltsc 2021-x64
23 signatures
900 seconds
Behavioral task
behavioral5
Sample
nkth.exe
Resource
win11-20250207-en
windows11-21h2-x64
24 signatures
900 seconds
Errors
Reason
Machine shutdown
General
-
Target
nkth.exe
-
Size
55KB
-
MD5
33644523cb6a6c01bbf2dd5c3a97aafc
-
SHA1
7fd0d35a09a32693d30ffdb49ecd69c1229d2a20
-
SHA256
e451ebc803766d533d92baf458485284fb64cc3e8d4491cf410ea7fb2d5ded45
-
SHA512
43bddd6e1cd6acf040fec6d2b51afd86daa0f5f8ef7990b7dab2e9a42bdcdec5fede30d0510e6fdfd1cb08a4028e5057061f7c4e91a8b5a300ae1af9505cef2b
-
SSDEEP
1536:5EOADn6cpNPmSpVcDGiwsNMDdXExI3pmsm:bADn6cPzLcDGiwsNMDdXExI3pm
Malware Config
Signatures
-
Njrat family
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nkth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2304 nkth.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe Token: SeIncBasePriorityPrivilege 2304 nkth.exe Token: 33 2304 nkth.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2724 2304 nkth.exe 30 PID 2304 wrote to memory of 2724 2304 nkth.exe 30 PID 2304 wrote to memory of 2724 2304 nkth.exe 30 PID 2304 wrote to memory of 2724 2304 nkth.exe 30 PID 2724 wrote to memory of 2108 2724 cmd.exe 32 PID 2724 wrote to memory of 2108 2724 cmd.exe 32 PID 2724 wrote to memory of 2108 2724 cmd.exe 32 PID 2724 wrote to memory of 2108 2724 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\nkth.exe"C:\Users\Admin\AppData\Local\Temp\nkth.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.execmd /c start shutdown /s /f /t 02⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\shutdown.exeshutdown /s /f /t 03⤵
- System Location Discovery: System Language Discovery
PID:2108
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2572
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1768