Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 12:30

General

  • Target

    94baf96aef2ab66cb33ef5829eed04ec1a204a235876ef584a789c1bdee33754.exe

  • Size

    272KB

  • MD5

    a2717ce0070c8eaf767c3926eab77470

  • SHA1

    5185dc1f24769a92a4df8dfacd926694339fabd7

  • SHA256

    94baf96aef2ab66cb33ef5829eed04ec1a204a235876ef584a789c1bdee33754

  • SHA512

    fa9e61c568e8f3f1c0468ef7f01f5e7ba7acf8fe5b38bf36ead9284b51a6906e01e558d88e4ec21ac3e54b74db37e2584d6984cc3d87f66026081595afdee15b

  • SSDEEP

    6144:lCe1plYF6fR+rs60XwP/1FVKQy2Mrl/omDctl:lCe1plYF65XAlF4LlBDI

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94baf96aef2ab66cb33ef5829eed04ec1a204a235876ef584a789c1bdee33754.exe
    "C:\Users\Admin\AppData\Local\Temp\94baf96aef2ab66cb33ef5829eed04ec1a204a235876ef584a789c1bdee33754.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Windows directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4876-132-0x0000000075360000-0x0000000075911000-memory.dmp

    Filesize

    5.7MB

  • memory/4876-133-0x0000000075360000-0x0000000075911000-memory.dmp

    Filesize

    5.7MB