Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    71s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 14:33

General

  • Target

    3bff6d6cad0c4ba59578cc5027c088406bcfebf18af1a0af0db3862128d14f46.exe

  • Size

    270KB

  • MD5

    b45b717cd5371a8be8e6a472ce0e02a1

  • SHA1

    41439c8a3d8012e3aee1f08e9b4c072cf2bb07d5

  • SHA256

    3bff6d6cad0c4ba59578cc5027c088406bcfebf18af1a0af0db3862128d14f46

  • SHA512

    8ce0ac18bd3e6c21ef5173c637fcdcce03373b972e6f553964a77d5f830566e4a1855ddc2aa20a943a04bcf5584e8c6ed62fcc600235ed9702bb7edebc1b7468

  • SSDEEP

    6144:NW9Ak9dCngaxBA3s+mUNkwxCKq7pNZNyDV790LB3/Mzefjctl0Y:NWqknCUsDYkwUKuJAVJ0NBfjI0Y

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bff6d6cad0c4ba59578cc5027c088406bcfebf18af1a0af0db3862128d14f46.exe
    "C:\Users\Admin\AppData\Local\Temp\3bff6d6cad0c4ba59578cc5027c088406bcfebf18af1a0af0db3862128d14f46.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1544-54-0x0000000074C41000-0x0000000074C43000-memory.dmp

    Filesize

    8KB

  • memory/1544-55-0x0000000074150000-0x00000000746FB000-memory.dmp

    Filesize

    5.7MB

  • memory/1544-56-0x0000000074150000-0x00000000746FB000-memory.dmp

    Filesize

    5.7MB