Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7683611bcb...8b.exe

windows7-x64

10

7683611bcb...8b.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    189s
  • max time network
    204s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25/11/2022, 20:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7683611bcbfa27b9806e229e7fe1cc6ac0df3e593a1fae55badc85f9e064ea8b.exe

  • Size

    545KB

  • MD5

    d720ccaaf30a34475934869bee3d6f8d

  • SHA1

    20286177c8652beaf43c78e7ddd75331ae126954

  • SHA256

    7683611bcbfa27b9806e229e7fe1cc6ac0df3e593a1fae55badc85f9e064ea8b

  • SHA512

    9df4f4052359c89c893c7d27e0b6cbbede2b48acf615afdd591b18c666490b823493e2aa16cfc20b0a63b204047e2b4803c86c0011bbc75663d3f3b7a1c6bfa9

  • SSDEEP

    12288:mS80B7rivHM5aHWC+fO1k/X5l73srf8Y99LZQW2p:mSXWMMHz+feeR8oY99lQW4

Score
10/10
imminentspywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7683611bcbfa27b9806e229e7fe1cc6ac0df3e593a1fae55badc85f9e064ea8b.exe
    "C:\Users\Admin\AppData\Local\Temp\7683611bcbfa27b9806e229e7fe1cc6ac0df3e593a1fae55badc85f9e064ea8b.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Google Update" /XML "C:\Users\Admin\AppData\Local\Temp\alllll.xml"
      2⤵
      • Creates scheduled task(s)
      PID:1656
    • C:\Users\Admin\AppData\Local\Temp\peverify.exe
      "C:\Users\Admin\AppData\Local\Temp\peverify.exe" -woohoo 1892 C:\Users\Admin\AppData\Local\Temp\chrome.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_FB6BD2AF592BD59C48D4520A31AC1EA3
    Filesize

    1KB

    MD5

    b62f90393051a756277b5cb67a93dd52

    SHA1

    ce29407e24e5cf8843d6981de07e21b0b79eecbc

    SHA256

    4363f4bedd41d3e5fe4d5e24959d6f0f46e920bca530056f87f6ad267431c003

    SHA512

    af281ca94e999aa97e97807d59cab4593d462759f98358e25e3284ae9f5ef48f421209fd5f8143b0397284672e1dc508ebc5b043ed0f93e58390f414b4ba0d20

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
    Filesize

    834B

    MD5

    2f9af8e0d783cfa432c7041713c8f5ee

    SHA1

    974e325ade4fd9e3f450913e8269c78d1ef4836a

    SHA256

    b4c71719b03d24adf1b8d89707cdf20e2b0be78c58686d78c340da6fd3a00eb3

    SHA512

    3ccb5b22dd0cb7e4841b4979d1c0aa6e921925cc9a187c88d67d6e2f19285ed4acc30424c7e481b61e215bdae8af9d4bdc9c17fada508ff0385cd9d456968c72

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_FB6BD2AF592BD59C48D4520A31AC1EA3
    Filesize

    408B

    MD5

    52994180233e97ac5053cc0f33e7d70a

    SHA1

    d19040fbd39400ac7d9cb397914b58b196e03da5

    SHA256

    a61c553809ded235b6877c1f3918f0a59321b8039d706b8b6c970bd494623bb9

    SHA512

    7e484e542d7c1cb0a9a7d496c0a18f8e85291d4254063b68d2aa7fe7b9452552176e67cd92a3f11ee01010d6a524a8b8b2fe290887c2b331de42e0da7a94850a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
    Filesize

    404B

    MD5

    bd8040db64411b8e6927c36f64f09ed6

    SHA1

    8cbbfa2d5cf0972f3c1c240e32d5316118190f95

    SHA256

    158a73e9c50ded707c9066e40e06cdf09f621fb1379d13bc807d589f3935f8d0

    SHA512

    4353ccce6a4f390a6379cec654f17ebccf6a35f37fdc232d156a93b2a9aff5ef8ecc67d7fd5867c78c4b581410ab30856966259f4734585ef9e529246cfc96ff

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
    Filesize

    188B

    MD5

    7c59bab1e585a5a01efa9cbb82b16d3b

    SHA1

    3620ed464569da0a38b28a4ef51b0ca81b90fa53

    SHA256

    8ae79b41d8314845c0a4407a5a87c5b96682d682599f6a8d31a213ae170dde68

    SHA512

    ad82bfbd5ea0455217c330d43787156574921702e6d1d611b6df5a4b2e1d5d50cae3309cd4741bbd59766eaf9d2ae719f8f52c1c819892ab5640821ae51f310d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9b432f4055f4a79c830b59d52df54d88

    SHA1

    2a77189d726c65ec2f6a01916bf4979d21665ebe

    SHA256

    d6574a40751e5acfdd0b122c3b27ebd66c6e1fabe22c3c99d3b6d83f382e7e86

    SHA512

    600929676713ad67f45330af67b17c79a047a670604e35ae174e982f1304ad23e737d3cf2d4920c5c00f6d16bd5889d2006285a7637e5fe82423f1bc0808239c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\alllll.xml
    Filesize

    1KB

    MD5

    f94100f697f7009dbe477db7a95b1a1f

    SHA1

    e4d6ae1549de01f08525215226b29cd93907456d

    SHA256

    0c041f2ad56b8bead27a2bf1866cc06a5dbc1614456a5bc8c375db300abed733

    SHA512

    416684324b78a7c981abf2cc868e7b5b01a81d58a0f6ca9ea8f02fdb9f60094144c069b4539769348bde3bbb7c3e567b569c1c57e7af5fa9cdf11bab33763dd3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\peverify.exe
    Filesize

    545KB

    MD5

    d720ccaaf30a34475934869bee3d6f8d

    SHA1

    20286177c8652beaf43c78e7ddd75331ae126954

    SHA256

    7683611bcbfa27b9806e229e7fe1cc6ac0df3e593a1fae55badc85f9e064ea8b

    SHA512

    9df4f4052359c89c893c7d27e0b6cbbede2b48acf615afdd591b18c666490b823493e2aa16cfc20b0a63b204047e2b4803c86c0011bbc75663d3f3b7a1c6bfa9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\peverify.exe
    Filesize

    545KB

    MD5

    d720ccaaf30a34475934869bee3d6f8d

    SHA1

    20286177c8652beaf43c78e7ddd75331ae126954

    SHA256

    7683611bcbfa27b9806e229e7fe1cc6ac0df3e593a1fae55badc85f9e064ea8b

    SHA512

    9df4f4052359c89c893c7d27e0b6cbbede2b48acf615afdd591b18c666490b823493e2aa16cfc20b0a63b204047e2b4803c86c0011bbc75663d3f3b7a1c6bfa9

    Download Submit

  • \Users\Admin\AppData\Local\Temp\peverify.exe
    Filesize

    545KB

    MD5

    d720ccaaf30a34475934869bee3d6f8d

    SHA1

    20286177c8652beaf43c78e7ddd75331ae126954

    SHA256

    7683611bcbfa27b9806e229e7fe1cc6ac0df3e593a1fae55badc85f9e064ea8b

    SHA512

    9df4f4052359c89c893c7d27e0b6cbbede2b48acf615afdd591b18c666490b823493e2aa16cfc20b0a63b204047e2b4803c86c0011bbc75663d3f3b7a1c6bfa9

    Download Submit

  • \Users\Admin\AppData\Local\Temp\peverify.exe
    Filesize

    545KB

    MD5

    d720ccaaf30a34475934869bee3d6f8d

    SHA1

    20286177c8652beaf43c78e7ddd75331ae126954

    SHA256

    7683611bcbfa27b9806e229e7fe1cc6ac0df3e593a1fae55badc85f9e064ea8b

    SHA512

    9df4f4052359c89c893c7d27e0b6cbbede2b48acf615afdd591b18c666490b823493e2aa16cfc20b0a63b204047e2b4803c86c0011bbc75663d3f3b7a1c6bfa9

    Download Submit

  • memory/1684-71-0x0000000074A80000-0x000000007502B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1684-72-0x0000000074A80000-0x000000007502B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1892-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1892-55-0x0000000074A80000-0x000000007502B000-memory.dmp

    Filesize

    5.7MB

    Download