Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

b291b2c8ec...08.exe

windows7-x64

10

b291b2c8ec...08.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    180s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 15:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b291b2c8ecab8b28ec8506c39b593cf90f8911053d6215627b4ae53acf16a908.exe

  • Size

    362KB

  • MD5

    a8756c76d04c168c55055b85b4322143

  • SHA1

    7c0e2e3c78cb9f81e94a44831116f972bb77f099

  • SHA256

    b291b2c8ecab8b28ec8506c39b593cf90f8911053d6215627b4ae53acf16a908

  • SHA512

    776ffab28592e397ec40a10f753a52338813a875680889da8ec3472aa445c253827d667b966e75fdeeb032c237b9b979d347abe6a6386f8488dad0a7cfadf1a4

  • SSDEEP

    6144:85QQDGouQm342k2pdW1/8r4o3xWxa9apddmXc2hjH7Nk9G:z8GoPm342N9rhhuxZsc2hnNk9G

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b291b2c8ecab8b28ec8506c39b593cf90f8911053d6215627b4ae53acf16a908.exe
    "C:\Users\Admin\AppData\Local\Temp\b291b2c8ecab8b28ec8506c39b593cf90f8911053d6215627b4ae53acf16a908.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\b291b2c8ecab8b28ec8506c39b593cf90f8911053d6215627b4ae53acf16a908.exe
      "C:\Users\Admin\AppData\Local\Temp\b291b2c8ecab8b28ec8506c39b593cf90f8911053d6215627b4ae53acf16a908.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1108
    • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3412
        • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          PID:1152

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\AeLookupSvi.exe.log
    Filesize

    128B

    MD5

    a5dcc7c9c08af7dddd82be5b036a4416

    SHA1

    4f998ca1526d199e355ffb435bae111a2779b994

    SHA256

    e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

    SHA512

    56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Imminent\Logs\28-11-2022
    Filesize

    45B

    MD5

    6239075a60967348bcbc253d0976ca6d

    SHA1

    62d9b77ab2764d49a18029d78cfa8723ae19f06f

    SHA256

    3d6b748ffd8ca381fef385d0a9f5ff22e0f81f0524674701edf5242442950781

    SHA512

    fe2c971695e06800a536b0eb67c9748a60913771097dbcaeab955cf8a8cf74238aad54ca342fed03b26f123d2990b8ebf3ed89ab7f5e890b4efbc865a946966e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
    Filesize

    8KB

    MD5

    8b1102e104f0fc7121b4c3f1e247bcf2

    SHA1

    e611b031ff933efba52597130f717afaf961f568

    SHA256

    7371971b042d3632be65dcd2353ef8f6b35870c7b8405af4ca7f0e2d92289791

    SHA512

    91464c5288e84dff67c652856c89024d90f6cdb19fcc7ee537b93e6d9bfb82b88e65b98f0c7855f6af31ed6b94712ff3d2de6aca94fc73101c250c3bff233a16

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
    Filesize

    8KB

    MD5

    8b1102e104f0fc7121b4c3f1e247bcf2

    SHA1

    e611b031ff933efba52597130f717afaf961f568

    SHA256

    7371971b042d3632be65dcd2353ef8f6b35870c7b8405af4ca7f0e2d92289791

    SHA512

    91464c5288e84dff67c652856c89024d90f6cdb19fcc7ee537b93e6d9bfb82b88e65b98f0c7855f6af31ed6b94712ff3d2de6aca94fc73101c250c3bff233a16

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
    Filesize

    8KB

    MD5

    8b1102e104f0fc7121b4c3f1e247bcf2

    SHA1

    e611b031ff933efba52597130f717afaf961f568

    SHA256

    7371971b042d3632be65dcd2353ef8f6b35870c7b8405af4ca7f0e2d92289791

    SHA512

    91464c5288e84dff67c652856c89024d90f6cdb19fcc7ee537b93e6d9bfb82b88e65b98f0c7855f6af31ed6b94712ff3d2de6aca94fc73101c250c3bff233a16

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
    Filesize

    8KB

    MD5

    8b1102e104f0fc7121b4c3f1e247bcf2

    SHA1

    e611b031ff933efba52597130f717afaf961f568

    SHA256

    7371971b042d3632be65dcd2353ef8f6b35870c7b8405af4ca7f0e2d92289791

    SHA512

    91464c5288e84dff67c652856c89024d90f6cdb19fcc7ee537b93e6d9bfb82b88e65b98f0c7855f6af31ed6b94712ff3d2de6aca94fc73101c250c3bff233a16

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
    Filesize

    362KB

    MD5

    a8756c76d04c168c55055b85b4322143

    SHA1

    7c0e2e3c78cb9f81e94a44831116f972bb77f099

    SHA256

    b291b2c8ecab8b28ec8506c39b593cf90f8911053d6215627b4ae53acf16a908

    SHA512

    776ffab28592e397ec40a10f753a52338813a875680889da8ec3472aa445c253827d667b966e75fdeeb032c237b9b979d347abe6a6386f8488dad0a7cfadf1a4

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
    Filesize

    362KB

    MD5

    a8756c76d04c168c55055b85b4322143

    SHA1

    7c0e2e3c78cb9f81e94a44831116f972bb77f099

    SHA256

    b291b2c8ecab8b28ec8506c39b593cf90f8911053d6215627b4ae53acf16a908

    SHA512

    776ffab28592e397ec40a10f753a52338813a875680889da8ec3472aa445c253827d667b966e75fdeeb032c237b9b979d347abe6a6386f8488dad0a7cfadf1a4

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
    Filesize

    362KB

    MD5

    a8756c76d04c168c55055b85b4322143

    SHA1

    7c0e2e3c78cb9f81e94a44831116f972bb77f099

    SHA256

    b291b2c8ecab8b28ec8506c39b593cf90f8911053d6215627b4ae53acf16a908

    SHA512

    776ffab28592e397ec40a10f753a52338813a875680889da8ec3472aa445c253827d667b966e75fdeeb032c237b9b979d347abe6a6386f8488dad0a7cfadf1a4

    Download Submit

  • memory/1108-140-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1108-135-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1152-160-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1152-157-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2316-147-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2316-132-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2500-146-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2500-145-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2728-148-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2728-139-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2728-141-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3412-150-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/3412-156-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3412-159-0x0000000075410000-0x00000000759C1000-memory.dmp

    Filesize

    5.7MB

    Download