Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28/11/2022, 18:25 UTC

General

  • Target

    eb975aeaaf038751aa94d25ed94e0c56107de932f236b83650ac51778ca11931.exe

  • Size

    1.4MB

  • MD5

    c3a012f02656f46f5d072571531c6525

  • SHA1

    7638c66e36ca156903cfac0ac7e69c20207e0d3c

  • SHA256

    eb975aeaaf038751aa94d25ed94e0c56107de932f236b83650ac51778ca11931

  • SHA512

    c4c61117ea017da1b5a4da8569ac5c0df95409408fa8f26a5950b38c188f677dd247a7d8988968d7231273f8e8e43accd389b59a42bf962f8c85d1706001fc00

  • SSDEEP

    12288:8qOIM5nP5WBPS8n/iN6cg1wFIa0FsMps:8qA5nRkPTn/iZZItOMps

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb975aeaaf038751aa94d25ed94e0c56107de932f236b83650ac51778ca11931.exe
    "C:\Users\Admin\AppData\Local\Temp\eb975aeaaf038751aa94d25ed94e0c56107de932f236b83650ac51778ca11931.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Users\Admin\AppData\Roaming\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Users\Admin\AppData\Roaming\csrss.exe
        "C:\Users\Admin\AppData\Roaming\csrss.exe" -reg "explorer.exe, C:\Users\Admin\AppData\Roaming\winlogon.exe" -proc 1564 C:\Users\Admin\AppData\Roaming\winlogon.exe
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1560

Network

  • flag-unknown
    DNS
    alienware123.duckdns.org
    winlogon.exe
    Remote address:
    8.8.8.8:53
    Request
    alienware123.duckdns.org
    IN A
    Response
    alienware123.duckdns.org
    IN A
    192.169.69.26
  • 192.169.69.26:9003
    alienware123.duckdns.org
    winlogon.exe
    148 B
    88 B
    3
    2
  • 192.169.69.26:9003
    alienware123.duckdns.org
    winlogon.exe
    98 B
    44 B
    2
    1
  • 8.8.8.8:53
    alienware123.duckdns.org
    dns
    winlogon.exe
    70 B
    86 B
    1
    1

    DNS Request

    alienware123.duckdns.org

    DNS Response

    192.169.69.26

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\csrss.exe

    Filesize

    1.4MB

    MD5

    c3a012f02656f46f5d072571531c6525

    SHA1

    7638c66e36ca156903cfac0ac7e69c20207e0d3c

    SHA256

    eb975aeaaf038751aa94d25ed94e0c56107de932f236b83650ac51778ca11931

    SHA512

    c4c61117ea017da1b5a4da8569ac5c0df95409408fa8f26a5950b38c188f677dd247a7d8988968d7231273f8e8e43accd389b59a42bf962f8c85d1706001fc00

  • C:\Users\Admin\AppData\Roaming\csrss.exe

    Filesize

    1.4MB

    MD5

    c3a012f02656f46f5d072571531c6525

    SHA1

    7638c66e36ca156903cfac0ac7e69c20207e0d3c

    SHA256

    eb975aeaaf038751aa94d25ed94e0c56107de932f236b83650ac51778ca11931

    SHA512

    c4c61117ea017da1b5a4da8569ac5c0df95409408fa8f26a5950b38c188f677dd247a7d8988968d7231273f8e8e43accd389b59a42bf962f8c85d1706001fc00

  • \Users\Admin\AppData\Roaming\csrss.exe

    Filesize

    1.4MB

    MD5

    c3a012f02656f46f5d072571531c6525

    SHA1

    7638c66e36ca156903cfac0ac7e69c20207e0d3c

    SHA256

    eb975aeaaf038751aa94d25ed94e0c56107de932f236b83650ac51778ca11931

    SHA512

    c4c61117ea017da1b5a4da8569ac5c0df95409408fa8f26a5950b38c188f677dd247a7d8988968d7231273f8e8e43accd389b59a42bf962f8c85d1706001fc00

  • \Users\Admin\AppData\Roaming\csrss.exe

    Filesize

    1.4MB

    MD5

    c3a012f02656f46f5d072571531c6525

    SHA1

    7638c66e36ca156903cfac0ac7e69c20207e0d3c

    SHA256

    eb975aeaaf038751aa94d25ed94e0c56107de932f236b83650ac51778ca11931

    SHA512

    c4c61117ea017da1b5a4da8569ac5c0df95409408fa8f26a5950b38c188f677dd247a7d8988968d7231273f8e8e43accd389b59a42bf962f8c85d1706001fc00

  • memory/1560-65-0x0000000074360000-0x000000007490B000-memory.dmp

    Filesize

    5.7MB

  • memory/1560-67-0x0000000074360000-0x000000007490B000-memory.dmp

    Filesize

    5.7MB

  • memory/1564-58-0x0000000074360000-0x000000007490B000-memory.dmp

    Filesize

    5.7MB

  • memory/1564-66-0x0000000074360000-0x000000007490B000-memory.dmp

    Filesize

    5.7MB

  • memory/1948-54-0x0000000076031000-0x0000000076033000-memory.dmp

    Filesize

    8KB

  • memory/1948-57-0x0000000074360000-0x000000007490B000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.