Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2023, 13:40

General

  • Target

    PURCHASE ORDER RFQ_CF-170419S3_.exe

  • Size

    1.1MB

  • MD5

    10e0c2c544c56f8bb1deb536590606ff

  • SHA1

    99a8d3a2bc97c8941d0c78bb655e2d57244706f4

  • SHA256

    77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

  • SHA512

    3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

  • SSDEEP

    24576:LCMmK3Aw7NM0AiSYLaTm4W0hZEd3/2dhJgM9bObUtv:LC+7q0tqT5No6wMl8Ut

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER RFQ_CF-170419S3_.exe
    "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER RFQ_CF-170419S3_.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1736
    • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
      C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
        3⤵
          PID:276
        • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
          C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:840
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
            4⤵
              PID:1600
            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
              C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1036
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
                5⤵
                  PID:1244
                • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                  C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:636
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
                    6⤵
                      PID:288
                    • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                      C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1128
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
                        7⤵
                          PID:896
                        • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                          C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                          7⤵
                          • Executes dropped EXE
                          PID:760

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • memory/276-88-0x00000000747B0000-0x0000000074D5B000-memory.dmp

              Filesize

              5.7MB

            • memory/288-146-0x00000000747B0000-0x0000000074D5B000-memory.dmp

              Filesize

              5.7MB

            • memory/288-149-0x00000000747B0000-0x0000000074D5B000-memory.dmp

              Filesize

              5.7MB

            • memory/636-152-0x0000000003480000-0x0000000003575000-memory.dmp

              Filesize

              980KB

            • memory/636-134-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/636-137-0x0000000001F30000-0x0000000002025000-memory.dmp

              Filesize

              980KB

            • memory/636-148-0x0000000003480000-0x0000000003575000-memory.dmp

              Filesize

              980KB

            • memory/636-147-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/636-138-0x0000000003480000-0x0000000003575000-memory.dmp

              Filesize

              980KB

            • memory/840-96-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/840-98-0x00000000020D0000-0x00000000021C5000-memory.dmp

              Filesize

              980KB

            • memory/840-99-0x00000000034B0000-0x00000000035A5000-memory.dmp

              Filesize

              980KB

            • memory/840-109-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/840-110-0x00000000034B0000-0x00000000035A5000-memory.dmp

              Filesize

              980KB

            • memory/840-113-0x00000000034B0000-0x00000000035A5000-memory.dmp

              Filesize

              980KB

            • memory/896-166-0x00000000747B0000-0x0000000074D5B000-memory.dmp

              Filesize

              5.7MB

            • memory/1036-129-0x0000000003450000-0x0000000003545000-memory.dmp

              Filesize

              980KB

            • memory/1036-128-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1036-115-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1036-117-0x0000000002CC0000-0x0000000002DB5000-memory.dmp

              Filesize

              980KB

            • memory/1036-118-0x0000000003450000-0x0000000003545000-memory.dmp

              Filesize

              980KB

            • memory/1036-132-0x0000000003450000-0x0000000003545000-memory.dmp

              Filesize

              980KB

            • memory/1120-75-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1120-90-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1120-95-0x00000000033B0000-0x00000000034A5000-memory.dmp

              Filesize

              980KB

            • memory/1120-80-0x00000000033B0000-0x00000000034A5000-memory.dmp

              Filesize

              980KB

            • memory/1120-91-0x00000000033B0000-0x00000000034A5000-memory.dmp

              Filesize

              980KB

            • memory/1120-79-0x0000000002C20000-0x0000000002D15000-memory.dmp

              Filesize

              980KB

            • memory/1128-154-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1128-171-0x0000000003460000-0x0000000003555000-memory.dmp

              Filesize

              980KB

            • memory/1128-168-0x0000000003460000-0x0000000003555000-memory.dmp

              Filesize

              980KB

            • memory/1128-167-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1128-157-0x0000000003460000-0x0000000003555000-memory.dmp

              Filesize

              980KB

            • memory/1128-156-0x0000000001FC0000-0x00000000020B5000-memory.dmp

              Filesize

              980KB

            • memory/1244-127-0x00000000747B0000-0x0000000074D5B000-memory.dmp

              Filesize

              5.7MB

            • memory/1600-108-0x00000000747B0000-0x0000000074D5B000-memory.dmp

              Filesize

              5.7MB

            • memory/1736-65-0x00000000747B0000-0x0000000074D5B000-memory.dmp

              Filesize

              5.7MB

            • memory/1736-63-0x0000000000400000-0x000000000045A000-memory.dmp

              Filesize

              360KB

            • memory/1736-58-0x0000000000400000-0x000000000045A000-memory.dmp

              Filesize

              360KB

            • memory/1736-61-0x0000000000400000-0x000000000045A000-memory.dmp

              Filesize

              360KB

            • memory/1736-68-0x00000000747B0000-0x0000000074D5B000-memory.dmp

              Filesize

              5.7MB

            • memory/2024-74-0x00000000039D0000-0x0000000003ACF000-memory.dmp

              Filesize

              1020KB

            • memory/2024-89-0x00000000039D0000-0x0000000003ACF000-memory.dmp

              Filesize

              1020KB

            • memory/2024-57-0x0000000003400000-0x00000000034F5000-memory.dmp

              Filesize

              980KB

            • memory/2024-72-0x0000000003400000-0x00000000034F5000-memory.dmp

              Filesize

              980KB

            • memory/2024-54-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/2024-56-0x0000000002BC0000-0x0000000002CB5000-memory.dmp

              Filesize

              980KB

            • memory/2024-67-0x0000000003400000-0x00000000034F5000-memory.dmp

              Filesize

              980KB

            • memory/2024-66-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/2024-55-0x00000000760B1000-0x00000000760B3000-memory.dmp

              Filesize

              8KB