Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2023, 13:42

General

  • Target

    PURCHASE ORDER RFQ_CF-170419S3_.exe

  • Size

    1.1MB

  • MD5

    10e0c2c544c56f8bb1deb536590606ff

  • SHA1

    99a8d3a2bc97c8941d0c78bb655e2d57244706f4

  • SHA256

    77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

  • SHA512

    3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

  • SSDEEP

    24576:LCMmK3Aw7NM0AiSYLaTm4W0hZEd3/2dhJgM9bObUtv:LC+7q0tqT5No6wMl8Ut

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER RFQ_CF-170419S3_.exe
    "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER RFQ_CF-170419S3_.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:892
    • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
      C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
        3⤵
          PID:2044
        • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
          C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:964
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
            4⤵
              PID:1924
            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
              C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:972
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
                5⤵
                  PID:1384
                • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                  C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1576
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
                    6⤵
                      PID:1732
                    • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                      C:\Users\Admin\AppData\Local\Temp\VQwinup.exe
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2012
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
                        7⤵
                          PID:388

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\TYboDhwl\VQHHtUoO.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • C:\Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • \Users\Admin\AppData\Local\Temp\VQwinup.exe

              Filesize

              1.1MB

              MD5

              10e0c2c544c56f8bb1deb536590606ff

              SHA1

              99a8d3a2bc97c8941d0c78bb655e2d57244706f4

              SHA256

              77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d

              SHA512

              3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea

            • memory/388-163-0x00000000747C0000-0x0000000074D6B000-memory.dmp

              Filesize

              5.7MB

            • memory/892-68-0x00000000747C0000-0x0000000074D6B000-memory.dmp

              Filesize

              5.7MB

            • memory/892-65-0x00000000747C0000-0x0000000074D6B000-memory.dmp

              Filesize

              5.7MB

            • memory/892-63-0x0000000000400000-0x000000000045A000-memory.dmp

              Filesize

              360KB

            • memory/892-61-0x0000000000400000-0x000000000045A000-memory.dmp

              Filesize

              360KB

            • memory/892-58-0x0000000000400000-0x000000000045A000-memory.dmp

              Filesize

              360KB

            • memory/964-94-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/964-97-0x00000000033E0000-0x00000000034D5000-memory.dmp

              Filesize

              980KB

            • memory/964-108-0x00000000033E0000-0x00000000034D5000-memory.dmp

              Filesize

              980KB

            • memory/964-107-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/964-112-0x00000000033E0000-0x00000000034D5000-memory.dmp

              Filesize

              980KB

            • memory/964-96-0x0000000001EE0000-0x0000000001FD5000-memory.dmp

              Filesize

              980KB

            • memory/972-126-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/972-115-0x0000000002090000-0x0000000002185000-memory.dmp

              Filesize

              980KB

            • memory/972-113-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/972-116-0x00000000034F0000-0x00000000035E5000-memory.dmp

              Filesize

              980KB

            • memory/972-127-0x00000000034F0000-0x00000000035E5000-memory.dmp

              Filesize

              980KB

            • memory/972-131-0x00000000034F0000-0x00000000035E5000-memory.dmp

              Filesize

              980KB

            • memory/1384-125-0x00000000747C0000-0x0000000074D6B000-memory.dmp

              Filesize

              5.7MB

            • memory/1576-132-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1576-150-0x00000000035A0000-0x0000000003695000-memory.dmp

              Filesize

              980KB

            • memory/1576-146-0x00000000035A0000-0x0000000003695000-memory.dmp

              Filesize

              980KB

            • memory/1576-145-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1576-135-0x00000000035A0000-0x0000000003695000-memory.dmp

              Filesize

              980KB

            • memory/1576-134-0x00000000020E0000-0x00000000021D5000-memory.dmp

              Filesize

              980KB

            • memory/1732-144-0x00000000747C0000-0x0000000074D6B000-memory.dmp

              Filesize

              5.7MB

            • memory/1768-78-0x00000000033D0000-0x00000000034C5000-memory.dmp

              Filesize

              980KB

            • memory/1768-88-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1768-77-0x0000000002C40000-0x0000000002D35000-memory.dmp

              Filesize

              980KB

            • memory/1768-74-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/1768-93-0x00000000033D0000-0x00000000034C5000-memory.dmp

              Filesize

              980KB

            • memory/1768-89-0x00000000033D0000-0x00000000034C5000-memory.dmp

              Filesize

              980KB

            • memory/1924-106-0x00000000747C0000-0x0000000074D6B000-memory.dmp

              Filesize

              5.7MB

            • memory/2012-151-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/2012-164-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/2012-154-0x00000000033F0000-0x00000000034E5000-memory.dmp

              Filesize

              980KB

            • memory/2012-153-0x0000000001E80000-0x0000000001F75000-memory.dmp

              Filesize

              980KB

            • memory/2016-73-0x0000000003410000-0x0000000003505000-memory.dmp

              Filesize

              980KB

            • memory/2016-54-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/2016-66-0x0000000000400000-0x00000000004FF000-memory.dmp

              Filesize

              1020KB

            • memory/2016-67-0x0000000003410000-0x0000000003505000-memory.dmp

              Filesize

              980KB

            • memory/2016-57-0x0000000003410000-0x0000000003505000-memory.dmp

              Filesize

              980KB

            • memory/2016-56-0x0000000002030000-0x0000000002125000-memory.dmp

              Filesize

              980KB

            • memory/2016-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

              Filesize

              8KB

            • memory/2044-87-0x00000000747C0000-0x0000000074D6B000-memory.dmp

              Filesize

              5.7MB