Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    178s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 18:01

General

  • Target

    0a37ecfea5074fff2de431e643e74af0.exe

  • Size

    693KB

  • MD5

    0a37ecfea5074fff2de431e643e74af0

  • SHA1

    4ff3dfa39ae7fd46772c30ff547ed935e134396f

  • SHA256

    114ad38ef50939dbc71a24923dff65aad0167b7679805d3c3a5a2fd4b6925247

  • SHA512

    7ee5854e7e3cebf76de910b47f427095c420cd27c227d74cd0c62e44f2adfc429c1abb02391cc7ca15df28a99ce471c4912d4a41fc43e234d78029f330f3c33f

  • SSDEEP

    12288:tSIzbMSwyUI2buNNqwfVsQV2wWU4dh2hPnmrTVr5i38VeUbBxjv:tSibMSws2SqwGuZUgz3kXjv

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0.exe
    "C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\Windows\SysWOW64\CMD.exe
      "CMD"
      2⤵
        PID:1508
      • C:\Windows\SysWOW64\CMD.exe
        "CMD"
        2⤵
          PID:2764
        • C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0.exe
          "C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0.exe"
          2⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Drops file in Windows directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:5060

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0.exe

        Filesize

        261KB

        MD5

        dbce389074fbbf5c3021a3419b9a46d0

        SHA1

        1b31cc5b7a071315ed12932e7611384bcb34fb64

        SHA256

        08b548a8eb26c2a65300519a973dd239750fe51299a0352755e66665fb02ea20

        SHA512

        31fa2049389502ea159410b83af659629b9b82ced022206f6660a195b0388068355342e235edd03c72c1f3105ea5bab53f72d2c8c42d6393c0539dde7fca5c4d

      • memory/4660-22-0x00000000014E0000-0x00000000015E0000-memory.dmp

        Filesize

        1024KB

      • memory/4660-21-0x0000000001A40000-0x0000000001A50000-memory.dmp

        Filesize

        64KB

      • memory/4660-4-0x00000000014E0000-0x00000000015E0000-memory.dmp

        Filesize

        1024KB

      • memory/4660-6-0x00000000014E0000-0x00000000015E0000-memory.dmp

        Filesize

        1024KB

      • memory/4660-24-0x00000000747B0000-0x0000000074D61000-memory.dmp

        Filesize

        5.7MB

      • memory/4660-1-0x00000000747B0000-0x0000000074D61000-memory.dmp

        Filesize

        5.7MB

      • memory/4660-2-0x0000000001A40000-0x0000000001A50000-memory.dmp

        Filesize

        64KB

      • memory/4660-18-0x00000000747B0000-0x0000000074D61000-memory.dmp

        Filesize

        5.7MB

      • memory/4660-23-0x00000000014E0000-0x00000000015E0000-memory.dmp

        Filesize

        1024KB

      • memory/4660-0-0x00000000747B0000-0x0000000074D61000-memory.dmp

        Filesize

        5.7MB

      • memory/5060-13-0x0000000000F50000-0x0000000000F60000-memory.dmp

        Filesize

        64KB

      • memory/5060-14-0x00000000747B0000-0x0000000074D61000-memory.dmp

        Filesize

        5.7MB

      • memory/5060-12-0x00000000747B0000-0x0000000074D61000-memory.dmp

        Filesize

        5.7MB

      • memory/5060-10-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/5060-25-0x00000000747B0000-0x0000000074D61000-memory.dmp

        Filesize

        5.7MB

      • memory/5060-26-0x0000000000F50000-0x0000000000F60000-memory.dmp

        Filesize

        64KB