Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Imeitu.exe
windows7-x64
7Imeitu.exe
windows10-2004-x64
7MSINET.dll
windows7-x64
1MSINET.dll
windows10-2004-x64
1gnsdk_musicid.dll
windows7-x64
1gnsdk_musicid.dll
windows10-2004-x64
1小云工�...��.exe
windows7-x64
1小云工�...��.exe
windows10-2004-x64
1查看最�...��.url
windows7-x64
1查看最�...��.url
windows10-2004-x64
1运行不�...��.url
windows7-x64
1运行不�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 02:41
Behavioral task
behavioral1
Sample
Imeitu.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Imeitu.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
MSINET.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
MSINET.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
gnsdk_musicid.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
gnsdk_musicid.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
小云工作室最新版本.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
小云工作室最新版本.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
查看最新版本.url
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
查看最新版本.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
运行不了请看这里.url
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
运行不了请看这里.url
Resource
win10v2004-20231215-en
General
-
Target
Imeitu.exe
-
Size
101KB
-
MD5
adac8f8f217a5c2ae417c2f299c6dd43
-
SHA1
f1f19fcb72d6e88475fb8816312b9f2989fadb17
-
SHA256
fd68657bd13a87f23668d41f5c7d45ca2dd8422569bd31da0e72d06cbe8dd6b9
-
SHA512
8ea7f58dec4e04928c9660f06e7a4c8bba31ef943922f953c1736c7d3d805278c60e46f304d9fa265639638516feee79ea4d0e3c198b4ba9413580f211cfdf35
-
SSDEEP
3072:SHgm+HaBorwige2WPGptgZ9zLlL1+RtSFFx9r:SN+HTr4epuptGDfvh
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3068-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/3068-14-0x0000000000400000-0x0000000000423000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3068 Imeitu.exe Token: SeBackupPrivilege 3068 Imeitu.exe