Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 09:10

General

  • Target

    24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe

  • Size

    908KB

  • MD5

    58af7b91af918aaaf0517c50728ea7ed

  • SHA1

    a36361938df502286245392342b9f5d0c214ac94

  • SHA256

    24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49

  • SHA512

    abfceb84ae216b4f92a7290d4d3ad0e7bb845026ea760d3d948479a792b1fbe8a526298ed5df8f4a4b7401aa8afc773f2920ea04be43e04b239f8586259840c6

  • SSDEEP

    12288:QqjqRBa80gi+TCUQpd6KA26mY6nltHnhm9FXRN:QwqN0gi+TCUQvHEFXb

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe
    "C:\Users\Admin\AppData\Local\Temp\24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Users\Admin\AppData\Roaming\model\print.exe
      "C:\Users\Admin\AppData\Roaming\model\print.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1852
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1808

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Roaming\model\print.exe

      Filesize

      908KB

      MD5

      708573e1307a8a8eff341f1a4e183777

      SHA1

      d835069fb5f14e989803dd251a5eace94a264888

      SHA256

      5a64ea4078046e2518137bf0c82acecec8a40944e0300de46aa3bfe1ddc21df1

      SHA512

      8e06b66e8d48a3fc86db04abb2c0c65756258a5a1366ae35d327bf14ea0477737fed42659135fb49eb4ddae172309e2f48f8c9b092d30ee5b816dccdbdb390af

    • memory/1852-23-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1852-31-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1852-38-0x0000000000510000-0x0000000000526000-memory.dmp

      Filesize

      88KB

    • memory/1852-37-0x00000000003C0000-0x00000000003E8000-memory.dmp

      Filesize

      160KB

    • memory/1852-36-0x0000000004AF0000-0x0000000004B9E000-memory.dmp

      Filesize

      696KB

    • memory/1852-21-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1852-33-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1852-29-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1852-25-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1852-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1852-22-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1852-35-0x0000000000210000-0x0000000000220000-memory.dmp

      Filesize

      64KB

    • memory/2252-0-0x00000000749EE000-0x00000000749EF000-memory.dmp

      Filesize

      4KB

    • memory/2252-3-0x00000000749E0000-0x00000000750CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2252-4-0x00000000749EE000-0x00000000749EF000-memory.dmp

      Filesize

      4KB

    • memory/2252-5-0x00000000749E0000-0x00000000750CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2252-1-0x0000000000C60000-0x0000000000D3E000-memory.dmp

      Filesize

      888KB

    • memory/2252-2-0x00000000004E0000-0x00000000004E8000-memory.dmp

      Filesize

      32KB

    • memory/2252-15-0x00000000749E0000-0x00000000750CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2528-17-0x00000000749E0000-0x00000000750CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2528-14-0x00000000749E0000-0x00000000750CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2528-34-0x00000000749E0000-0x00000000750CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2528-16-0x0000000000940000-0x0000000000A1E000-memory.dmp

      Filesize

      888KB

    • memory/2528-20-0x0000000002020000-0x0000000002078000-memory.dmp

      Filesize

      352KB

    • memory/2528-18-0x00000000749E0000-0x00000000750CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2528-19-0x00000000749E0000-0x00000000750CE000-memory.dmp

      Filesize

      6.9MB