Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
25s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
15/03/2025, 22:10
Static task
static1
General
-
Target
Software.exe
-
Size
1.6MB
-
MD5
db056b8fa628b67e11bd626192939d6b
-
SHA1
248ca50f39de6b6180265d19fb6eedc68bf25afc
-
SHA256
e7f04e85236f0caafe518bd96369313021969077dba1c4a6d42e694498dab04f
-
SHA512
bca1856b4bb8342c0f6d5ee19edcb420c70e6b272f087d3f8f73daa00842fa00037840a5eb5655e1445af8d578d304874323b2889f75b27136df9366df596336
-
SSDEEP
24576:ytb20pkaCqT5TBWgNQ7ayEYyM63uUOyok0ceJZwd/w9mML9eu4MaMUp46A:/Vg5tQ7ayExZO9k0waPLR4Ma25
Malware Config
Signatures
-
Imminent family
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAmOR.com.url Software.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\mamor.com.url taskmgr.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1632 set thread context of 4660 1632 Software.exe 82 PID 1632 set thread context of 5880 1632 Software.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Software.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4660 InstallUtil.exe Token: 33 4660 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4660 InstallUtil.exe Token: SeDebugPrivilege 5012 taskmgr.exe Token: SeSystemProfilePrivilege 5012 taskmgr.exe Token: SeCreateGlobalPrivilege 5012 taskmgr.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe -
Suspicious use of SendNotifyMessage 25 IoCs
pid Process 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe 5012 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4660 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1632 wrote to memory of 5880 1632 Software.exe 81 PID 1632 wrote to memory of 5880 1632 Software.exe 81 PID 1632 wrote to memory of 5880 1632 Software.exe 81 PID 1632 wrote to memory of 4660 1632 Software.exe 82 PID 1632 wrote to memory of 4660 1632 Software.exe 82 PID 1632 wrote to memory of 4660 1632 Software.exe 82 PID 1632 wrote to memory of 4660 1632 Software.exe 82 PID 1632 wrote to memory of 4660 1632 Software.exe 82 PID 1632 wrote to memory of 4660 1632 Software.exe 82 PID 1632 wrote to memory of 4660 1632 Software.exe 82 PID 1632 wrote to memory of 4660 1632 Software.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Software.exe"C:\Users\Admin\AppData\Local\Temp\Software.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:5880
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4660
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4772
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80B
MD57f5321fdd8572b5e213990536e0e172a
SHA13453ef7729ef9ff79d7f9e5a75ad5d2eb46e43c2
SHA25697305088e7cfa90c46e88ff2f71cfa331051b585f94f2231791aa855dea2ef05
SHA512702315bf40343ebe2f1911db8be5d2c07c36598ea672dc9b5f84bd4f641b6e1dbc68871d7ede259d1fa4b11b9562b01e2836a221ab6a141cc0e101ec4302d63c