Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
07/07/2020, 09:12
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Document BL,INV and packing list.jpg.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Shipment Document BL,INV and packing list.jpg.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
Shipment Document BL,INV and packing list.jpg.exe
-
Size
659KB
-
MD5
fe59b9e260519d6227ff7e239c9d0a04
-
SHA1
577f9d0d5fd671a83caad0cfe241fbf724d372fc
-
SHA256
57294ac308436e17b7e99da25f3d0fa1eb0a466572bed8ee736e078d0dc8042f
-
SHA512
30f90794a594bb0f68f04089f4f367d7251e24c25d073386eb6f2df7d847d558ea859d4404632d069041ac0157952db95f13e064fef5f3a968dd227a341eea59
Score
10/10
Malware Config
Extracted
Family
remcos
C2
hussanm.duckdns.org:7652
Signatures
-
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1084 1060 Shipment Document BL,INV and packing list.jpg.exe 24 PID 1060 wrote to memory of 1084 1060 Shipment Document BL,INV and packing list.jpg.exe 24 PID 1060 wrote to memory of 1084 1060 Shipment Document BL,INV and packing list.jpg.exe 24 PID 1060 wrote to memory of 1084 1060 Shipment Document BL,INV and packing list.jpg.exe 24 PID 1084 wrote to memory of 1312 1084 Shipment Document BL,INV and packing list.jpg.exe 25 PID 1084 wrote to memory of 1312 1084 Shipment Document BL,INV and packing list.jpg.exe 25 PID 1084 wrote to memory of 1312 1084 Shipment Document BL,INV and packing list.jpg.exe 25 PID 1084 wrote to memory of 1312 1084 Shipment Document BL,INV and packing list.jpg.exe 25 PID 1084 wrote to memory of 1312 1084 Shipment Document BL,INV and packing list.jpg.exe 25 PID 1084 wrote to memory of 1312 1084 Shipment Document BL,INV and packing list.jpg.exe 25 PID 1084 wrote to memory of 1312 1084 Shipment Document BL,INV and packing list.jpg.exe 25 PID 1312 wrote to memory of 1496 1312 cmd.exe 27 PID 1312 wrote to memory of 1496 1312 cmd.exe 27 PID 1312 wrote to memory of 1496 1312 cmd.exe 27 PID 1312 wrote to memory of 1496 1312 cmd.exe 27 PID 1312 wrote to memory of 908 1312 cmd.exe 28 PID 1312 wrote to memory of 908 1312 cmd.exe 28 PID 1312 wrote to memory of 908 1312 cmd.exe 28 PID 1312 wrote to memory of 908 1312 cmd.exe 28 PID 908 wrote to memory of 744 908 remcos.exe 29 PID 908 wrote to memory of 744 908 remcos.exe 29 PID 908 wrote to memory of 744 908 remcos.exe 29 PID 908 wrote to memory of 744 908 remcos.exe 29 -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1060 Shipment Document BL,INV and packing list.jpg.exe 908 remcos.exe -
Loads dropped DLL 2 IoCs
pid Process 1312 cmd.exe 1312 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 908 remcos.exe 744 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 744 remcos.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1060 Shipment Document BL,INV and packing list.jpg.exe 908 remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1060 set thread context of 1084 1060 Shipment Document BL,INV and packing list.jpg.exe 24 PID 908 set thread context of 744 908 remcos.exe 29 -
Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Shipment Document BL,INV and packing list.jpg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Shipment Document BL,INV and packing list.jpg.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1496 PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"2⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
PID:1084 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1312 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:1496
-
-
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:908 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
PID:744
-
-
-
-