Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
15/11/2023, 21:07
Static task
static1
Behavioral task
behavioral1
Sample
77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe
Resource
win7-20231023-en
General
-
Target
77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe
-
Size
1023.9MB
-
MD5
e187abc066f3a9b3751199160e80416e
-
SHA1
9615d3c182031fd626fc9f4eb691ee1f94b516f1
-
SHA256
6abbdd5105f4caf66cc11b6dbaf1ee4713ffcd5da388271c06e7498b38a76e92
-
SHA512
92ec4972052995e313a20cdd6c3461bab8e0811697bd9b3704a6c2082ec91f8d0439853415c4d67b965af1a9ce043d445b3fa5d8ce617dfa2d6ef8b06002f8e1
-
SSDEEP
24576:3qpXIhjkNbsNcg8McK/kUacq9Zm7W8WQYI:ahI1UgBVu39Y7GQY
Malware Config
Extracted
remcos
BALOTO
nazareno77.con-ip.com:7770
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-GC9ATE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1936 set thread context of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2568 schtasks.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2848 csc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2848 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 28 PID 1936 wrote to memory of 2528 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 34 PID 1936 wrote to memory of 2528 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 34 PID 1936 wrote to memory of 2528 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 34 PID 1936 wrote to memory of 2528 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 34 PID 1936 wrote to memory of 2544 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 33 PID 1936 wrote to memory of 2544 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 33 PID 1936 wrote to memory of 2544 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 33 PID 1936 wrote to memory of 2544 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 33 PID 1936 wrote to memory of 2564 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 32 PID 1936 wrote to memory of 2564 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 32 PID 1936 wrote to memory of 2564 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 32 PID 1936 wrote to memory of 2564 1936 77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe 32 PID 2544 wrote to memory of 2568 2544 cmd.exe 35 PID 2544 wrote to memory of 2568 2544 cmd.exe 35 PID 2544 wrote to memory of 2568 2544 cmd.exe 35 PID 2544 wrote to memory of 2568 2544 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe"C:\Users\Admin\AppData\Local\Temp\77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2848
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"2⤵PID:2564
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f3⤵
- Creates scheduled task(s)
PID:2568
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"2⤵PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5d55d8c4bb7c7fe8e287d14f5331bec3a
SHA19616e6eb86146d17ccc95ed7331ede164eb81abe
SHA256fec7e16db45dbb68200ebacf2808d4c05c52b1a29662ec240067738d0655af36
SHA512355a064b9b4bf9375aa8c23d35063cf720ceafeefdaa4c2f5920d62b8a364a4cd056e11d040c4c8fc70305eaf0f35d03a5e6fdd330e483f75fa3197cfe6400f4