Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 10:30
Static task
static1
Behavioral task
behavioral1
Sample
Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe
Resource
win10v2004-20231215-en
General
-
Target
Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe
-
Size
5KB
-
MD5
10531525068f2547147c84cf4b464f75
-
SHA1
7c05bb4ee5c49eef647837347825c19a1756d73b
-
SHA256
2821d789c0b37d3ed136eebd66c36216386fa9d4935fcd733b1e8ef4fd388d36
-
SHA512
d6a9e15f614aab2a2baecb832f5c7ba642893fd62d353bac09d1a247a834ef0e4ec781551e6a5ed9deb97308f19cb333b52f71e82e5ff2536bdcc2d843350fa5
-
SSDEEP
48:6yZEbVTWEkfWXedefzwYczF5ejsFBCJwUhloy54Rn6l+spsVtiOl1VeRqFSpfbNM:sQEPeoczo4YwUhuyy++BvVeTzNt
Malware Config
Extracted
remcos
FRESH
igw.myfirewall.org:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-4HN46L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detect ZGRat V1 34 IoCs
resource yara_rule behavioral2/memory/4984-3-0x00000000054B0000-0x0000000005596000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-6-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-7-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-9-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-11-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-13-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-15-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-17-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-19-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-21-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-23-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-25-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-27-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-29-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-31-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-33-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-35-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-37-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-39-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-41-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-43-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-45-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-47-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-49-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-51-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-55-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-53-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-57-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-59-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-61-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-63-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-65-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-67-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 behavioral2/memory/4984-69-0x00000000054B0000-0x0000000005590000-memory.dmp family_zgrat_v1 -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4168-1154-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/4168-1162-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/656-1157-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/656-1165-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
resource yara_rule behavioral2/memory/4168-1154-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/656-1157-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2440-1158-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2440-1163-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4168-1162-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/656-1165-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\windows.exe" Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4984 set thread context of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 3420 set thread context of 656 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 100 PID 3420 set thread context of 4168 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 101 PID 3420 set thread context of 2440 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2348 ipconfig.exe 2744 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 656 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 656 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 2440 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 2440 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 656 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 656 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe Token: SeDebugPrivilege 2440 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4984 wrote to memory of 3112 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 84 PID 4984 wrote to memory of 3112 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 84 PID 4984 wrote to memory of 3112 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 84 PID 3112 wrote to memory of 2348 3112 cmd.exe 87 PID 3112 wrote to memory of 2348 3112 cmd.exe 87 PID 3112 wrote to memory of 2348 3112 cmd.exe 87 PID 4984 wrote to memory of 4220 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 96 PID 4984 wrote to memory of 4220 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 96 PID 4984 wrote to memory of 4220 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 96 PID 4220 wrote to memory of 2744 4220 cmd.exe 97 PID 4220 wrote to memory of 2744 4220 cmd.exe 97 PID 4220 wrote to memory of 2744 4220 cmd.exe 97 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 4984 wrote to memory of 3420 4984 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 98 PID 3420 wrote to memory of 2960 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 99 PID 3420 wrote to memory of 2960 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 99 PID 3420 wrote to memory of 2960 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 99 PID 3420 wrote to memory of 656 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 100 PID 3420 wrote to memory of 656 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 100 PID 3420 wrote to memory of 656 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 100 PID 3420 wrote to memory of 656 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 100 PID 3420 wrote to memory of 4168 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 101 PID 3420 wrote to memory of 4168 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 101 PID 3420 wrote to memory of 4168 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 101 PID 3420 wrote to memory of 4168 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 101 PID 3420 wrote to memory of 2440 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 102 PID 3420 wrote to memory of 2440 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 102 PID 3420 wrote to memory of 2440 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 102 PID 3420 wrote to memory of 2440 3420 Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe"C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
PID:2348
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
PID:2744
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe"C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe"C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe" /stext "C:\Users\Admin\AppData\Local\Temp\uowgkqtzawtwmlskfxcn"3⤵PID:2960
-
-
C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe"C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe" /stext "C:\Users\Admin\AppData\Local\Temp\uowgkqtzawtwmlskfxcn"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:656
-
-
C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe"C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe" /stext "C:\Users\Admin\AppData\Local\Temp\fqczlieaoelbpzoowiwgqxjm"3⤵
- Accesses Microsoft Outlook accounts
PID:4168
-
-
C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe"C:\Users\Admin\AppData\Local\Temp\Mit Technologies Iran - MIT PO_TURK00926600.pdf(73KB).exe" /stext "C:\Users\Admin\AppData\Local\Temp\hkprmbpucmdozfcsftjibcedtgq"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5a957012c1cced7427ce0f77a6c50dc66
SHA1e6b42230fb9d6e33718814e1ef49df2268f99f1b
SHA25631b7e37e525c5310f9f65467ebc4a0735b85e57a7a3cb56a002633e6ff48acc9
SHA512475af0e7acfa71400f918bfba444065ee87e4e960133236196001d13765662fbb65b3246b53f34573a7c948336bee6d001af2bb38a362e4d077ac2e920366a74
-
Filesize
4KB
MD50cb17253d14f1f732dfbc3ef9b580d1e
SHA185d726cf68f14dd34090de9f4d160c0387249b68
SHA256e09a0aed9bbc43da3b7a85d30a9a10b54d11c096aa6cef81c23364bc9c4dfcc9
SHA512f651e62d58e83f9d5e21f3ac8cc516290bfff66c1981dc14cc3a7a900db70d6e7e15c99bb717a18c036b96a6c2f794c2351df7aa39b69531f2112860a51a86ee