Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 02:20
Static task
static1
Behavioral task
behavioral1
Sample
f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe
Resource
win10v2004-20240226-en
General
-
Target
f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe
-
Size
3.6MB
-
MD5
cf7bc3c744eedf62ec6452c1ab170b51
-
SHA1
d1b669631370863da9ac7b01bc3881ff4b506f18
-
SHA256
f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c
-
SHA512
141ec775ef5676144f8b7470cd08795589e1eb67031ed8235a846013014028747b1a8d0ade054a6b2db200b8d6a30d55d4c651943b4b2471eda5a6ee4a91ed61
-
SSDEEP
49152:lp98Mq2HVhvxG9I1EBn1SdaVY6kqjpr33J7cXdn7jc7QBip7aF2M2/j8e3KEggFm:lR1h2qaVnkM3eeQY2Fgxt++IY404
Malware Config
Extracted
remcos
RDEC
64.188.18.137:1604
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-VI2QU3
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 26 IoCs
resource yara_rule behavioral1/memory/2332-11-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-18-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-19-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-16-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-14-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-13-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-12-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-10-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-20-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-21-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-23-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-22-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-24-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-25-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-28-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-29-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-60-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-63-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-64-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-65-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-66-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-67-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-68-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-69-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-72-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2332-73-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM -
Detects executables built or packed with MPress PE compressor 16 IoCs
resource yara_rule behavioral1/memory/2504-32-0x0000000000400000-0x0000000000478000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2636-38-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2768-43-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2636-47-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2504-46-0x0000000000400000-0x0000000000478000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2768-45-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2768-44-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2636-41-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2504-40-0x0000000000400000-0x0000000000478000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2636-39-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2504-34-0x0000000000400000-0x0000000000478000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2504-52-0x0000000000400000-0x0000000000478000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2636-54-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2332-55-0x0000000010000000-0x0000000010019000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2332-59-0x0000000010000000-0x0000000010019000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2332-58-0x0000000010000000-0x0000000010019000-memory.dmp INDICATOR_EXE_Packed_MPress -
Detects executables packed with or use KoiVM 1 IoCs
resource yara_rule behavioral1/memory/2008-4-0x000000001B040000-0x000000001B114000-memory.dmp INDICATOR_EXE_Packed_KoiVM -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 3 IoCs
resource yara_rule behavioral1/memory/2636-47-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2636-41-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2636-54-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 3 IoCs
resource yara_rule behavioral1/memory/2636-47-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2636-41-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2636-54-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/2636-47-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/2636-41-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/2636-54-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/2504-46-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/2504-40-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/2504-52-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral1/memory/2636-47-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/2504-46-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2768-45-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2636-41-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/2504-40-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2504-52-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2636-54-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wmplayer.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2008 set thread context of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2332 set thread context of 2504 2332 wmplayer.exe 32 PID 2332 set thread context of 2636 2332 wmplayer.exe 33 PID 2332 set thread context of 2768 2332 wmplayer.exe 34 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2504 wmplayer.exe 2504 wmplayer.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2332 wmplayer.exe 2332 wmplayer.exe 2332 wmplayer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe Token: SeDebugPrivilege 2768 wmplayer.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2000 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 28 PID 2008 wrote to memory of 2000 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 28 PID 2008 wrote to memory of 2000 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 28 PID 2008 wrote to memory of 2000 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 28 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 2332 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 29 PID 2008 wrote to memory of 1992 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 30 PID 2008 wrote to memory of 1992 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 30 PID 2008 wrote to memory of 1992 2008 f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe 30 PID 2332 wrote to memory of 2504 2332 wmplayer.exe 32 PID 2332 wrote to memory of 2504 2332 wmplayer.exe 32 PID 2332 wrote to memory of 2504 2332 wmplayer.exe 32 PID 2332 wrote to memory of 2504 2332 wmplayer.exe 32 PID 2332 wrote to memory of 2504 2332 wmplayer.exe 32 PID 2332 wrote to memory of 2636 2332 wmplayer.exe 33 PID 2332 wrote to memory of 2636 2332 wmplayer.exe 33 PID 2332 wrote to memory of 2636 2332 wmplayer.exe 33 PID 2332 wrote to memory of 2636 2332 wmplayer.exe 33 PID 2332 wrote to memory of 2636 2332 wmplayer.exe 33 PID 2332 wrote to memory of 2768 2332 wmplayer.exe 34 PID 2332 wrote to memory of 2768 2332 wmplayer.exe 34 PID 2332 wrote to memory of 2768 2332 wmplayer.exe 34 PID 2332 wrote to memory of 2768 2332 wmplayer.exe 34 PID 2332 wrote to memory of 2768 2332 wmplayer.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe"C:\Users\Admin\AppData\Local\Temp\f3050a3a335d79e31e55dcc7da2da1a672593433058cbb3e325dde599cc11b1c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2000
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lgltwficpbouaaqtihstbbriugsdvaxtzj"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2504
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wjqmwxt"3⤵
- Accesses Microsoft Outlook accounts
PID:2636
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ydeexqdyrs"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2008 -s 6842⤵PID:1992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84