Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

PCRemoteRe...16.exe

windows7-x64

4

PCRemoteRe...16.exe

windows10-2004-x64

10

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

MonectMediaCenter.exe

windows7-x64

10

MonectMediaCenter.exe

windows10-2004-x64

10

MonectRunt...ck.exe

windows7-x64

5

MonectRunt...ck.exe

windows10-2004-x64

8

MonectServer.exe

windows7-x64

1

MonectServer.exe

windows10-2004-x64

1

MonectServ...ce.exe

windows7-x64

1

MonectServ...ce.exe

windows10-2004-x64

1

PCRemoteReceiver.exe

windows7-x64

10

PCRemoteReceiver.exe

windows10-2004-x64

10

Packages/v...64.exe

windows7-x64

7

Packages/v...64.exe

windows10-2004-x64

7

QRCodeEncoder.dll

windows7-x64

1

QRCodeEncoder.dll

windows10-2004-x64

1

SDL2.dll

windows7-x64

1

SDL2.dll

windows10-2004-x64

1

SDL2_image.dll

windows7-x64

1

SDL2_image.dll

windows10-2004-x64

1

TouchInput.dll

windows7-x64

1

TouchInput.dll

windows10-2004-x64

1

avcodec-59.dll

windows7-x64

10

avcodec-59.dll

windows10-2004-x64

10

avformat-59.dll

windows7-x64

10

avformat-59.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    04/05/2024, 14:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PCRemoteReceiver.exe

  • Size

    7.2MB

  • MD5

    1f131b830b107f7ff0e12be96cac1eb1

  • SHA1

    1abb094ccb683d7e5ab18c1fe3bc37ad777accba

  • SHA256

    22720868281ba4a699ebe9e34a94865bfb40207b386672d0afa4e4daba94bc0d

  • SHA512

    c4df0294a1b25f96de69bf228f6b8612a9ab6f048110de441f83ef088296cb7106cc1dd125b32f4784395f99f579a4090c35a6db801d8ee442e57344858142eb

  • SSDEEP

    98304:n+iVLTjmGW8YRlXXe4nazbKBZ1P9BAvzycT6BKig+Z6elPq:nhzmGQRlXX5azWH1qKgig+Aepq

Score
10/10
privateloaderevasionloader

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Drops file in Drivers directory 9 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 50 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiver.exe
    "C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiver.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:920
    • C:\Users\Admin\AppData\Local\Temp\MonectRuntimeCheck.exe
      "C:\Users\Admin\AppData\Local\Temp\MonectRuntimeCheck.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Users\Admin\AppData\Local\Temp\driververifyx64.exe
        "C:\Users\Admin\AppData\Local\Temp\driververifyx64.exe"
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3256
      • C:\Windows\System32\netsh.exe
        advfirewall firewall add rule name="MonectServerService" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MonectServerService.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        PID:4620
      • C:\Windows\System32\netsh.exe
        advfirewall firewall add rule name="PCRemoteReceiver" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiver.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        PID:2612
      • C:\Windows\System32\netsh.exe
        advfirewall firewall add rule name="MonectMediaCenter" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MonectMediaCenter.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        PID:1812
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{880b5c6a-9611-b844-96b7-2e60c137351a}\vjoy.inf" "9" "49e52482b" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "c:\users\admin\appdata\local\temp\driver\vjoy"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2656
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:b2fe4818a00a2e82:vjoy.Inst.Win7:12.53.21.621:root\vid_1234&pid_bead&rev_0219," "49e52482b" "0000000000000138"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3896
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9b85e0e0-f58d-c44c-bc6f-65708288f8b5}\vigembus.inf" "9" "429a86e87" "0000000000000168" "WinSta0\Default" "0000000000000170" "208" "c:\users\admin\appdata\local\temp\driver\vigem"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2272
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c14ce88408607219:ViGEmBus_Device:1.16.112.0:nefarius\vigembus\gen1," "429a86e87" "0000000000000168"
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4384
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x410 0x2fc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3252
  • C:\Users\Admin\AppData\Local\Temp\MonectServerService.exe
    C:\Users\Admin\AppData\Local\Temp\MonectServerService.exe
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Local\Temp\driververifyx64.exe
      -disable
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4264
    • C:\Users\Admin\AppData\Local\Temp\MonectServer.exe
      "C:\Users\Admin\AppData\Local\Temp\MonectServer.exe"
      2⤵
        PID:3612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\{880B5~1\WdfCoInstaller01009.dll
      Filesize

      1.7MB

      MD5

      5cb42a31e35004ad81e5e89092adf3bc

      SHA1

      afdd47f3a2ec58f15abb2626e1233f5e356e8908

      SHA256

      44812fe5fe3b848d7d592278382c7c0370eba3115a9bd7f8db22efb89d1ed2b3

      SHA512

      328b35bb2b4963abc01602e2f0a78bf540c12e055bea3990d346e06edf53b5682c3387b6f86fbcf8552e2714c9d3ae6db28ca2a37a2bceb9db7e97076e932c1e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{880B5~1\hidkmdf.sys
      Filesize

      26KB

      MD5

      bffc21f44b02fbdd4a09c445db87ec59

      SHA1

      f7ca5a2d0b2eb9ecaf75cbfcc73eeb65889490c8

      SHA256

      8668f69c256baff9422ac9b3ab77448c21b5043547920591148b152cb3afb0d2

      SHA512

      87ee090ed4581650a491df30e26da5420ae4d6a83d178ae9e0b0ca419e367a5f31424df407d0fab55a78f2300a712c66c62ef15425e44ae5bd8100f790fbda78

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{880B5~1\vjoy.sys
      Filesize

      65KB

      MD5

      cc63b7e91816e5001fe79a840916f1c9

      SHA1

      63ff46f8b85bc29e298ef2ac7a434ff2df49918e

      SHA256

      297f9c12df8bd91640439c0bf7fe1ee391bbd01d330f5e1604a29c4669977774

      SHA512

      58fdcec81b6cff4e0d3a44ca93cfe1d86d8849afd0dd31af3a0d6e94483b5492a0f4729b3a0996084b56d4f5584166c4902abe195784ac7c2584489d699f0e48

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{880b5c6a-9611-b844-96b7-2e60c137351a}\vjoy.inf
      Filesize

      10KB

      MD5

      731f3d80f2296e3e13f4335885fa2556

      SHA1

      27e8a4a8eb907b1b1c8b720ef02a45bf9b1c6124

      SHA256

      33fe32886a8bf72769c3e4991265546c3d1cca9247dbb661f23f7f82362226a4

      SHA512

      b154c375f49934c1858646e9e750fcb7b06d6c453f61d283bb5ee5d2fe509f887d796d722d8fb7084734ee178549a33a85b23d012dc9bcd5c74136700dc4ceb4

      Download Submit

    • C:\Windows\System32\CatRoot2\dberr.txt
      Filesize

      37KB

      MD5

      f0011e73036eee3e53ab2dba1460bc72

      SHA1

      f4693ff6cb676942ebb7cc0d3d284ea1747963c6

      SHA256

      06e4ce5edab923f25e737af624477afa000736637cc82911cbd8c11529bc5d96

      SHA512

      a338bb454d69808497e648905c33c4c8bd697d3bc1986e189e06b7f26695cf312bf157a50dc31371931b93b733b366b316c2da0c62626d19f2c1aba34da10a1d

      Download Submit

    • C:\Windows\System32\DriverStore\Temp\{1b35a4e4-c5d0-584a-9002-2d0e3b4de481}\SET5601.tmp
      Filesize

      11KB

      MD5

      fb06e77f7c7bc0902d416c079c32d6a3

      SHA1

      b75aee99d492d84e83cc5ddba4791b8d2a570e7a

      SHA256

      784ea14d897c88be331d5c129d254a3a09add3d47066ad2879adecef3f00c97d

      SHA512

      1d0299593a0ce9ec23784b52602475ddea6e1b86dd3a02173061fdd9b724627265a3d6f8f08fd955615b972e9887111158fb86125c0dfde3659b4854294b66cb

      Download Submit

    • C:\Windows\System32\DriverStore\Temp\{ce672516-aa4b-4c40-a4e2-7d382620c884}\SET5AB5.tmp
      Filesize

      9KB

      MD5

      e67c26e6c46015f05da50046aacf8581

      SHA1

      32dfcee6d080e1b0c8012f8a6198f1e7d2afa3a0

      SHA256

      5b03a642a52d5ee895931c8fad98b2a67f20331c313aec42aa96d76c9c3ff928

      SHA512

      dd197b897c71f11abb9eefbad70691ed0b2b2ad0636616276d08d2c2a002b99e1ff7c5c47a54df94967f9a9f8c977fafba247f6aecfaa917dfb7efdb2d983493

      Download Submit

    • C:\Windows\System32\DriverStore\Temp\{ce672516-aa4b-4c40-a4e2-7d382620c884}\SET5AB6.tmp
      Filesize

      2KB

      MD5

      c75c1a401eba37e59c4477b22f8ced9b

      SHA1

      5e845664f66e4d005fa2b041db4c9f6bf0d564a9

      SHA256

      63774d6149f036c0d9faf98b062fea6b97debed559a9522099e46b54fe58da40

      SHA512

      1a12908961361eeea00b98174434e931f5d575a9cf72858a21536c2900c7c55107b5d34952cc149119572d3ea93e3c7d2fca018dd3535660dfb008c82eff8bb2

      Download Submit

    • C:\Windows\System32\DriverStore\Temp\{ce672516-aa4b-4c40-a4e2-7d382620c884}\x64\SET5AA3.tmp
      Filesize

      67KB

      MD5

      129165f67ccbb25be6be8ae2f0c15dda

      SHA1

      499865e046dc1d70edbf2a31ef06c03b6c6ea855

      SHA256

      1a1e57cb0dd7ca08d96bbb1b6ce667e3273702c13a7ecf86839b7642ef8255e0

      SHA512

      4666cf73ef77b0e7b86822fdc18743d41496c46686a91535ed7757dbdb8e0354489383aa4a27ab943e26360e8e1c8aed5600724034e0e6c38163faea24344ca2

      Download Submit

    • C:\Windows\System32\DriverStore\Temp\{ce672516-aa4b-4c40-a4e2-7d382620c884}\x64\SET5AB4.tmp
      Filesize

      1.7MB

      MD5

      f279d3e406114192148dd976de222138

      SHA1

      0567e9073c46c40e60e2ecd0a509579f029efd8e

      SHA256

      1a7627c11aecf24e8e0c9a519498e8456f0457bd89f0ffe649bd8fb53a194f89

      SHA512

      e72d1011bd3c4208c3733228aac45a6ae00c3979ffb49130d4141293764db1b91551edf9340b5cc5c987b848e3ffc661b8084923c2032b175fcf55321f42dc25

      Download Submit

    • memory/920-190-0x00007FF999180000-0x00007FF999383000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/920-193-0x000000006A880000-0x000000006A8A7000-memory.dmp

      Filesize

      156KB

      Download

    • memory/920-194-0x00007FF998DF0000-0x00007FF999020000-memory.dmp

      Filesize

      2.2MB

      Download

    • memory/920-192-0x00007FF999020000-0x00007FF9990C8000-memory.dmp

      Filesize

      672KB

      Download

    • memory/920-191-0x00007FF9990D0000-0x00007FF999173000-memory.dmp

      Filesize

      652KB

      Download

    • memory/920-195-0x00000183C5770000-0x00000183CA679000-memory.dmp

      Filesize

      79.0MB

      Download