Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
Tax Organizer.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Tax Organizer.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
msimg32.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
msimg32.dll
Resource
win10v2004-20240426-en
Errors
General
-
Target
msimg32.dll
-
Size
45.1MB
-
MD5
2b0cd6422137c4f1c4496305467b95c4
-
SHA1
a4ede1255abdda3fc27347fc46a0b3b9fd963972
-
SHA256
d9ffb32f33d1f16ca20346890449d410edb025a631f40b277c692474ba0c0318
-
SHA512
b1e8e238ccabf4be29d862d49191345a52310be178b1eb3b305cb2277877f948c14860a9fb95df1b93b6a01bb234217cc7cddedbd3ebdcd1e92b7ff05dd1a0a6
-
SSDEEP
786432:oUP7GCGO7t0Srkx/tC0SzIdSwh/WxbpNHQD3trzRp2:oUP7GCG6iSrkx1hSzYsHQD3t/RY
Malware Config
Extracted
remcos
RemoteHost
deytrycooldown.duckdns.org:7070
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TYSCJG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2456 regsvr32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1676 2456 WerFault.exe 84 -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "154" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2464 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 220 LogonUI.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2456 2876 regsvr32.exe 84 PID 2876 wrote to memory of 2456 2876 regsvr32.exe 84 PID 2876 wrote to memory of 2456 2876 regsvr32.exe 84 PID 2456 wrote to memory of 2464 2456 regsvr32.exe 95 PID 2456 wrote to memory of 2464 2456 regsvr32.exe 95 PID 2456 wrote to memory of 2464 2456 regsvr32.exe 95 PID 2456 wrote to memory of 2464 2456 regsvr32.exe 95 PID 2456 wrote to memory of 2464 2456 regsvr32.exe 95 PID 2456 wrote to memory of 2464 2456 regsvr32.exe 95
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\msimg32.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\msimg32.dll2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 8003⤵
- Program crash
PID:1676
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2456 -ip 24561⤵PID:2260
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38c1855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:220