Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
Mtn03 Credit Receipt Jpg.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Mtn03 Credit Receipt Jpg.exe
Resource
win10v2004-20240426-en
General
-
Target
Mtn03 Credit Receipt Jpg.exe
-
Size
519KB
-
MD5
c39c874e0184d91e2a9ca393c919bac3
-
SHA1
2ce663a89bf9b7f2dbb8f847585bebd60cee52c7
-
SHA256
86b29c8b17f5e01fe26349520452e9cf853cfb816ef46f37b071f02b7d96d603
-
SHA512
8ce86457420fef18bb56c86c8af629752ab652ff45332799e8c4b39e856b209a64f9d9024be21da86f1288767e5dcf4ab41ca8cfc6f6f12f20d2419a92c5a91e
-
SSDEEP
12288:ivNVAT3iHR0R3ZvDSQJZTebqRkTsekknxN:AVgyHR0TvOQJkma/N
Malware Config
Extracted
remcos
1.7 Pro
Host
william2243.duckdns.org:1598
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_pdaejuprezbgooi
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
detects Windows exceutables potentially bypassing UAC using eventvwr.exe 9 IoCs
resource yara_rule behavioral1/memory/2076-15-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2076-12-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2076-11-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2076-17-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2076-19-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2076-29-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2888-49-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2888-50-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2888-51-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer -
Executes dropped EXE 2 IoCs
pid Process 2412 remcos.exe 2888 remcos.exe -
Loads dropped DLL 1 IoCs
pid Process 2752 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Mtn03 Credit Receipt Jpg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1936 set thread context of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 2412 set thread context of 2888 2412 remcos.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2652 PING.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2888 remcos.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2888 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2888 remcos.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 1936 wrote to memory of 2076 1936 Mtn03 Credit Receipt Jpg.exe 28 PID 2076 wrote to memory of 2752 2076 Mtn03 Credit Receipt Jpg.exe 29 PID 2076 wrote to memory of 2752 2076 Mtn03 Credit Receipt Jpg.exe 29 PID 2076 wrote to memory of 2752 2076 Mtn03 Credit Receipt Jpg.exe 29 PID 2076 wrote to memory of 2752 2076 Mtn03 Credit Receipt Jpg.exe 29 PID 2076 wrote to memory of 2752 2076 Mtn03 Credit Receipt Jpg.exe 29 PID 2076 wrote to memory of 2752 2076 Mtn03 Credit Receipt Jpg.exe 29 PID 2076 wrote to memory of 2752 2076 Mtn03 Credit Receipt Jpg.exe 29 PID 2752 wrote to memory of 2652 2752 cmd.exe 31 PID 2752 wrote to memory of 2652 2752 cmd.exe 31 PID 2752 wrote to memory of 2652 2752 cmd.exe 31 PID 2752 wrote to memory of 2652 2752 cmd.exe 31 PID 2752 wrote to memory of 2412 2752 cmd.exe 32 PID 2752 wrote to memory of 2412 2752 cmd.exe 32 PID 2752 wrote to memory of 2412 2752 cmd.exe 32 PID 2752 wrote to memory of 2412 2752 cmd.exe 32 PID 2412 wrote to memory of 2888 2412 remcos.exe 33 PID 2412 wrote to memory of 2888 2412 remcos.exe 33 PID 2412 wrote to memory of 2888 2412 remcos.exe 33 PID 2412 wrote to memory of 2888 2412 remcos.exe 33 PID 2412 wrote to memory of 2888 2412 remcos.exe 33 PID 2412 wrote to memory of 2888 2412 remcos.exe 33 PID 2412 wrote to memory of 2888 2412 remcos.exe 33 PID 2412 wrote to memory of 2888 2412 remcos.exe 33 PID 2412 wrote to memory of 2888 2412 remcos.exe 33 PID 2412 wrote to memory of 2888 2412 remcos.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mtn03 Credit Receipt Jpg.exe"C:\Users\Admin\AppData\Local\Temp\Mtn03 Credit Receipt Jpg.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\Mtn03 Credit Receipt Jpg.exe"C:\Users\Admin\AppData\Local\Temp\Mtn03 Credit Receipt Jpg.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:2652
-
-
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2888
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99B
MD576c1687d97dfdbcea62ef1490bec5001
SHA15f4d1aeafa7d840cde67b76f97416dd68efd1bed
SHA25679f04ea049979ffd2232c459fdd57fae97a5255aea9b4a2c7dce7ead856f37a4
SHA512da250f0628632a644f159d818a82a8b9cca8224e46843bddbe0f6f9c32a2d04f7736a620af49ab6d77616317ca7d68285e60043965fe86c03d940835bd30a925
-
Filesize
519KB
MD5c39c874e0184d91e2a9ca393c919bac3
SHA12ce663a89bf9b7f2dbb8f847585bebd60cee52c7
SHA25686b29c8b17f5e01fe26349520452e9cf853cfb816ef46f37b071f02b7d96d603
SHA5128ce86457420fef18bb56c86c8af629752ab652ff45332799e8c4b39e856b209a64f9d9024be21da86f1288767e5dcf4ab41ca8cfc6f6f12f20d2419a92c5a91e