Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
TaxDocuments.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
TaxDocuments.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
msimg32.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
msimg32.dll
Resource
win10v2004-20240802-en
General
-
Target
TaxDocuments.exe
-
Size
1.7MB
-
MD5
30307b319b2451b6bf61d3e6b232f1da
-
SHA1
6a512848872be1325761e7ca110e0a1ee91cb0ef
-
SHA256
a7dbbad8a1cd038e5ab5b3c6b1b312774d808e4b0a2254e8039036972ac8881a
-
SHA512
7833ecb30a75324af6852e3583a609a653652f3cda9037ace7a1098ce7e52ed4b994c5ff1a0a0b4db748a01b06e8d4b8a10a50ebb9c0d4fbc8aa12dd1168f0b7
-
SSDEEP
24576:17AMY27PG+4VWz3zYxQ2IQKbvavAyoVVxPuOcabAC9fH6lJUkwJYaTTgKmfa8+:Nwj+4VWnoqSkHNckbfH6lJ2XgKmf+
Malware Config
Extracted
remcos
RemoteHost
privmerkt.com:6042
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BMG9AW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2300 TaxDocuments.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaxDocuments.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaxDocuments.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2300 wrote to memory of 4940 2300 TaxDocuments.exe 86 PID 2300 wrote to memory of 4940 2300 TaxDocuments.exe 86 PID 2300 wrote to memory of 4940 2300 TaxDocuments.exe 86 PID 2300 wrote to memory of 4940 2300 TaxDocuments.exe 86 PID 2300 wrote to memory of 4940 2300 TaxDocuments.exe 86 PID 2300 wrote to memory of 4940 2300 TaxDocuments.exe 86 PID 2300 wrote to memory of 4596 2300 TaxDocuments.exe 87 PID 2300 wrote to memory of 4596 2300 TaxDocuments.exe 87 PID 2300 wrote to memory of 4596 2300 TaxDocuments.exe 87 PID 4596 wrote to memory of 3700 4596 cmd.exe 89 PID 4596 wrote to memory of 3700 4596 cmd.exe 89 PID 4596 wrote to memory of 3700 4596 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\TaxDocuments.exe"C:\Users\Admin\AppData\Local\Temp\TaxDocuments.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\TaxDocuments.exe"C:\Users\Admin\AppData\Local\Temp\TaxDocuments.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4940
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3700
-
-