Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
e7da9da76702fefa71e67e7c2d67eb70N.exe
Resource
win7-20240903-en
General
-
Target
e7da9da76702fefa71e67e7c2d67eb70N.exe
-
Size
953KB
-
MD5
e7da9da76702fefa71e67e7c2d67eb70
-
SHA1
c97603e9070393fa9bb56e8674512cde49bfe444
-
SHA256
84bb8bba33e1a515260b02421d72da6ad0d685d432c64c572a230337dca28c54
-
SHA512
37a6f8be2cc4835a4bb15d5e4f86d1c9390cb94480642dfee08210640e679d694a8031fbd68d8ec1b84f8d4ff01ad33794562ec1456c262a4d10bc4fd483fd4c
-
SSDEEP
24576:B0R6OKfNjIxTUYFb5rTGx+Up4/r6HOzHEEg5d:eGfqV5t5rKTa/9HEV
Malware Config
Extracted
remcos
blvinc
blv23728.ddns.net:1973
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-NGC4XU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3764 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation e7da9da76702fefa71e67e7c2d67eb70N.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3464 set thread context of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7da9da76702fefa71e67e7c2d67eb70N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7da9da76702fefa71e67e7c2d67eb70N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3764 powershell.exe 3764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3764 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2676 e7da9da76702fefa71e67e7c2d67eb70N.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3464 wrote to memory of 3764 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 94 PID 3464 wrote to memory of 3764 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 94 PID 3464 wrote to memory of 3764 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 94 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96 PID 3464 wrote to memory of 2676 3464 e7da9da76702fefa71e67e7c2d67eb70N.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7da9da76702fefa71e67e7c2d67eb70N.exe"C:\Users\Admin\AppData\Local\Temp\e7da9da76702fefa71e67e7c2d67eb70N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e7da9da76702fefa71e67e7c2d67eb70N.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
C:\Users\Admin\AppData\Local\Temp\e7da9da76702fefa71e67e7c2d67eb70N.exe"C:\Users\Admin\AppData\Local\Temp\e7da9da76702fefa71e67e7c2d67eb70N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5b7c4b4e7794b79bf6b8f9084147a267a
SHA1dc80ce0762622debe768c1cef8274f66a2516756
SHA25678ca48bb921cd291cf3a115fa0f0c581b722593b43bb75157a140a8f65204427
SHA5123b8588347bc8f22b996d9bd406dc40c27a2b0c623b0bc1124a473015801c55f631e813b3d263580f1fc112a7014d118fef4d7859432e221f3306d0014920f779
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82