Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3IMANG59293...02.exe
windows7-x64
10IMANG59293...02.exe
windows10-2004-x64
10$APPDATA/a...60.dll
windows7-x64
1$APPDATA/a...60.dll
windows10-2004-x64
1$APPDATA/a...60.dll
windows7-x64
1$APPDATA/a...60.dll
windows10-2004-x64
1$APPDATA/a...UI.dll
windows7-x64
1$APPDATA/a...UI.dll
windows10-2004-x64
1$APPDATA/a...op.dll
windows7-x64
1$APPDATA/a...op.dll
windows10-2004-x64
1$APPDATA/a...rs.exe
windows7-x64
3$APPDATA/a...rs.exe
windows10-2004-x64
3$APPDATA/a...im.dll
windows7-x64
3$APPDATA/a...im.dll
windows10-2004-x64
3$APPDATA/p...60.dll
windows7-x64
1$APPDATA/p...60.dll
windows10-2004-x64
1$APPDATA/p...ui.dll
windows7-x64
1$APPDATA/p...ui.dll
windows10-2004-x64
1$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$TEMP/Towb...ia.dll
windows7-x64
3$TEMP/Towb...ia.dll
windows10-2004-x64
3$TEMP/paperings.exe
windows7-x64
10$TEMP/paperings.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/09/2024, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$APPDATA/app_browser/25.opends60.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$APPDATA/app_browser/25.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$APPDATA/app_browser/40.opends60.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$APPDATA/app_browser/40.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$APPDATA/app_browser/MicrosoftVisualStudioWebUI.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$APPDATA/app_browser/MicrosoftVisualStudioWebUI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$APPDATA/app_browser/VsWebSiteInterop.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$APPDATA/app_browser/VsWebSiteInterop.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$APPDATA/app_browser/aspnetregbrowsers.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$APPDATA/app_browser/aspnetregbrowsers.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$APPDATA/app_browser/mscortim.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
$APPDATA/app_browser/mscortim.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$APPDATA/postinfo/34.opends60.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$APPDATA/postinfo/34.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$APPDATA/postinfo/rcxditui.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$APPDATA/postinfo/rcxditui.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/advsplash.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/advsplash.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$TEMP/TowbarHamartia.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$TEMP/TowbarHamartia.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$TEMP/paperings.exe
Resource
win7-20240903-en
General
-
Target
IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe
-
Size
778KB
-
MD5
6ec62d2feca20ea0d9c8730aa3f660e3
-
SHA1
5386d98ec0d08febf713058df774e9e6044c9080
-
SHA256
e6b58687faf8165eb9f34872e6dd9df1a97e527a1c9765b698be615e72f368e0
-
SHA512
6017f06cc445a45cf7f57e131e682fb2f5c56c35bbb1884e3759a44cadb559ea6ca51851808fb2012e3de1f28bdfbb52a35301706468f67ef0f85494fe474aeb
-
SSDEEP
24576:LwuySQX1XbJzkbtccJ7tQB/9ksYwSQvf8os+q:L5QdbJzFAtKksnSQv+7
Malware Config
Extracted
remcos
2.5.0 Pro
DECIMO
decimoremcdns.duckdns.org:1011
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-EXFS95
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 37 2484 cmd.exe 43 2484 cmd.exe 46 2484 cmd.exe 51 2484 cmd.exe 52 2484 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2180 paperings.exe -
Loads dropped DLL 1 IoCs
pid Process 2180 paperings.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\sfc.job cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language paperings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2180 paperings.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2180 paperings.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2484 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 2180 4852 IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe 82 PID 4852 wrote to memory of 2180 4852 IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe 82 PID 4852 wrote to memory of 2180 4852 IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe 82 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87 PID 2180 wrote to memory of 2484 2180 paperings.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe"C:\Users\Admin\AppData\Local\Temp\IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\paperings.exeC:\Users\Admin\AppData\Local\Temp\paperings.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2484
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
645KB
MD55c9b2fdeda32f5e7c5dba14db7d405f1
SHA10616c4b7aade47f8a7a110222cf21b40a9138540
SHA2560376fa7850a8e22086b054e55a626633f5376e5a1639eb10799ae68a1f64493d
SHA51242fa024108e621cfdeae5b888597d635ed6a60465a174e1d2c8145465bda8fdc45809cb231a651d182414d39a2e21402fa2c50e711efaa29c37cde9154c19f15
-
Filesize
54KB
MD5d65c8ac05fd814a0327588b6b485c43e
SHA15555dc0c343f857c4732683b4018a271b17a6ca0
SHA256030bcfc5c4629fff97b77925e1650c9bb9b267c1018f2fc754f90afc143522e1
SHA512a40aa752ba28afb4e4b40ebb551612a819876dde50414c9ff1c0bf6b46618ab9d7b459eca0262fc0b9a13a649123c37fede7b20db4b8f3344c81551041d86fa0
-
Filesize
39KB
MD5f4392de13dfac4aa804152adbd93e793
SHA1ee90e001945afde21dcd12d542f0eabb9f94f4a6
SHA25631ae1165f008db6195108f984d3fe495f10c6ac4a5f74bd365102f84b57d9aba
SHA51240bf82d364c757576c3d7897d6d7413b64089056a8279433b5d5a35ada7a01607754c29678afd9bada5934d49c26f800132d400c864b38234fba4017bcf01de4
-
Filesize
74B
MD5c29fe46d8d14556f6e83a2b22a271d03
SHA1ea713e6daa511c2d246950a62c115d822f15ae72
SHA256d578c928c4f0dbffde8cf13f4b79549c7090f5cefbb29b7b7bd131dc5aa5c5d5
SHA51260dd080743ae1ecc2e9598e1edba41ab5150f8e879784a505edc5d075312b614eb8a28a67d5403e974e8607d35d0f8c3d2f1c7570dfc4b9c9f33ca2ff24f0319