Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23/09/2024, 11:50
Static task
static1
Behavioral task
behavioral1
Sample
20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe
Resource
win10v2004-20240802-en
General
-
Target
20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe
-
Size
138KB
-
MD5
a72a99b91f5e47c3a6f40ef983343680
-
SHA1
a8cfc9541ea81f16d67ebd7900c8020b563d04e7
-
SHA256
20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684
-
SHA512
9d9d71e2f00d615c428ea409998ece26a7ba0dd8cc36a3ffa254ba775fcab03f6cca05d1967c9204a9468d1f48c556e34e5cccbb82cc8f1d4e31c592c41f9937
-
SSDEEP
1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjK6:xPd4n/M+WLcilrpgGH/GwY87mVmIXK
Malware Config
Extracted
remcos
1.7 Pro
Host
systemcontrol.ddns.net:45000
systemcontrol2.ddns.net:45000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
OfficeUpgrade.exe
-
copy_folder
OfficeUpgrade
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
Upgrader.dat
-
keylog_flag
false
-
keylog_folder
Upgrader
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
req_khauflaoyr
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
OfficeUpgrade
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2288 wn2ra4ohzdr.exe 2744 wn2ra4ohzdr.exe -
Loads dropped DLL 1 IoCs
pid Process 1924 20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe" 20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2288 set thread context of 2744 2288 wn2ra4ohzdr.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wn2ra4ohzdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wn2ra4ohzdr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2744 wn2ra4ohzdr.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2288 1924 20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe 31 PID 1924 wrote to memory of 2288 1924 20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe 31 PID 1924 wrote to memory of 2288 1924 20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe 31 PID 1924 wrote to memory of 2288 1924 20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe 31 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32 PID 2288 wrote to memory of 2744 2288 wn2ra4ohzdr.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe"C:\Users\Admin\AppData\Local\Temp\20f3e8b4bcc6bb2ff900b0b95332b8d4284077269023a14c2b2f13625ced2684N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2744
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138KB
MD5d799bb45ce43014dcd1f4e739c887f56
SHA19612aac6bedd736aa3bd81d7c051f4137b66d7fe
SHA2560866416b526c75b4083f64b36ccf75eafd72d8102834ac745f0acfba4dac136b
SHA5127bcbc347463ff65157dcf0fab06054a85f772d9494aefa896d0dd1138a2e3fdf06b76add813f2c122c4f860f67b05e1c87240cf2737a30ecb09daaa8d27d1101