Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/09/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
QUOTATION.exe
Resource
win10v2004-20240802-en
General
-
Target
QUOTATION.exe
-
Size
900KB
-
MD5
a1e1f9aef9a168423b2f0cd1dbe2ba9a
-
SHA1
921abb3a628f79b295c92d7298da8dfedc1b9376
-
SHA256
66c41f2310824c8b5b2365a2283d28c5b47d2a829afa45a1b00b710259d9622d
-
SHA512
6281720fd5a85723cb6cc85845fa4895cf0190cad58a4924c2a36a0d7d7b6f41b4a2f1c7bf005e969c5e973294c287a3c5c1c2c91029fd40b0d6a697e2bcd673
-
SSDEEP
24576:kpdp7oz4EdD2Vw6byE1MVoLVKbG65MyekkQ40e8nk9IN:kP7iqLy5VoLVCdJe5QX
Malware Config
Extracted
remcos
RemoteHost
www.projectusf.com:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
gfh
-
mouse_option
false
-
mutex
Rmc-J91LMC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1808 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2856 set thread context of 2268 2856 QUOTATION.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUOTATION.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUOTATION.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2816 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1808 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1808 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2268 QUOTATION.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2856 wrote to memory of 1808 2856 QUOTATION.exe 30 PID 2856 wrote to memory of 1808 2856 QUOTATION.exe 30 PID 2856 wrote to memory of 1808 2856 QUOTATION.exe 30 PID 2856 wrote to memory of 1808 2856 QUOTATION.exe 30 PID 2856 wrote to memory of 2816 2856 QUOTATION.exe 32 PID 2856 wrote to memory of 2816 2856 QUOTATION.exe 32 PID 2856 wrote to memory of 2816 2856 QUOTATION.exe 32 PID 2856 wrote to memory of 2816 2856 QUOTATION.exe 32 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34 PID 2856 wrote to memory of 2268 2856 QUOTATION.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AWLIvgmtRIHlb.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AWLIvgmtRIHlb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9415.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD530233ff665d3de52024d4c08b7b98e18
SHA1a195707fad02a8ab1eddd6090d85dedab9f7a933
SHA2563c5e6a0f57a4963b4436c42fe6acf7be2742d0557fb48e5aa92c6b99d7015e09
SHA5129cff675b5d3744acc0b4732ef297490c8e9fdf7e431efa8d1df7dd276050002835951bffdd70bc5ecdf22796ad03b592638c5b9361e15cb593d4176a9b2935ca
-
Filesize
1KB
MD5fdc0f0bfdd285b56b659d9d0f446c567
SHA1bcaf25f7bf804b0f57e8462bde156380a72fe4c4
SHA2569a888ffd859e00c3937992e1a906e4fe5f98805372fa63d76618f63157721d4e
SHA512d35332c4015a778e0852372259e75a0ee28fd5e171d7401b492801f1b3e52cc98b28e7c55062fe1eb37474602b3023ab2311d1c15b5950f68183d3fd28f455cd