Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/09/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
QUOTATION.exe
Resource
win10v2004-20240802-en
General
-
Target
QUOTATION.exe
-
Size
900KB
-
MD5
a1e1f9aef9a168423b2f0cd1dbe2ba9a
-
SHA1
921abb3a628f79b295c92d7298da8dfedc1b9376
-
SHA256
66c41f2310824c8b5b2365a2283d28c5b47d2a829afa45a1b00b710259d9622d
-
SHA512
6281720fd5a85723cb6cc85845fa4895cf0190cad58a4924c2a36a0d7d7b6f41b4a2f1c7bf005e969c5e973294c287a3c5c1c2c91029fd40b0d6a697e2bcd673
-
SSDEEP
24576:kpdp7oz4EdD2Vw6byE1MVoLVKbG65MyekkQ40e8nk9IN:kP7iqLy5VoLVCdJe5QX
Malware Config
Extracted
remcos
RemoteHost
www.projectusf.com:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
gfh
-
mouse_option
false
-
mutex
Rmc-J91LMC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4732 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation QUOTATION.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1856 set thread context of 1432 1856 QUOTATION.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUOTATION.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUOTATION.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2684 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4732 powershell.exe 1856 QUOTATION.exe 1856 QUOTATION.exe 4732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4732 powershell.exe Token: SeDebugPrivilege 1856 QUOTATION.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1432 QUOTATION.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1856 wrote to memory of 4732 1856 QUOTATION.exe 87 PID 1856 wrote to memory of 4732 1856 QUOTATION.exe 87 PID 1856 wrote to memory of 4732 1856 QUOTATION.exe 87 PID 1856 wrote to memory of 2684 1856 QUOTATION.exe 89 PID 1856 wrote to memory of 2684 1856 QUOTATION.exe 89 PID 1856 wrote to memory of 2684 1856 QUOTATION.exe 89 PID 1856 wrote to memory of 2776 1856 QUOTATION.exe 92 PID 1856 wrote to memory of 2776 1856 QUOTATION.exe 92 PID 1856 wrote to memory of 2776 1856 QUOTATION.exe 92 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93 PID 1856 wrote to memory of 1432 1856 QUOTATION.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AWLIvgmtRIHlb.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AWLIvgmtRIHlb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD467.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"2⤵PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD57f562f636064208256fe3dbc39fa4de6
SHA1aa28673c4bed7dfe066cbaed0a83009cddfda9c3
SHA2565f2804145a65b4c9ecf9a7883830e3e96b9b8443123017bd245cff259751a3bd
SHA5126d70b9263fe7b1c20f32483bffe5da3dc59438108821a35474c20f479383b78e995410efa789bc8b43d4dc16ff437f21e807da12cc6dec8feeac742419b380ae
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD50d82d800a5155522a530db387e6c7de3
SHA1f0ed4257532231a84a27cb55ab577609b4863eca
SHA256d61e66c37b8bc26e07db4e603eef3ea1e2f407896c85acef6cdcdc9427be39a2
SHA512fb59f5f8e56c905c4f4283edd17f8e193433627b1bb1c67ed2e233406ad9fec17cd6a552c70af45387f8f464b26fb661da82acd2b36f6183e6845e9aece14156