Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe
Resource
win10v2004-20240802-en
General
-
Target
430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe
-
Size
885KB
-
MD5
4486c981feaebbbd36fed46237157836
-
SHA1
c8c48956dadaf9c71fbcb95ccbb27771071f777f
-
SHA256
430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5
-
SHA512
483cb6ca50611ee90f3958d9acee301969503e821352fdfc7e4d84617249bea2bfb72006fd3d9c56156813fcc29a44c39016f5854e83b78757a0a29ea68b6cb6
-
SSDEEP
24576:uzDv0aPkkju5aJKQQBvHG5571qWU9ujI:unjPjcakQ77/U9
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:52121
officerem.duckdns.org:52121
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-6GPUH1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2736 powershell.exe 2884 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1832 set thread context of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2780 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 2736 powershell.exe 2884 powershell.exe 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 2884 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2736 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 31 PID 1832 wrote to memory of 2736 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 31 PID 1832 wrote to memory of 2736 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 31 PID 1832 wrote to memory of 2736 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 31 PID 1832 wrote to memory of 2884 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 33 PID 1832 wrote to memory of 2884 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 33 PID 1832 wrote to memory of 2884 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 33 PID 1832 wrote to memory of 2884 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 33 PID 1832 wrote to memory of 2780 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 34 PID 1832 wrote to memory of 2780 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 34 PID 1832 wrote to memory of 2780 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 34 PID 1832 wrote to memory of 2780 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 34 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37 PID 1832 wrote to memory of 2748 1832 430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe"C:\Users\Admin\AppData\Local\Temp\430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\430def766ae648ee115b2ca3151e4519bfd8c002b0dbe1f1620a3c3702a2e3a5.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OdQDwgVqjDzll.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdQDwgVqjDzll" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE3CA.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2780
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ec25993c465b6a76fff0211e765feffd
SHA1b8fa54250ef563eb1fc395246e7ad8bd3931da17
SHA2568790e9e556c8d52b62396b5bd8029991a16c77a24b7b563cb07a0bc8e37ed1ef
SHA5125667bcb25ca8c6aad7202a66ababef3330a89c825555a1c3593c367eb7e1c384596513fce4b6cc12d5013a640db8fed1b60a15884cc2d302c00fb430d0fc1dd5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD599844af59ba9d4340ad4964cc7e32f9a
SHA1c48378c77649c45c59fe553a96b274ce6b50faf1
SHA256c80aef71ed380ff6906fd03d8fe38ee54a27f49215ef7f08bff6e1fc2fae2073
SHA51220ec7ffb7efc7368ee4366310d6bd81ba4953a18805f93adeb9a8f6f9a1f831884fef14b3a0f782bee2bb6c0cbfcda5bda6145f513737376b38bed0285bd3398