Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 09:01
Static task
static1
Behavioral task
behavioral1
Sample
SwiftPaymentCopy.pif.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SwiftPaymentCopy.pif.exe
Resource
win10v2004-20240802-en
General
-
Target
SwiftPaymentCopy.pif.exe
-
Size
1.0MB
-
MD5
46ab34139423cd2978d27245891ce5d5
-
SHA1
1f48eece26d531e006cd41c43c6092558ee324c0
-
SHA256
4ed81a9a25e52a99d76805b081679cfe3628756be4bda6a47e365506c7df3a0c
-
SHA512
b764e97ae1d5a2328c5cef7b331aa9c6fd82715a5a4bb3b7209a31da2354f7dfa28f2b601a62e52cd850cd5aa5e0713fb77e480ef50abec65d18039d7ef92585
-
SSDEEP
24576:8OAi/eYBrgdPLmmpQNogk+qyh4Rck6jGTo7NE:8hi3BviDg36RlA
Malware Config
Extracted
remcos
RemoteHost
www.drechftankholding.com:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
dfgh
-
mouse_option
false
-
mutex
Rmc-8J6PG9
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2432-62-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/796-60-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/772-57-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/772-57-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/796-60-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2876 powershell.exe 2944 powershell.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1448 set thread context of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 2364 set thread context of 796 2364 vbc.exe 38 PID 2364 set thread context of 772 2364 vbc.exe 39 PID 2364 set thread context of 2432 2364 vbc.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SwiftPaymentCopy.pif.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2760 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1448 SwiftPaymentCopy.pif.exe 1448 SwiftPaymentCopy.pif.exe 2944 powershell.exe 2876 powershell.exe 796 vbc.exe 796 vbc.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2364 vbc.exe 2364 vbc.exe 2364 vbc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1448 SwiftPaymentCopy.pif.exe Token: SeDebugPrivilege 2944 powershell.exe Token: SeDebugPrivilege 2876 powershell.exe Token: SeDebugPrivilege 2432 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2364 vbc.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1448 wrote to memory of 2876 1448 SwiftPaymentCopy.pif.exe 30 PID 1448 wrote to memory of 2876 1448 SwiftPaymentCopy.pif.exe 30 PID 1448 wrote to memory of 2876 1448 SwiftPaymentCopy.pif.exe 30 PID 1448 wrote to memory of 2876 1448 SwiftPaymentCopy.pif.exe 30 PID 1448 wrote to memory of 2944 1448 SwiftPaymentCopy.pif.exe 32 PID 1448 wrote to memory of 2944 1448 SwiftPaymentCopy.pif.exe 32 PID 1448 wrote to memory of 2944 1448 SwiftPaymentCopy.pif.exe 32 PID 1448 wrote to memory of 2944 1448 SwiftPaymentCopy.pif.exe 32 PID 1448 wrote to memory of 2760 1448 SwiftPaymentCopy.pif.exe 33 PID 1448 wrote to memory of 2760 1448 SwiftPaymentCopy.pif.exe 33 PID 1448 wrote to memory of 2760 1448 SwiftPaymentCopy.pif.exe 33 PID 1448 wrote to memory of 2760 1448 SwiftPaymentCopy.pif.exe 33 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 1448 wrote to memory of 2364 1448 SwiftPaymentCopy.pif.exe 36 PID 2364 wrote to memory of 796 2364 vbc.exe 38 PID 2364 wrote to memory of 796 2364 vbc.exe 38 PID 2364 wrote to memory of 796 2364 vbc.exe 38 PID 2364 wrote to memory of 796 2364 vbc.exe 38 PID 2364 wrote to memory of 796 2364 vbc.exe 38 PID 2364 wrote to memory of 772 2364 vbc.exe 39 PID 2364 wrote to memory of 772 2364 vbc.exe 39 PID 2364 wrote to memory of 772 2364 vbc.exe 39 PID 2364 wrote to memory of 772 2364 vbc.exe 39 PID 2364 wrote to memory of 772 2364 vbc.exe 39 PID 2364 wrote to memory of 2432 2364 vbc.exe 40 PID 2364 wrote to memory of 2432 2364 vbc.exe 40 PID 2364 wrote to memory of 2432 2364 vbc.exe 40 PID 2364 wrote to memory of 2432 2364 vbc.exe 40 PID 2364 wrote to memory of 2432 2364 vbc.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\SwiftPaymentCopy.pif.exe"C:\Users\Admin\AppData\Local\Temp\SwiftPaymentCopy.pif.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SwiftPaymentCopy.pif.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lZqUPD.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lZqUPD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4099.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2760
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\vyvyioodulwbrzajisrqecsunxfvo"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\gsiqjhzfitogbfwnsdekphflwexwhjdz"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:772
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\qmoj"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5d17ec373aaa4d10d8c73c9e3c00404ba
SHA10de4d38ab8eeb4c7934fd940c95cff14aa8fb3a4
SHA2566d4f96c1e706541ee6cf05e190b377b2fdbdc8639438ac6888d25d044e846a3f
SHA512dc46f17a42ac6cfdf1e68c6bba721147e3f202b16743039294c1852648466b2983904de83a52a228b900cd2d3cc1f75fd4d7101b9dc62b3d3b4e77f9485c4add
-
Filesize
1KB
MD533cbb15c7afd7ca9bd6275269a856aca
SHA11bdddcfe9f15f455a860c8eae2d4814ff780f5bb
SHA2563d5fe6eab9ef072e94b1928b9289cb108f7c1f029b9efa62a0b8b4c9293f6869
SHA5125c58da2634fc062bc5a058c30d2bfb4a1c304be8b9f2d1e16df789aba8b3070cc78df80c7577d4b29c4460259ace353ded3032ac1685de6d64a827a37eb755df
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5636b806c262875fd9c6e314caa732663
SHA1864bfc92aafbdd1f6dbe57ae878e01b195309099
SHA25640512f55a8940959902f33582cd3069f3f6dea3bd185bf6d68fd26cbf3bace44
SHA512bd649c37d51d34c3f9b80c03851f6718026be6b25cecd3e4f55bf528a7c69f18000e8ed361551c79ae447b290e0157a6fe84f9502e585653d048dfb81d2c4135