Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
05/10/2024, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation Order.exe
Resource
win10-20240611-en
General
-
Target
Confirmation Order.exe
-
Size
892KB
-
MD5
3b13b07b05ea3f2084ee3c38080fffe3
-
SHA1
dde112544004281ad7d02b36c607bc4a258f22a6
-
SHA256
b93408af1dfa127e3b11d16cd92dab65f448d77fa933259c139bb0f0e6d33a75
-
SHA512
c09987d78d52fc94bc991b40380b6f5752f1b15139850d24ed93e9ea8ce74add4b4b477493fb8c0a6980de9e14fb511123e2571622c3c5a46f4402f09d037fe0
-
SSDEEP
12288:5Eqv8RratEshTEMAiqoWpVvfS4D36FUOJT02id9IV/SxjTWAY+acgp8bQbQk:J8OZTEMAifWTvfuL42id94cgGIQ
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:59321
nnamoo.duckdns.org:59321
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-41EVS0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2352 powershell.exe 1272 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1592 set thread context of 216 1592 Confirmation Order.exe 78 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Confirmation Order.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Confirmation Order.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1180 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2352 powershell.exe 1592 Confirmation Order.exe 1592 Confirmation Order.exe 1272 powershell.exe 1272 powershell.exe 2352 powershell.exe 1272 powershell.exe 2352 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2352 powershell.exe Token: SeDebugPrivilege 1272 powershell.exe Token: SeDebugPrivilege 1592 Confirmation Order.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1592 wrote to memory of 2352 1592 Confirmation Order.exe 71 PID 1592 wrote to memory of 2352 1592 Confirmation Order.exe 71 PID 1592 wrote to memory of 2352 1592 Confirmation Order.exe 71 PID 1592 wrote to memory of 1272 1592 Confirmation Order.exe 73 PID 1592 wrote to memory of 1272 1592 Confirmation Order.exe 73 PID 1592 wrote to memory of 1272 1592 Confirmation Order.exe 73 PID 1592 wrote to memory of 1180 1592 Confirmation Order.exe 74 PID 1592 wrote to memory of 1180 1592 Confirmation Order.exe 74 PID 1592 wrote to memory of 1180 1592 Confirmation Order.exe 74 PID 1592 wrote to memory of 560 1592 Confirmation Order.exe 77 PID 1592 wrote to memory of 560 1592 Confirmation Order.exe 77 PID 1592 wrote to memory of 560 1592 Confirmation Order.exe 77 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78 PID 1592 wrote to memory of 216 1592 Confirmation Order.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bDXSeyoVzkpA.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bDXSeyoVzkpA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp838.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1180
-
-
C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"2⤵PID:560
-
-
C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"2⤵
- System Location Discovery: System Language Discovery
PID:216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD5308a486d9ff6b72bb3600318728c0dd9
SHA1363f1a8b273d1b7e0356b03b04ecfe5702e43a13
SHA256f33dc739713f18979ba95608a857567e0eadc40e1c4559f6f0035dd2f0458923
SHA51251a525d7b4895dce73cb665f8362e75a2a7fd35488220a1980aa89a82a55cf9cb9bf82e40e05a17c890be59eecbc4fe0233b70979486a1fdce84a6bdd59398da
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
1KB
MD5b4d84cc41b1d80fedcdf0688d37ab2de
SHA12f67074a867128def0bab83a352f470db9a2553f
SHA256a5517534690b6dc43394e27b8097e1c7d7879469f1bfe4f1c24d94f7e16fa82d
SHA512fda8978e07fbc46032dcb37374d041bfaa76945d666f9e95b1dac49ca6999ef0d174f3e2573dde1079a987f3e07989236e3ad0037036ef7b3d8138bdca4d6d19