Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
58s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe
Resource
win10v2004-20240802-en
General
-
Target
bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe
-
Size
436KB
-
MD5
347bc8ce26d1a2f12714c11f3dacdd86
-
SHA1
b9bf9b6161ab9a59f733c6b258a5e0977ea96f72
-
SHA256
bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad
-
SHA512
76b9ed3e398f64948643e127a8f8f9c654777995ff90cbcc58ab69c7134cf53c6c63861cd79aa5ed3eea077a1f0de6a9877708e8461cd243a3334432dcf53254
-
SSDEEP
12288:CtmEp/dzYtn6c1Ts8ovJlgC2PNBxqe8Ke3:QdzYd6c1TAvfgxxt8N
Malware Config
Extracted
remcos
Yavakosa
198.23.227.212:32583
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
yava_vd.exe
-
copy_folder
yava
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-D7NPY6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe -
Executes dropped EXE 1 IoCs
pid Process 1064 yava_vd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-D7NPY6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\yava\\yava_vd.exe\"" bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-D7NPY6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\yava\\yava_vd.exe\"" yava_vd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 23 IoCs
pid pid_target Process procid_target 2360 3744 WerFault.exe 83 956 3744 WerFault.exe 83 1464 3744 WerFault.exe 83 3304 3744 WerFault.exe 83 1860 3744 WerFault.exe 83 1460 3744 WerFault.exe 83 4964 3744 WerFault.exe 83 4564 1064 WerFault.exe 97 636 1064 WerFault.exe 97 5032 1064 WerFault.exe 97 4972 1064 WerFault.exe 97 3508 1064 WerFault.exe 97 2956 1064 WerFault.exe 97 4480 1064 WerFault.exe 97 2256 1064 WerFault.exe 97 3272 1064 WerFault.exe 97 1256 1064 WerFault.exe 97 2856 1064 WerFault.exe 97 3172 1064 WerFault.exe 97 4192 1064 WerFault.exe 97 4668 1064 WerFault.exe 97 4048 1064 WerFault.exe 97 1096 1064 WerFault.exe 97 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yava_vd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3744 wrote to memory of 1064 3744 bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe 97 PID 3744 wrote to memory of 1064 3744 bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe 97 PID 3744 wrote to memory of 1064 3744 bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe"C:\Users\Admin\AppData\Local\Temp\bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 10122⤵
- Program crash
PID:2360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 10482⤵
- Program crash
PID:956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 11602⤵
- Program crash
PID:1464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 10362⤵
- Program crash
PID:3304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 11882⤵
- Program crash
PID:1860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 11802⤵
- Program crash
PID:1460
-
-
C:\Users\Admin\AppData\Roaming\yava\yava_vd.exe"C:\Users\Admin\AppData\Roaming\yava\yava_vd.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 6683⤵
- Program crash
PID:4564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 6723⤵
- Program crash
PID:636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 7483⤵
- Program crash
PID:5032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 7843⤵
- Program crash
PID:4972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 7963⤵
- Program crash
PID:3508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 9483⤵
- Program crash
PID:2956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 9883⤵
- Program crash
PID:4480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 10083⤵
- Program crash
PID:2256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 9803⤵
- Program crash
PID:3272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 10163⤵
- Program crash
PID:1256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 12643⤵
- Program crash
PID:2856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 6843⤵
- Program crash
PID:3172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 8843⤵
- Program crash
PID:4192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 13043⤵
- Program crash
PID:4668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 13723⤵
- Program crash
PID:4048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 13203⤵
- Program crash
PID:1096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 9962⤵
- Program crash
PID:4964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3744 -ip 37441⤵PID:1916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3744 -ip 37441⤵PID:1832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3744 -ip 37441⤵PID:4852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3744 -ip 37441⤵PID:2448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3744 -ip 37441⤵PID:3236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3744 -ip 37441⤵PID:2716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3744 -ip 37441⤵PID:2968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1064 -ip 10641⤵PID:2896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1064 -ip 10641⤵PID:1232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1064 -ip 10641⤵PID:2736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1064 -ip 10641⤵PID:1708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1064 -ip 10641⤵PID:4832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1064 -ip 10641⤵PID:3688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1064 -ip 10641⤵PID:2728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1064 -ip 10641⤵PID:3608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1064 -ip 10641⤵PID:4688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1064 -ip 10641⤵PID:3060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1064 -ip 10641⤵PID:1876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1064 -ip 10641⤵PID:2564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1064 -ip 10641⤵PID:412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1064 -ip 10641⤵PID:4576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1064 -ip 10641⤵PID:3816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1064 -ip 10641⤵PID:3076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD5347bc8ce26d1a2f12714c11f3dacdd86
SHA1b9bf9b6161ab9a59f733c6b258a5e0977ea96f72
SHA256bc5291ee0d10c3c162be7663068790322127c781d1ed8789a847c140dd0075ad
SHA51276b9ed3e398f64948643e127a8f8f9c654777995ff90cbcc58ab69c7134cf53c6c63861cd79aa5ed3eea077a1f0de6a9877708e8461cd243a3334432dcf53254