Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 21:59
Behavioral task
behavioral1
Sample
94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe
Resource
win10v2004-20241007-en
General
-
Target
94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe
-
Size
482KB
-
MD5
6520492a4e7f9bc4dfb068de1c7b6450
-
SHA1
b5c2086a01528386482826ad243c2711e04200fb
-
SHA256
94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aa
-
SHA512
dd8d2d9a22ff521496a908f7dd5de7e25c4d7fd0a56d917a0ba29a5d160a293890f5c397e1ae7bb8a7488d4795221f819d810826b5d533ad1d61e63c438b2565
-
SSDEEP
6144:KTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcr8T4:KTlrYw1RUh3NFn+N5WfIQIjbs/ZX/T4
Malware Config
Extracted
remcos
MIX
liveos.zapto.org:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
music.exe
-
copy_folder
db
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
ire
-
mouse_option
false
-
mutex
Rmc-GHRUZU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-GHRUZU = "\"C:\\ProgramData\\db\\music.exe\"" music.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-GHRUZU = "\"C:\\ProgramData\\db\\music.exe\"" 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run music.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe -
Executes dropped EXE 1 IoCs
pid Process 1456 music.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-GHRUZU = "\"C:\\ProgramData\\db\\music.exe\"" 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-GHRUZU = "\"C:\\ProgramData\\db\\music.exe\"" 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-GHRUZU = "\"C:\\ProgramData\\db\\music.exe\"" music.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-GHRUZU = "\"C:\\ProgramData\\db\\music.exe\"" music.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1456 set thread context of 2396 1456 music.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language music.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1456 music.exe 1456 music.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1456 music.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1260 wrote to memory of 1456 1260 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe 86 PID 1260 wrote to memory of 1456 1260 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe 86 PID 1260 wrote to memory of 1456 1260 94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe 86 PID 1456 wrote to memory of 2396 1456 music.exe 87 PID 1456 wrote to memory of 2396 1456 music.exe 87 PID 1456 wrote to memory of 2396 1456 music.exe 87 PID 1456 wrote to memory of 2396 1456 music.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe"C:\Users\Admin\AppData\Local\Temp\94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aaN.exe"1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\ProgramData\db\music.exe"C:\ProgramData\db\music.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2396
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
482KB
MD56520492a4e7f9bc4dfb068de1c7b6450
SHA1b5c2086a01528386482826ad243c2711e04200fb
SHA25694465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aa
SHA512dd8d2d9a22ff521496a908f7dd5de7e25c4d7fd0a56d917a0ba29a5d160a293890f5c397e1ae7bb8a7488d4795221f819d810826b5d533ad1d61e63c438b2565