Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 22:47
Static task
static1
Behavioral task
behavioral1
Sample
LIQUIDACION0002389204324283.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
LIQUIDACION0002389204324283.exe
Resource
win10v2004-20241007-en
General
-
Target
LIQUIDACION0002389204324283.exe
-
Size
5.0MB
-
MD5
f4f4a22021ac7ec3dbeaca8ecbb06043
-
SHA1
1bac415e7901b29a10cf3d0bdc90be5822003a81
-
SHA256
860b0aba6759593740ad1b6b5ae1bb895c09b85be566273c2877ef140ef75a65
-
SHA512
1c9b01d6e4f1b8b318d42ec10a54552dd2dabac6ea79abc657ddd2efbd5006cb80d2b112725f4dd57a1195eb151bcf5f860cc98f90254c6491f235152be6a742
-
SSDEEP
98304:3/k9oQgoMllDi8miotam56KNGiomHbJd5ML+waoQLi3nQiIK:3fQgbDDi8miotam56KNh7JIQ2AiL
Malware Config
Extracted
remcos
09()()()OcTUBRE()()()2024
oijifhb490398hfuni34uifn4.con-ip.com:5023
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-HZCS32
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\HxdDesignerEditor = "C:\\Users\\Admin\\Music\\HxdDesignerUpdater\\HxdVideo.exe" LIQUIDACION0002389204324283.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIQUIDACION0002389204324283.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIQUIDACION0002389204324283.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3068 LIQUIDACION0002389204324283.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2168 wrote to memory of 3068 2168 LIQUIDACION0002389204324283.exe 30 PID 2168 wrote to memory of 3068 2168 LIQUIDACION0002389204324283.exe 30 PID 2168 wrote to memory of 3068 2168 LIQUIDACION0002389204324283.exe 30 PID 2168 wrote to memory of 3068 2168 LIQUIDACION0002389204324283.exe 30 PID 2168 wrote to memory of 3068 2168 LIQUIDACION0002389204324283.exe 30 PID 2168 wrote to memory of 3068 2168 LIQUIDACION0002389204324283.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\LIQUIDACION0002389204324283.exe"C:\Users\Admin\AppData\Local\Temp\LIQUIDACION0002389204324283.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\LIQUIDACION0002389204324283.exe"C:\Users\Admin\AppData\Local\Temp\LIQUIDACION0002389204324283.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD50f8a5c457d9d781c353eb395ac8a0c17
SHA1fbb57ed06250aa2285676d9627ed4b2a56eed5f1
SHA256a7fc344d35f29fb8d1a0f23fa75e38143bac577e8964b095c8be1e134b1164ea
SHA512b0424c1c591361d84bc3f7fb15710b43c3c3ebd33501ac385c2664578281e3dc377447bb77bd636c0fbec7e5018d536ef78bac189330c48349c37aa3fe2cb2ca