Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 01:59
Static task
static1
Behavioral task
behavioral1
Sample
83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe
Resource
win10v2004-20241007-en
General
-
Target
83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe
-
Size
1.6MB
-
MD5
2e58a14f3a8d78298aee99cb4ea39adc
-
SHA1
90c96e8671f739a0a20daaafab1567d3c457a612
-
SHA256
83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344
-
SHA512
71f115edb7c4013458f957473aa943a910d509f2a94b0ab6e57e84d13e458c17571702830a3eb7cf9e784e52ff1c986e35088a7ce7ab094c48f818d2a7fa6a5d
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLH0yTfIXPlFb2wjVkwAE9owb7uVJnIJYKR3prW4BoPEK8X3PR:f3v+7/5QLVYdkQ99b7ujIJjixkyKi87
Malware Config
Extracted
remcos
RemoteHost
www.projectusf.com:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
gfh
-
mouse_option
false
-
mutex
Rmc-J91LMC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detected Nirsoft tools 6 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/220-42-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/1520-41-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/1520-34-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/220-33-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/2352-40-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/1520-44-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/220-42-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/220-33-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/1520-41-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/1520-34-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/1520-44-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotes.vbs Quotes.exe -
Executes dropped EXE 1 IoCs
pid Process 4028 Quotes.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts svchost.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0009000000023bfb-5.dat autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4028 set thread context of 2072 4028 Quotes.exe 87 PID 2072 set thread context of 1520 2072 svchost.exe 88 PID 2072 set thread context of 220 2072 svchost.exe 89 PID 2072 set thread context of 2352 2072 svchost.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1520 svchost.exe 1520 svchost.exe 2352 svchost.exe 2352 svchost.exe 1520 svchost.exe 1520 svchost.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 4028 Quotes.exe 2072 svchost.exe 2072 svchost.exe 2072 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2352 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2072 svchost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4400 wrote to memory of 4028 4400 83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe 86 PID 4400 wrote to memory of 4028 4400 83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe 86 PID 4400 wrote to memory of 4028 4400 83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe 86 PID 4028 wrote to memory of 2072 4028 Quotes.exe 87 PID 4028 wrote to memory of 2072 4028 Quotes.exe 87 PID 4028 wrote to memory of 2072 4028 Quotes.exe 87 PID 4028 wrote to memory of 2072 4028 Quotes.exe 87 PID 2072 wrote to memory of 1520 2072 svchost.exe 88 PID 2072 wrote to memory of 1520 2072 svchost.exe 88 PID 2072 wrote to memory of 1520 2072 svchost.exe 88 PID 2072 wrote to memory of 1520 2072 svchost.exe 88 PID 2072 wrote to memory of 220 2072 svchost.exe 89 PID 2072 wrote to memory of 220 2072 svchost.exe 89 PID 2072 wrote to memory of 220 2072 svchost.exe 89 PID 2072 wrote to memory of 220 2072 svchost.exe 89 PID 2072 wrote to memory of 2352 2072 svchost.exe 90 PID 2072 wrote to memory of 2352 2072 svchost.exe 90 PID 2072 wrote to memory of 2352 2072 svchost.exe 90 PID 2072 wrote to memory of 2352 2072 svchost.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe"C:\Users\Admin\AppData\Local\Temp\83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\directory\Quotes.exe"C:\Users\Admin\AppData\Local\Temp\83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\83fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\djccazejjjifxlkuxtydfbpvp"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\nlpubrodfrakzayyoelwqojexqima"4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:220
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\qfvfckzftzsocgucxpxyttevyxzntzuf"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5254425d9cc84a940efaca4a84b869b81
SHA1eb9581bf8b003b2a569f2610a9a6a90332b63a7c
SHA25680fa63a99962cdeb94906dedce6ea2ba3d0960e222893ef79de78c0927513c58
SHA512b2ea3bed6a15e45e8687fd0015ad64dfd15a3682e9f667fdfad4b09e598dfc2e1e7b76dfb269da582f879d3b1362c4d71a48758d76118ef68010180b893d6190
-
Filesize
4KB
MD57aca43b2800ceb18b3ed2326532545de
SHA1d4cf207ef85bd749d59c1cb27a09c167ee21523a
SHA2563d9f8622d97587fd84d3d0560a50ab38e5f894fe4b5bcaa34279643fdaaeb480
SHA5120e002e6b8d965c227d9b1aa7c0251619c787ec7717e59667e756e5815e3666a955ea397eb148a1ed6bb7d8045727e4efa656a103f14bc70a03b03f0c91283c2f
-
Filesize
1.6MB
MD52e58a14f3a8d78298aee99cb4ea39adc
SHA190c96e8671f739a0a20daaafab1567d3c457a612
SHA25683fd4f6c8ca4ae094ea629eda985b11e495aa8f6c8421970ef8573a50808e344
SHA51271f115edb7c4013458f957473aa943a910d509f2a94b0ab6e57e84d13e458c17571702830a3eb7cf9e784e52ff1c986e35088a7ce7ab094c48f818d2a7fa6a5d