Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
178s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 14:11
Static task
static1
Behavioral task
behavioral1
Sample
CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe
Resource
win10v2004-20241007-en
General
-
Target
CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe
-
Size
5.1MB
-
MD5
06bd75f1686847255ba61a86ef69eb8a
-
SHA1
e11abefa20031ce5f497fcb59c57e2f143a81e38
-
SHA256
45cc400d38a6a3de5075d593718a2b63deddfc20fd97107cf01c0c0bee341adc
-
SHA512
eb7e035aab6b1c5496dc8cebd5bb700ecf3d761747814ed8fc9a8534f989c3c84854f6878b0d076a13ca0d2d10413c10828cbb043e052566129c7c73a23bf8a7
-
SSDEEP
49152:k9C6IGwcuCr4SOgkpEEd6HninHFdrSgoQt171nYQo7uK2oaAXIi847dmjPU7n+at:kM6FDEdjl46JHElSYwkaEIm7x/
Malware Config
Extracted
remcos
Voltarger
dfgdfghghfhfh.con-ip.com:1665
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-I3REIW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 684 build.exe -
Loads dropped DLL 1 IoCs
pid Process 2860 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe -
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook csc.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook csc.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook csc.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook csc.exe Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\SprintDesignerEditor = "C:\\Users\\Admin\\Music\\SprintDesignerUpdater\\SprintVideoOculus.exe" CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\SprintDesignerEditor = "C:\\Users\\Admin\\Music\\SprintDesignerUpdater\\SprintVideoOculus.exe" build.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 684 set thread context of 2892 684 build.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2892 csc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2860 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1036 wrote to memory of 2860 1036 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 31 PID 1036 wrote to memory of 2860 1036 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 31 PID 1036 wrote to memory of 2860 1036 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 31 PID 1036 wrote to memory of 2860 1036 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 31 PID 1036 wrote to memory of 2860 1036 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 31 PID 1036 wrote to memory of 2860 1036 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 31 PID 2860 wrote to memory of 684 2860 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 33 PID 2860 wrote to memory of 684 2860 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 33 PID 2860 wrote to memory of 684 2860 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 33 PID 2860 wrote to memory of 684 2860 CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe 33 PID 684 wrote to memory of 2892 684 build.exe 34 PID 684 wrote to memory of 2892 684 build.exe 34 PID 684 wrote to memory of 2892 684 build.exe 34 PID 684 wrote to memory of 2892 684 build.exe 34 PID 684 wrote to memory of 2892 684 build.exe 34 PID 684 wrote to memory of 2892 684 build.exe 34 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 csc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe"C:\Users\Admin\AppData\Local\Temp\CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe"C:\Users\Admin\AppData\Local\Temp\CUS 415811343 4894584198641984198419861961961 OCTUBRE 7 DE 2024.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"4⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2892
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5e00fd54000020dfa00e3f39609d7d5d7
SHA1b13bd221664676fe9b0de7fdc3ed79c1f9390ca8
SHA256b1df54dff8045ac221e9c980bc4a66853dddc10c6781d2a5afa5d18eb7dcad78
SHA51279b2ad6b5b82616f69dc9fc8f0ae14d2946157b4f0d8b7620d3d09c91efb4f1834bf9ba897eaeb73a37cf04221c4e7969f2e5ac5503baaaa0b454a8089b48dfd
-
Filesize
5.1MB
MD5d5beeffa4590c187698e512a78dd1530
SHA1322aa0593d60fa30a258ca26e9d0a7157af9c0cf
SHA256a3989a05c58f63b85f038e4a32b2f9af1b987101000c1bebd160cc121a3b9e3e
SHA512e1320e21796566d6d0123e7a145ccfc90637a35a9f0127ab6fdf0721270fbd37c4bc88fedfb64e46d882c0d971a68db4c79c7e18949a892027b92f34efe7e0f6