Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 10:41
Behavioral task
behavioral1
Sample
QD0FZ_stub.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
QD0FZ_stub.exe
Resource
win10v2004-20241007-en
General
-
Target
QD0FZ_stub.exe
-
Size
469KB
-
MD5
e7be6cad5e537ccd392c2a1aefa60ee7
-
SHA1
324b9688a5d8c39f5e96e41f451cfc9a225d48d2
-
SHA256
8c7a4657ea68a69f364c8acb1881aa6e0f8140d3aba9a917f484ba6ec705db21
-
SHA512
0fc526f228ace907e580433d7e85e170ebfdc1eae24cf21d2e35568007f30abf517de2c215b1718ed31787e0ebfdafd89f11e6214f09f01492f75fe209c09037
-
SSDEEP
12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS0n9:uiLJbpI7I2WhQqZ709
Malware Config
Extracted
remcos
RemoteHost
else-directors.gl.at.ply.gg:56448
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Bitdefender.exe
-
copy_folder
Bitdefender
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-XTM51M
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
VisualStudioServer
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\Bitdefender.exe\"" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run QD0FZ_stub.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\Bitdefender.exe\"" QD0FZ_stub.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Bitdefender.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\Bitdefender.exe\"" Bitdefender.exe -
Deletes itself 1 IoCs
pid Process 2684 WScript.exe -
Executes dropped EXE 1 IoCs
pid Process 2928 Bitdefender.exe -
Loads dropped DLL 2 IoCs
pid Process 2816 cmd.exe 2816 cmd.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\Bitdefender.exe\"" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\Bitdefender.exe\"" QD0FZ_stub.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\Bitdefender.exe\"" QD0FZ_stub.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\Bitdefender.exe\"" Bitdefender.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\Bitdefender.exe\"" Bitdefender.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\Bitdefender.exe\"" iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2928 set thread context of 2724 2928 Bitdefender.exe 40 PID 2724 set thread context of 2728 2724 iexplore.exe 44 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QD0FZ_stub.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bitdefender.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 3 IoCs
pid Process 2636 reg.exe 1348 reg.exe 2716 reg.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2928 Bitdefender.exe 2724 iexplore.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2400 1740 QD0FZ_stub.exe 31 PID 1740 wrote to memory of 2400 1740 QD0FZ_stub.exe 31 PID 1740 wrote to memory of 2400 1740 QD0FZ_stub.exe 31 PID 1740 wrote to memory of 2400 1740 QD0FZ_stub.exe 31 PID 2400 wrote to memory of 2716 2400 cmd.exe 33 PID 2400 wrote to memory of 2716 2400 cmd.exe 33 PID 2400 wrote to memory of 2716 2400 cmd.exe 33 PID 2400 wrote to memory of 2716 2400 cmd.exe 33 PID 1740 wrote to memory of 2684 1740 QD0FZ_stub.exe 34 PID 1740 wrote to memory of 2684 1740 QD0FZ_stub.exe 34 PID 1740 wrote to memory of 2684 1740 QD0FZ_stub.exe 34 PID 1740 wrote to memory of 2684 1740 QD0FZ_stub.exe 34 PID 2684 wrote to memory of 2816 2684 WScript.exe 35 PID 2684 wrote to memory of 2816 2684 WScript.exe 35 PID 2684 wrote to memory of 2816 2684 WScript.exe 35 PID 2684 wrote to memory of 2816 2684 WScript.exe 35 PID 2816 wrote to memory of 2928 2816 cmd.exe 37 PID 2816 wrote to memory of 2928 2816 cmd.exe 37 PID 2816 wrote to memory of 2928 2816 cmd.exe 37 PID 2816 wrote to memory of 2928 2816 cmd.exe 37 PID 2928 wrote to memory of 108 2928 Bitdefender.exe 38 PID 2928 wrote to memory of 108 2928 Bitdefender.exe 38 PID 2928 wrote to memory of 108 2928 Bitdefender.exe 38 PID 2928 wrote to memory of 108 2928 Bitdefender.exe 38 PID 2928 wrote to memory of 2724 2928 Bitdefender.exe 40 PID 2928 wrote to memory of 2724 2928 Bitdefender.exe 40 PID 2928 wrote to memory of 2724 2928 Bitdefender.exe 40 PID 2928 wrote to memory of 2724 2928 Bitdefender.exe 40 PID 2928 wrote to memory of 2724 2928 Bitdefender.exe 40 PID 2724 wrote to memory of 2076 2724 iexplore.exe 41 PID 2724 wrote to memory of 2076 2724 iexplore.exe 41 PID 2724 wrote to memory of 2076 2724 iexplore.exe 41 PID 2724 wrote to memory of 2076 2724 iexplore.exe 41 PID 2076 wrote to memory of 2636 2076 cmd.exe 43 PID 2076 wrote to memory of 2636 2076 cmd.exe 43 PID 2076 wrote to memory of 2636 2076 cmd.exe 43 PID 2076 wrote to memory of 2636 2076 cmd.exe 43 PID 2724 wrote to memory of 2728 2724 iexplore.exe 44 PID 2724 wrote to memory of 2728 2724 iexplore.exe 44 PID 2724 wrote to memory of 2728 2724 iexplore.exe 44 PID 2724 wrote to memory of 2728 2724 iexplore.exe 44 PID 2724 wrote to memory of 2728 2724 iexplore.exe 44 PID 108 wrote to memory of 1348 108 cmd.exe 45 PID 108 wrote to memory of 1348 108 cmd.exe 45 PID 108 wrote to memory of 1348 108 cmd.exe 45 PID 108 wrote to memory of 1348 108 cmd.exe 45 PID 2724 wrote to memory of 984 2724 iexplore.exe 48 PID 2724 wrote to memory of 984 2724 iexplore.exe 48 PID 2724 wrote to memory of 984 2724 iexplore.exe 48 PID 2724 wrote to memory of 984 2724 iexplore.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\QD0FZ_stub.exe"C:\Users\Admin\AppData\Local\Temp\QD0FZ_stub.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2716
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Bitdefender\Bitdefender.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\ProgramData\Bitdefender\Bitdefender.exeC:\ProgramData\Bitdefender\Bitdefender.exe4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1348
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"5⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2636
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe6⤵PID:2728
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ugwmoihbmoaefd.vbs"6⤵
- System Location Discovery: System Language Discovery
PID:984
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538B
MD50d300850c4b872ee0997c0714d8946f8
SHA1c63b8f1a899b32bfb76555c22e3d91f6cb801256
SHA256025c871f620d631d578513c4dea28a0870ce306eb90ba2e19ef8ca641ba20ed9
SHA512ac704d9db7c78b12051e919d9b15d63bf62c2c0ed01ebe2a824a545df44c47fb0ed80af647a77c25ffa4fe1ade7c01151e8ac187118c15b6dbfbea3ce36ff7da
-
Filesize
580B
MD53acb59fed7a8eb82ab2dafe7964abe36
SHA1a18fe9a9e10edc38c8f326a254f643892d24e2d4
SHA256e01b68ba47caab4271202c88172dfd0f3917c9c034a8f0188430388e1c6f9dde
SHA512c483d1f9cb129d3b99af543a888133c98a779332a522fb0860255c34782f97bb0028153195b39c9300d00ff5b6e93b4aa57aef820dad3a63ed52be930a052ef5
-
Filesize
469KB
MD5e7be6cad5e537ccd392c2a1aefa60ee7
SHA1324b9688a5d8c39f5e96e41f451cfc9a225d48d2
SHA2568c7a4657ea68a69f364c8acb1881aa6e0f8140d3aba9a917f484ba6ec705db21
SHA5120fc526f228ace907e580433d7e85e170ebfdc1eae24cf21d2e35568007f30abf517de2c215b1718ed31787e0ebfdafd89f11e6214f09f01492f75fe209c09037