Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
Bank Fund Transfer-589237.scr
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bank Fund Transfer-589237.scr
Resource
win10v2004-20241007-en
General
-
Target
Bank Fund Transfer-589237.scr
-
Size
1.2MB
-
MD5
552044ce92b78bf4b68d242c2c380afe
-
SHA1
2ef4efa20f4fd0d05d8f49ccb22c9afeada93a62
-
SHA256
cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3
-
SHA512
4dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967
-
SSDEEP
24576:6YdgfvzmIzxWOwxzCJYC3PPoKb0Eci5ihjJVxw9bYOd+8:qzmmWXRCaePPjb0Eci5ih7xw9bYI
Malware Config
Extracted
remcos
RemoteHost
212.162.149.226:9285
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
AppUpdate
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-VCJ8ZS
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
AppUpdate
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2840 powershell.exe 2768 powershell.exe 2220 powershell.exe 3064 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 2364 remcos.exe 3024 remcos.exe -
Loads dropped DLL 1 IoCs
pid Process 1704 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppUpdate = "\"C:\\ProgramData\\AppUpdate\\remcos.exe\"" Bank Fund Transfer-589237.scr Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AppUpdate = "\"C:\\ProgramData\\AppUpdate\\remcos.exe\"" Bank Fund Transfer-589237.scr Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppUpdate = "\"C:\\ProgramData\\AppUpdate\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AppUpdate = "\"C:\\ProgramData\\AppUpdate\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2524 set thread context of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2364 set thread context of 3024 2364 remcos.exe 48 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bank Fund Transfer-589237.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bank Fund Transfer-589237.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 764 schtasks.exe 2240 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2524 Bank Fund Transfer-589237.scr 2524 Bank Fund Transfer-589237.scr 2524 Bank Fund Transfer-589237.scr 2524 Bank Fund Transfer-589237.scr 2768 powershell.exe 2840 powershell.exe 2364 remcos.exe 2364 remcos.exe 2364 remcos.exe 2220 powershell.exe 3064 powershell.exe 2364 remcos.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2524 Bank Fund Transfer-589237.scr Token: SeDebugPrivilege 2768 powershell.exe Token: SeDebugPrivilege 2840 powershell.exe Token: SeDebugPrivilege 2364 remcos.exe Token: SeDebugPrivilege 2220 powershell.exe Token: SeDebugPrivilege 3064 powershell.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2840 2524 Bank Fund Transfer-589237.scr 31 PID 2524 wrote to memory of 2840 2524 Bank Fund Transfer-589237.scr 31 PID 2524 wrote to memory of 2840 2524 Bank Fund Transfer-589237.scr 31 PID 2524 wrote to memory of 2840 2524 Bank Fund Transfer-589237.scr 31 PID 2524 wrote to memory of 2768 2524 Bank Fund Transfer-589237.scr 33 PID 2524 wrote to memory of 2768 2524 Bank Fund Transfer-589237.scr 33 PID 2524 wrote to memory of 2768 2524 Bank Fund Transfer-589237.scr 33 PID 2524 wrote to memory of 2768 2524 Bank Fund Transfer-589237.scr 33 PID 2524 wrote to memory of 764 2524 Bank Fund Transfer-589237.scr 34 PID 2524 wrote to memory of 764 2524 Bank Fund Transfer-589237.scr 34 PID 2524 wrote to memory of 764 2524 Bank Fund Transfer-589237.scr 34 PID 2524 wrote to memory of 764 2524 Bank Fund Transfer-589237.scr 34 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2524 wrote to memory of 2620 2524 Bank Fund Transfer-589237.scr 37 PID 2620 wrote to memory of 1004 2620 Bank Fund Transfer-589237.scr 38 PID 2620 wrote to memory of 1004 2620 Bank Fund Transfer-589237.scr 38 PID 2620 wrote to memory of 1004 2620 Bank Fund Transfer-589237.scr 38 PID 2620 wrote to memory of 1004 2620 Bank Fund Transfer-589237.scr 38 PID 1004 wrote to memory of 1704 1004 WScript.exe 39 PID 1004 wrote to memory of 1704 1004 WScript.exe 39 PID 1004 wrote to memory of 1704 1004 WScript.exe 39 PID 1004 wrote to memory of 1704 1004 WScript.exe 39 PID 1704 wrote to memory of 2364 1704 cmd.exe 41 PID 1704 wrote to memory of 2364 1704 cmd.exe 41 PID 1704 wrote to memory of 2364 1704 cmd.exe 41 PID 1704 wrote to memory of 2364 1704 cmd.exe 41 PID 2364 wrote to memory of 2220 2364 remcos.exe 42 PID 2364 wrote to memory of 2220 2364 remcos.exe 42 PID 2364 wrote to memory of 2220 2364 remcos.exe 42 PID 2364 wrote to memory of 2220 2364 remcos.exe 42 PID 2364 wrote to memory of 3064 2364 remcos.exe 44 PID 2364 wrote to memory of 3064 2364 remcos.exe 44 PID 2364 wrote to memory of 3064 2364 remcos.exe 44 PID 2364 wrote to memory of 3064 2364 remcos.exe 44 PID 2364 wrote to memory of 2240 2364 remcos.exe 45 PID 2364 wrote to memory of 2240 2364 remcos.exe 45 PID 2364 wrote to memory of 2240 2364 remcos.exe 45 PID 2364 wrote to memory of 2240 2364 remcos.exe 45 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48 PID 2364 wrote to memory of 3024 2364 remcos.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr" /S1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1777.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\AppUpdate\remcos.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\ProgramData\AppUpdate\remcos.exeC:\ProgramData\AppUpdate\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8037.tmp"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2240
-
-
C:\ProgramData\AppUpdate\remcos.exe"C:\ProgramData\AppUpdate\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3024
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5552044ce92b78bf4b68d242c2c380afe
SHA12ef4efa20f4fd0d05d8f49ccb22c9afeada93a62
SHA256cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3
SHA5124dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967
-
Filesize
392B
MD5046708368578d720d91fb9ceecec742e
SHA11dc732f67f48a1d5694f4cf14a8d279dbd1d6ee6
SHA25604f4edc28e97a16f93cf7acac864aba17cc467282550ae61baac719262be6f5e
SHA5129106f645ee74c9e061fcb396a00d706512d41054a356125f26a10d42390d8f0d3ea3dd785393bf5de358b62464ec3c0f7d2e27411e87bb408581f820c427e7f0
-
Filesize
1KB
MD51b7a99f00e695978e48aae7bc86e369f
SHA12c4e0928f09e48ba3e0c5d36a2bb577cf33c5349
SHA256e4d0746d3af5131925e0b200053a210a02ea9c4092fe7c13ea504dc0781f705d
SHA512a41065a9ef5f77b18afbb8cbf17bfab18767230cf1d3c06ef8a35df7877c178390ad332140ecfae9f5753613cb8906e0348820e60bfbf44daca8100de672157c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NWCCFJBYBSMNKKANFF5S.temp
Filesize7KB
MD51b6283bc9e300a796ab5a01e36a9a5d7
SHA1e652f54c92ddd7fb4f467e243c4c92d974818062
SHA256ed18fd308dbe2720a6f041b32d56a521cd2d53f2fc2855699cea015d33900af0
SHA5125f042e5318bc8ff318d6045912ec41d4761cfe673bb6dfd421b24633c5ce9baafe058fc587cc5e3f67bd672ac6fe5ff49e9406d436b36afc43ae2f1c21dee365
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5452db212842c84433e5e2b98dde1a52d
SHA1f9fe0533146cc776ebd81cc22895a2bcfcf615d9
SHA256067e48972f79b727ceb44a2d9bf45541075768e514f0def652c0b0a542d20556
SHA512e1f8523c9186aeb8afcb87eade302db005f6f7696de4a528d8db5838caad9794d323467d3b9f62227eb244df660c7ae546c8f89c09ad48ebe873f79a0647ec2a