Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
Bank Fund Transfer-589237.scr
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bank Fund Transfer-589237.scr
Resource
win10v2004-20241007-en
General
-
Target
Bank Fund Transfer-589237.scr
-
Size
1.2MB
-
MD5
552044ce92b78bf4b68d242c2c380afe
-
SHA1
2ef4efa20f4fd0d05d8f49ccb22c9afeada93a62
-
SHA256
cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3
-
SHA512
4dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967
-
SSDEEP
24576:6YdgfvzmIzxWOwxzCJYC3PPoKb0Eci5ihjJVxw9bYOd+8:qzmmWXRCaePPjb0Eci5ih7xw9bYI
Malware Config
Extracted
remcos
RemoteHost
212.162.149.226:9285
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
AppUpdate
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-VCJ8ZS
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
AppUpdate
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4556 powershell.exe 2400 powershell.exe 5096 powershell.exe 3376 powershell.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Bank Fund Transfer-589237.scr Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Bank Fund Transfer-589237.scr Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation remcos.exe -
Executes dropped EXE 2 IoCs
pid Process 3940 remcos.exe 992 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppUpdate = "\"C:\\ProgramData\\AppUpdate\\remcos.exe\"" Bank Fund Transfer-589237.scr Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AppUpdate = "\"C:\\ProgramData\\AppUpdate\\remcos.exe\"" Bank Fund Transfer-589237.scr Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppUpdate = "\"C:\\ProgramData\\AppUpdate\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AppUpdate = "\"C:\\ProgramData\\AppUpdate\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 436 set thread context of 1824 436 Bank Fund Transfer-589237.scr 95 PID 3940 set thread context of 992 3940 remcos.exe 108 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bank Fund Transfer-589237.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bank Fund Transfer-589237.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Bank Fund Transfer-589237.scr -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4344 schtasks.exe 2960 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 436 Bank Fund Transfer-589237.scr 436 Bank Fund Transfer-589237.scr 436 Bank Fund Transfer-589237.scr 2400 powershell.exe 5096 powershell.exe 436 Bank Fund Transfer-589237.scr 2400 powershell.exe 5096 powershell.exe 3940 remcos.exe 3940 remcos.exe 3940 remcos.exe 3376 powershell.exe 3940 remcos.exe 4556 powershell.exe 3376 powershell.exe 4556 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 436 Bank Fund Transfer-589237.scr Token: SeDebugPrivilege 2400 powershell.exe Token: SeDebugPrivilege 5096 powershell.exe Token: SeDebugPrivilege 3940 remcos.exe Token: SeDebugPrivilege 3376 powershell.exe Token: SeDebugPrivilege 4556 powershell.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 436 wrote to memory of 2400 436 Bank Fund Transfer-589237.scr 89 PID 436 wrote to memory of 2400 436 Bank Fund Transfer-589237.scr 89 PID 436 wrote to memory of 2400 436 Bank Fund Transfer-589237.scr 89 PID 436 wrote to memory of 5096 436 Bank Fund Transfer-589237.scr 91 PID 436 wrote to memory of 5096 436 Bank Fund Transfer-589237.scr 91 PID 436 wrote to memory of 5096 436 Bank Fund Transfer-589237.scr 91 PID 436 wrote to memory of 4344 436 Bank Fund Transfer-589237.scr 93 PID 436 wrote to memory of 4344 436 Bank Fund Transfer-589237.scr 93 PID 436 wrote to memory of 4344 436 Bank Fund Transfer-589237.scr 93 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 436 wrote to memory of 1824 436 Bank Fund Transfer-589237.scr 95 PID 1824 wrote to memory of 1980 1824 Bank Fund Transfer-589237.scr 96 PID 1824 wrote to memory of 1980 1824 Bank Fund Transfer-589237.scr 96 PID 1824 wrote to memory of 1980 1824 Bank Fund Transfer-589237.scr 96 PID 1980 wrote to memory of 4040 1980 WScript.exe 97 PID 1980 wrote to memory of 4040 1980 WScript.exe 97 PID 1980 wrote to memory of 4040 1980 WScript.exe 97 PID 4040 wrote to memory of 3940 4040 cmd.exe 99 PID 4040 wrote to memory of 3940 4040 cmd.exe 99 PID 4040 wrote to memory of 3940 4040 cmd.exe 99 PID 3940 wrote to memory of 3376 3940 remcos.exe 102 PID 3940 wrote to memory of 3376 3940 remcos.exe 102 PID 3940 wrote to memory of 3376 3940 remcos.exe 102 PID 3940 wrote to memory of 4556 3940 remcos.exe 104 PID 3940 wrote to memory of 4556 3940 remcos.exe 104 PID 3940 wrote to memory of 4556 3940 remcos.exe 104 PID 3940 wrote to memory of 2960 3940 remcos.exe 105 PID 3940 wrote to memory of 2960 3940 remcos.exe 105 PID 3940 wrote to memory of 2960 3940 remcos.exe 105 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108 PID 3940 wrote to memory of 992 3940 remcos.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr" /S1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC515.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4344
-
-
C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\AppUpdate\remcos.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\ProgramData\AppUpdate\remcos.exeC:\ProgramData\AppUpdate\remcos.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33AD.tmp"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2960
-
-
C:\ProgramData\AppUpdate\remcos.exe"C:\ProgramData\AppUpdate\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:992
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5552044ce92b78bf4b68d242c2c380afe
SHA12ef4efa20f4fd0d05d8f49ccb22c9afeada93a62
SHA256cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3
SHA5124dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD5f921955320fea8dbd8bcd2012a8f3722
SHA176e5dd6c0c97dadd09d306ad015de99f6515ca31
SHA25693511ac822917e92f0b1bd8eee5698306e99318af437271b45b035dbf468e931
SHA512b55bfa52377cd61ce970d4dfa46e5f854df7d19a8cd413c6ae8fa3f83e389c96ffd3e7bd731047b9a0f811097b573f236703cbeb136a4801f9f47a8f8519b4bc
-
Filesize
18KB
MD5d658928900af3b47b57d64bd3b71bef4
SHA1cf7ab674cbbf872f76bad17a291785d483ec84ae
SHA256c08af78c58cd9138bee650358192f7b5668c07a131ca416b9e15965794a8ffac
SHA512411efe34eb32be83191ed90700a6c77cb0c7997831e0df9fed0dcdcea530d1df514191693394a80e843829bdc60b289809ab9525d100271d8520c50709d09ed4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
392B
MD5046708368578d720d91fb9ceecec742e
SHA11dc732f67f48a1d5694f4cf14a8d279dbd1d6ee6
SHA25604f4edc28e97a16f93cf7acac864aba17cc467282550ae61baac719262be6f5e
SHA5129106f645ee74c9e061fcb396a00d706512d41054a356125f26a10d42390d8f0d3ea3dd785393bf5de358b62464ec3c0f7d2e27411e87bb408581f820c427e7f0
-
Filesize
1KB
MD5ce975596e0d2ad3e251ef6627f3339cc
SHA16d00ae25f67e46a7a45c218807f1046c1c6a5621
SHA2566ee200af49713a05e56cc4e71e75a230da819d322a5d25a754343e96a66ca105
SHA512ff92a3f1844210d3b855a4485c06edcf70b387d98ca9b9bc508418875d973140c9ac27dcb728e2f82561e31a8dc83ad8cfa4f7ccd764eff09859782289768431