Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
Santander.UK.Payment.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Santander.UK.Payment.exe
Resource
win10v2004-20241007-en
General
-
Target
Santander.UK.Payment.exe
-
Size
1.2MB
-
MD5
7af4a0f6896485fdc27f4790b6d3ec84
-
SHA1
a720679224ac7c6c6a194dd8f4a52cdc41386fe3
-
SHA256
1149a510d17d6978374310d23ebc0ec88d415c38a64ef8063af41cb0d882d56c
-
SHA512
7626c9fd3047e8579187056ccd4cb6394e4c399bd830eaa0ed8504ee95366931d15148dbb6a92a482a51df5e1c0aa25ade58cca9b1f3052ce534de6b79c13b2b
-
SSDEEP
24576:grOrP0zHczxWOPV4vu/kXtjpjWZ7R6Yy+Z7uMyeB:kzHqWm4vbXlMN0iZJyk
Malware Config
Extracted
remcos
RemoteHost
162.251.122.76:7119
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-P2SX34
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2448 powershell.exe 2420 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2796 set thread context of 2464 2796 Santander.UK.Payment.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Santander.UK.Payment.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Santander.UK.Payment.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2452 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2796 Santander.UK.Payment.exe 2796 Santander.UK.Payment.exe 2796 Santander.UK.Payment.exe 2796 Santander.UK.Payment.exe 2420 powershell.exe 2448 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2796 Santander.UK.Payment.exe Token: SeDebugPrivilege 2448 powershell.exe Token: SeDebugPrivilege 2420 powershell.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2420 2796 Santander.UK.Payment.exe 29 PID 2796 wrote to memory of 2420 2796 Santander.UK.Payment.exe 29 PID 2796 wrote to memory of 2420 2796 Santander.UK.Payment.exe 29 PID 2796 wrote to memory of 2420 2796 Santander.UK.Payment.exe 29 PID 2796 wrote to memory of 2448 2796 Santander.UK.Payment.exe 31 PID 2796 wrote to memory of 2448 2796 Santander.UK.Payment.exe 31 PID 2796 wrote to memory of 2448 2796 Santander.UK.Payment.exe 31 PID 2796 wrote to memory of 2448 2796 Santander.UK.Payment.exe 31 PID 2796 wrote to memory of 2452 2796 Santander.UK.Payment.exe 33 PID 2796 wrote to memory of 2452 2796 Santander.UK.Payment.exe 33 PID 2796 wrote to memory of 2452 2796 Santander.UK.Payment.exe 33 PID 2796 wrote to memory of 2452 2796 Santander.UK.Payment.exe 33 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35 PID 2796 wrote to memory of 2464 2796 Santander.UK.Payment.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\Santander.UK.Payment.exe"C:\Users\Admin\AppData\Local\Temp\Santander.UK.Payment.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Santander.UK.Payment.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AKkvgTPhySV.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AKkvgTPhySV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64FA.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2452
-
-
C:\Users\Admin\AppData\Local\Temp\Santander.UK.Payment.exe"C:\Users\Admin\AppData\Local\Temp\Santander.UK.Payment.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55fdf692c98e190c02e470ef6c300da6b
SHA1797374da84144a7ff675ef64b3f1b7b26cbfc676
SHA256f7f54488953b3d29aa4d78206057eb7338f619f05766399e91e7a682e452a096
SHA5123b42a1bbe88d4167c0c0d55e062e93e2fdd592fff8abe24cacf65a4369c41e3136bb30e6500064ef91320abe98f65d406ccf8edcff483998a2d2dba9d5fe9bbc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UTZF16XRV8ROCPKGW7FU.temp
Filesize7KB
MD55a63689db6c16b17bdaace6724abe166
SHA11e7c343437039a6b2b1779746723b5eafc39636c
SHA256037c7b6b135edf4c19fa57650d37c99c991a4581efc0d75955f6d62742d5e527
SHA512e504db994ca8c1ae7c7322097a7784f4e2552f3a0cd56d8d245da6b53e605d94954708ccda07c6e7a1e717129a534bc955d29f4d0e8f6d7f8f81cb6d6313978a