Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/11/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
remi.exe
Resource
win7-20240903-en
General
-
Target
remi.exe
-
Size
959KB
-
MD5
b074e2458b987efec69536a58316d5a6
-
SHA1
ffebefa18462d47fc8b82abc9069c9fdd6079da9
-
SHA256
e744e0aa890a2d9b5e6eed8403cb16f6098baee4a0529b1fabc0644ee4ba6b32
-
SHA512
1f76d7ae0558962781b913b765ff6b92b5f03aa511c6be2f206ff17c361052d4b34a37d46e49447a0860586474c3bc656ed34d9d094b605d06a6ebfbcc0a2422
-
SSDEEP
24576:YQm35eXO2xQ7nEP9FsGu0ftQbg665Xp3GuD+XjK:jej2ynElFsGu0fsgD5XpTqXj
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2344 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 348 remi.exe 348 remi.exe 348 remi.exe 348 remi.exe 348 remi.exe 348 remi.exe 348 remi.exe 348 remi.exe 348 remi.exe 348 remi.exe 2344 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 348 remi.exe Token: SeDebugPrivilege 2344 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 348 wrote to memory of 2344 348 remi.exe 31 PID 348 wrote to memory of 2344 348 remi.exe 31 PID 348 wrote to memory of 2344 348 remi.exe 31 PID 348 wrote to memory of 2344 348 remi.exe 31 PID 348 wrote to memory of 2768 348 remi.exe 33 PID 348 wrote to memory of 2768 348 remi.exe 33 PID 348 wrote to memory of 2768 348 remi.exe 33 PID 348 wrote to memory of 2768 348 remi.exe 33 PID 348 wrote to memory of 2676 348 remi.exe 34 PID 348 wrote to memory of 2676 348 remi.exe 34 PID 348 wrote to memory of 2676 348 remi.exe 34 PID 348 wrote to memory of 2676 348 remi.exe 34 PID 348 wrote to memory of 2336 348 remi.exe 35 PID 348 wrote to memory of 2336 348 remi.exe 35 PID 348 wrote to memory of 2336 348 remi.exe 35 PID 348 wrote to memory of 2336 348 remi.exe 35 PID 348 wrote to memory of 2044 348 remi.exe 36 PID 348 wrote to memory of 2044 348 remi.exe 36 PID 348 wrote to memory of 2044 348 remi.exe 36 PID 348 wrote to memory of 2044 348 remi.exe 36 PID 348 wrote to memory of 1368 348 remi.exe 37 PID 348 wrote to memory of 1368 348 remi.exe 37 PID 348 wrote to memory of 1368 348 remi.exe 37 PID 348 wrote to memory of 1368 348 remi.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\remi.exe"C:\Users\Admin\AppData\Local\Temp\remi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\remi.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Users\Admin\AppData\Local\Temp\remi.exe"C:\Users\Admin\AppData\Local\Temp\remi.exe"2⤵PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\remi.exe"C:\Users\Admin\AppData\Local\Temp\remi.exe"2⤵PID:2676
-
-
C:\Users\Admin\AppData\Local\Temp\remi.exe"C:\Users\Admin\AppData\Local\Temp\remi.exe"2⤵PID:2336
-
-
C:\Users\Admin\AppData\Local\Temp\remi.exe"C:\Users\Admin\AppData\Local\Temp\remi.exe"2⤵PID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\remi.exe"C:\Users\Admin\AppData\Local\Temp\remi.exe"2⤵PID:1368
-