Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06/12/2024, 07:05
Static task
static1
Behavioral task
behavioral1
Sample
0021635Purchase.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
0021635Purchase.exe
Resource
win10v2004-20241007-en
General
-
Target
0021635Purchase.exe
-
Size
1.3MB
-
MD5
131a67c95691f8fc41713102f3528846
-
SHA1
dd8d92f7ecbf0cf280038fb94d00bcc43d17cf0a
-
SHA256
caca9062bbedb4519f51493d026a344f885ac593b7224d40458ff07f8ecee4ba
-
SHA512
1a685b5666e4d2e4d7fdae7b6230b32ed51f15e4d6a7da54f88c2962aba4d93cc93f1343058a07aaef5756356ca6b37f172a32d716e4862ad77b6a2ad80007f4
-
SSDEEP
24576:Mu6J33O0c+JY5UZ+XC0kGso6Faq+T+qyO49vQAlBH51ZfCiRWY:Wu0c++OCvkGs9FaqkyOuvxH5gY
Malware Config
Extracted
remcos
RemoteHost
192.3.64.152:2559
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ZFXG9Y
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jailkeeper.vbs jailkeeper.exe -
Executes dropped EXE 1 IoCs
pid Process 2756 jailkeeper.exe -
Loads dropped DLL 1 IoCs
pid Process 2708 0021635Purchase.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0036000000016ca5-8.dat autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2756 set thread context of 2720 2756 jailkeeper.exe 32 PID 2720 set thread context of 2804 2720 svchost.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0021635Purchase.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jailkeeper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2720 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2756 jailkeeper.exe 2720 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2708 0021635Purchase.exe 2708 0021635Purchase.exe 2756 jailkeeper.exe 2756 jailkeeper.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2708 0021635Purchase.exe 2708 0021635Purchase.exe 2756 jailkeeper.exe 2756 jailkeeper.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2756 2708 0021635Purchase.exe 31 PID 2708 wrote to memory of 2756 2708 0021635Purchase.exe 31 PID 2708 wrote to memory of 2756 2708 0021635Purchase.exe 31 PID 2708 wrote to memory of 2756 2708 0021635Purchase.exe 31 PID 2756 wrote to memory of 2720 2756 jailkeeper.exe 32 PID 2756 wrote to memory of 2720 2756 jailkeeper.exe 32 PID 2756 wrote to memory of 2720 2756 jailkeeper.exe 32 PID 2756 wrote to memory of 2720 2756 jailkeeper.exe 32 PID 2756 wrote to memory of 2720 2756 jailkeeper.exe 32 PID 2720 wrote to memory of 2804 2720 svchost.exe 33 PID 2720 wrote to memory of 2804 2720 svchost.exe 33 PID 2720 wrote to memory of 2804 2720 svchost.exe 33 PID 2720 wrote to memory of 2804 2720 svchost.exe 33 PID 2720 wrote to memory of 2804 2720 svchost.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0021635Purchase.exe"C:\Users\Admin\AppData\Local\Temp\0021635Purchase.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\extrorsal\jailkeeper.exe"C:\Users\Admin\AppData\Local\Temp\0021635Purchase.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\0021635Purchase.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵PID:2804
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5131a67c95691f8fc41713102f3528846
SHA1dd8d92f7ecbf0cf280038fb94d00bcc43d17cf0a
SHA256caca9062bbedb4519f51493d026a344f885ac593b7224d40458ff07f8ecee4ba
SHA5121a685b5666e4d2e4d7fdae7b6230b32ed51f15e4d6a7da54f88c2962aba4d93cc93f1343058a07aaef5756356ca6b37f172a32d716e4862ad77b6a2ad80007f4