Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/12/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe
-
Size
868KB
-
MD5
d4fa2d3197da723c8030147297b9e904
-
SHA1
1623b9fac1f027f328a4a567fec7f9517e8a9b5b
-
SHA256
943df694d18c31eba3477271af8be3ba54e003afd623d162705bf203ef0ab6ee
-
SHA512
24649db62837626affd681f7b20fce823dacd45d6207ffb7e100d61c65385bc69eb0fd412715129e1237160a849fb8ec566ce7b760174334e85715fa10ea0911
-
SSDEEP
12288:d5aTUxjQBT/48bXaGJdB38Krf7zpurlZFcHTn3mOJurGrel9VroDij:d53x0BTZbBVfXpQHETn3mO4ueJHj
Malware Config
Extracted
remcos
3.2.0 Pro
Reed
ezfax2021.home-webserver.de:24133
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
iuis.exe
-
copy_folder
oiujhy
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
uhyg.dat
-
keylog_flag
false
-
keylog_folder
juhg
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
iuyhg-XOY14N
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
oiu
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Remcos family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4724 set thread context of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4792 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4536 vbc.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4724 wrote to memory of 4792 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 98 PID 4724 wrote to memory of 4792 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 98 PID 4724 wrote to memory of 4792 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 98 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100 PID 4724 wrote to memory of 4536 4724 d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4fa2d3197da723c8030147297b9e904_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\smmtJKPRG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE63.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4792
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5a1a68b502cbf314e65767c609ee5d92a
SHA16c55348e9db5c2bafb76b2ec1d65862e24cbc875
SHA2565b3b2ce8f48768f88a37b5617601fb1258b13a8a8f83041e651fab1990ee571c
SHA512881a406f8c25ae4e12b0bc82b19483c975f90aaa74a56c8d805e4230bcbda6272d1464db36b70d2a067a603fcc1ce39a368d2907de48fdf061dc54b40abb2332