Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/12/2024, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe
Resource
win10v2004-20241007-en
General
-
Target
7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe
-
Size
832KB
-
MD5
f443c222255e35ee6dd0e194360c23ce
-
SHA1
a8c84df31a575ab84e6255b89351ce877c9619c8
-
SHA256
7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b
-
SHA512
ca58f238cf2599fabd5c34faa34630e2f158cc87a612ad1783a5982b7c835bf7941ee68699dc3e9486f01b578caf6ac53a15f22b92398aa32c8d8742d202fe53
-
SSDEEP
12288:OeB1Nd/75yaHV5epXyU8+uggQdbGqDEEiHczNGNB4aEPvl1bDDdOJVe3e+mraL:OW1D5yeV5eNyB7QtHDE3HcE0DA8mraL
Malware Config
Extracted
remcos
RemoteHost
192.210.150.26:3678
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-MKYDDH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2568 powershell.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wmplayer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2216 set thread context of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2504 set thread context of 2520 2504 wmplayer.exe 41 PID 2504 set thread context of 2600 2504 wmplayer.exe 42 PID 2504 set thread context of 1624 2504 wmplayer.exe 43 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2568 powershell.exe 2520 wmplayer.exe 2520 wmplayer.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2504 wmplayer.exe 2504 wmplayer.exe 2504 wmplayer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2568 powershell.exe Token: SeDebugPrivilege 1624 wmplayer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2504 wmplayer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2568 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 32 PID 2216 wrote to memory of 2568 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 32 PID 2216 wrote to memory of 2568 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 32 PID 2216 wrote to memory of 2840 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 34 PID 2216 wrote to memory of 2840 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 34 PID 2216 wrote to memory of 2840 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 34 PID 2216 wrote to memory of 2840 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 34 PID 2216 wrote to memory of 2840 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 34 PID 2216 wrote to memory of 2840 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 34 PID 2216 wrote to memory of 2840 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 34 PID 2216 wrote to memory of 2840 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 34 PID 2216 wrote to memory of 2840 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 34 PID 2216 wrote to memory of 2564 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 35 PID 2216 wrote to memory of 2564 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 35 PID 2216 wrote to memory of 2564 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 35 PID 2216 wrote to memory of 2564 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 35 PID 2216 wrote to memory of 2564 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 35 PID 2216 wrote to memory of 2564 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 35 PID 2216 wrote to memory of 2564 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 35 PID 2216 wrote to memory of 2564 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 35 PID 2216 wrote to memory of 2564 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 35 PID 2216 wrote to memory of 3056 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 36 PID 2216 wrote to memory of 3056 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 36 PID 2216 wrote to memory of 3056 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 36 PID 2216 wrote to memory of 3056 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 36 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 1300 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 37 PID 2216 wrote to memory of 2108 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 38 PID 2216 wrote to memory of 2108 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 38 PID 2216 wrote to memory of 2108 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 38 PID 2216 wrote to memory of 2108 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 38 PID 2216 wrote to memory of 2108 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 38 PID 2216 wrote to memory of 2108 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 38 PID 2216 wrote to memory of 2108 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 38 PID 2216 wrote to memory of 2108 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 38 PID 2216 wrote to memory of 2108 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 38 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 2504 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 39 PID 2216 wrote to memory of 1720 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 40 PID 2216 wrote to memory of 1720 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 40 PID 2216 wrote to memory of 1720 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 40 PID 2216 wrote to memory of 1720 2216 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe 40 PID 2504 wrote to memory of 2520 2504 wmplayer.exe 41 PID 2504 wrote to memory of 2520 2504 wmplayer.exe 41 PID 2504 wrote to memory of 2520 2504 wmplayer.exe 41 PID 2504 wrote to memory of 2520 2504 wmplayer.exe 41 PID 2504 wrote to memory of 2520 2504 wmplayer.exe 41 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe"C:\Users\Admin\AppData\Local\Temp\7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe"1⤵
- UAC bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2216 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7053c8d9983dc949e5d559ba1b006b8ba9c059a23e06cd87c857c3d04201381b.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2840
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:2564
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:3056
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:1300
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2108
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\utpjdppyqvpxd"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2520
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wvucdhasedhkftmzh"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:2600
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hqimealtalzophalqhxl"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5aa9a4b3f392b68f63e9d4682b318417c
SHA1f33810b46263d4f1cf090b8ff79d1e78f19b16d7
SHA256fea1969b5e52311cb485592e3275482aeda145b32a878b6345a3439ddaf93a11
SHA512a5efe216f3ac80ceedbed8266c4da4c7dce2c569ba541bb9c1a1131bcb7fb5af5c9dce96632e6737e19ee3182250db7c39d1303a76c4f7a9b79639a08f9d4e04
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84