Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe
-
Size
801.5MB
-
MD5
2b9277603e1db2622f9e3271d01d0caf
-
SHA1
00106fabb9c8ab767821b32b6346ffffef485aaf
-
SHA256
e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0
-
SHA512
cc4d093538773cffea41cabf85df5a4589331fc2bf478ef96faeb1f74e35db0b95d847ac9413ff19f08e31fcc7d4c81351bd611e52792bb10cfe798c1553bf0f
-
SSDEEP
24576:/pBtKkpXwKPHp0EVWnqMKMklXZ8N7Y5jQoLOnrq/aCVXcA:9TdvMKMklXSN7YDOrqyCVXv
Malware Config
Extracted
remcos
thorami-v5
rlbotz.duckdns.org:2404
80.76.51.46:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
update.exe
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
furog.dat
-
keylog_flag
false
-
mouse_option
false
-
mutex
Rvhugures-AM08A0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
nupdat
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe -
Executes dropped EXE 1 IoCs
pid Process 3540 fon gehewico.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fon gehewico.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3004 cmd.exe 1828 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1828 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3504 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 3540 fon gehewico.exe 3540 fon gehewico.exe 3540 fon gehewico.exe 3540 fon gehewico.exe 3540 fon gehewico.exe 3540 fon gehewico.exe 3540 fon gehewico.exe 3540 fon gehewico.exe 3540 fon gehewico.exe 3540 fon gehewico.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3540 fon gehewico.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1512 wrote to memory of 3504 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 84 PID 1512 wrote to memory of 3504 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 84 PID 1512 wrote to memory of 3504 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 84 PID 1512 wrote to memory of 3540 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 86 PID 1512 wrote to memory of 3540 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 86 PID 1512 wrote to memory of 3540 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 86 PID 1512 wrote to memory of 3004 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 89 PID 1512 wrote to memory of 3004 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 89 PID 1512 wrote to memory of 3004 1512 JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe 89 PID 3004 wrote to memory of 4948 3004 cmd.exe 92 PID 3004 wrote to memory of 4948 3004 cmd.exe 92 PID 3004 wrote to memory of 4948 3004 cmd.exe 92 PID 3004 wrote to memory of 1828 3004 cmd.exe 93 PID 3004 wrote to memory of 1828 3004 cmd.exe 93 PID 3004 wrote to memory of 1828 3004 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Nosix kem pepij\fon gehewico.exe"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3504
-
-
C:\Users\Admin\Nosix kem pepij\fon gehewico.exe"C:\Users\Admin\Nosix kem pepij\fon gehewico.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3540
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e6d5495df143ab691fe58e9e05453c1bf8342ace37e4a7dd1a550d7afe640fd0.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:4948
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1828
-
-