Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
897s -
max time network
894s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2025, 00:33
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe
Resource
win10v2004-20241007-en
General
-
Target
Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe
-
Size
1.2MB
-
MD5
14950122eb9408da25415925f2d640c1
-
SHA1
a0a700a23a76d1a74e4bfeea70285b031e4632a5
-
SHA256
bab2fe1464095154de3715f90f92351a3f462bebac4d6a7dd52bc1411c6964cc
-
SHA512
fe514613a05a531588a186ee2caf4438a263e10689d509cc8bfba8b5aecce72c2f7bc065a2a2599e9612080ad27c6907d24fe263fe105d48f111fb1e3252614c
-
SSDEEP
24576:msyGmpFPxXbdq3hwbS5nrm9utI2SnS4ZxE:msy/pF9AAKq8MZxE
Malware Config
Extracted
remcos
UPDATEIP
suregigg2.redirectme.net:4689
suregigg2.redirectme.net:4688
oaziamaka.duckdns.org:4688
oaziamaka.duckdns.org:4689
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
aleopty.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
deokwensgb-XP0DHK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/1740-90-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/756-89-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4236-91-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4236-91-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/1740-90-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4824 powershell.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts msiexec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Endocytic = "%Nerver% -windowstyle 1 $Farvelaserprintere=(gi 'HKCU:\\Software\\Goons\\').GetValue('Shillingene');%Nerver% ($Farvelaserprintere)" reg.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 24 2384 msiexec.exe 28 2384 msiexec.exe 36 2384 msiexec.exe 38 2384 msiexec.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2384 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4824 powershell.exe 2384 msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2384 set thread context of 1740 2384 msiexec.exe 106 PID 2384 set thread context of 4236 2384 msiexec.exe 108 PID 2384 set thread context of 756 2384 msiexec.exe 109 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4784 reg.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 4824 powershell.exe 4824 powershell.exe 4824 powershell.exe 4824 powershell.exe 4824 powershell.exe 4824 powershell.exe 4824 powershell.exe 4824 powershell.exe 4824 powershell.exe 1740 msiexec.exe 1740 msiexec.exe 756 msiexec.exe 756 msiexec.exe 1740 msiexec.exe 1740 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4824 powershell.exe 2384 msiexec.exe 2384 msiexec.exe 2384 msiexec.exe 2384 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 4824 powershell.exe Token: SeIncreaseQuotaPrivilege 4824 powershell.exe Token: SeSecurityPrivilege 4824 powershell.exe Token: SeTakeOwnershipPrivilege 4824 powershell.exe Token: SeLoadDriverPrivilege 4824 powershell.exe Token: SeSystemProfilePrivilege 4824 powershell.exe Token: SeSystemtimePrivilege 4824 powershell.exe Token: SeProfSingleProcessPrivilege 4824 powershell.exe Token: SeIncBasePriorityPrivilege 4824 powershell.exe Token: SeCreatePagefilePrivilege 4824 powershell.exe Token: SeBackupPrivilege 4824 powershell.exe Token: SeRestorePrivilege 4824 powershell.exe Token: SeShutdownPrivilege 4824 powershell.exe Token: SeDebugPrivilege 4824 powershell.exe Token: SeSystemEnvironmentPrivilege 4824 powershell.exe Token: SeRemoteShutdownPrivilege 4824 powershell.exe Token: SeUndockPrivilege 4824 powershell.exe Token: SeManageVolumePrivilege 4824 powershell.exe Token: 33 4824 powershell.exe Token: 34 4824 powershell.exe Token: 35 4824 powershell.exe Token: 36 4824 powershell.exe Token: SeDebugPrivilege 756 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2384 msiexec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3676 wrote to memory of 4824 3676 Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe 83 PID 3676 wrote to memory of 4824 3676 Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe 83 PID 3676 wrote to memory of 4824 3676 Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe 83 PID 4824 wrote to memory of 2384 4824 powershell.exe 97 PID 4824 wrote to memory of 2384 4824 powershell.exe 97 PID 4824 wrote to memory of 2384 4824 powershell.exe 97 PID 4824 wrote to memory of 2384 4824 powershell.exe 97 PID 2384 wrote to memory of 216 2384 msiexec.exe 98 PID 2384 wrote to memory of 216 2384 msiexec.exe 98 PID 2384 wrote to memory of 216 2384 msiexec.exe 98 PID 216 wrote to memory of 4784 216 cmd.exe 101 PID 216 wrote to memory of 4784 216 cmd.exe 101 PID 216 wrote to memory of 4784 216 cmd.exe 101 PID 2384 wrote to memory of 1740 2384 msiexec.exe 106 PID 2384 wrote to memory of 1740 2384 msiexec.exe 106 PID 2384 wrote to memory of 1740 2384 msiexec.exe 106 PID 2384 wrote to memory of 1740 2384 msiexec.exe 106 PID 2384 wrote to memory of 3412 2384 msiexec.exe 107 PID 2384 wrote to memory of 3412 2384 msiexec.exe 107 PID 2384 wrote to memory of 3412 2384 msiexec.exe 107 PID 2384 wrote to memory of 4236 2384 msiexec.exe 108 PID 2384 wrote to memory of 4236 2384 msiexec.exe 108 PID 2384 wrote to memory of 4236 2384 msiexec.exe 108 PID 2384 wrote to memory of 4236 2384 msiexec.exe 108 PID 2384 wrote to memory of 756 2384 msiexec.exe 109 PID 2384 wrote to memory of 756 2384 msiexec.exe 109 PID 2384 wrote to memory of 756 2384 msiexec.exe 109 PID 2384 wrote to memory of 756 2384 msiexec.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Terriner=gc -Raw 'C:\Users\Admin\AppData\Local\reguladetriens\Frygts\Udflippedes47\Kumisses.Ins';$Phellogenetic=$Terriner.SubString(69463,3);.$Phellogenetic($Terriner)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Endocytic" /t REG_EXPAND_SZ /d "%Nerver% -windowstyle 1 $Farvelaserprintere=(gi 'HKCU:\Software\Goons\').GetValue('Shillingene');%Nerver% ($Farvelaserprintere)"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Endocytic" /t REG_EXPAND_SZ /d "%Nerver% -windowstyle 1 $Farvelaserprintere=(gi 'HKCU:\Software\Goons\').GetValue('Shillingene');%Nerver% ($Farvelaserprintere)"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4784
-
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\gnovtxdzsgspnnodhl"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1740
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\qpugupobgokuptchqvsfgl"4⤵PID:3412
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\qpugupobgokuptchqvsfgl"4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:4236
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\bjhyuhyuuwdzahylhgfzryorc"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5562a58578d6d04c7fb6bda581c57c03c
SHA112ab2b88624d01da0c5f5d1441aa21cbc276c5f5
SHA256ff5c70287ba432a83f9015209d6e933462edca01d68c53c09882e1e4d22241c8
SHA5123f6e19faa0196bd4c085defa587e664abdd63c25ef30df8f4323e60a5a5aca3cd2709466f772e64ab00fe331d4264841422d6057451947f3500e9252a132254e
-
Filesize
335KB
MD5a76b3c738bef91dc0872c4a6e676a263
SHA154e8678dc5eb402dd566eef02d532c5d0825dedf
SHA256eef8c4345d818a1342852abb0d4d6368ba73ebedf356f006fdce15d4aaa4db06
SHA5124d59189a9280e0dc32ba54bd7ce69c6e13ef5409d8144969db1ad878a44f0bd1e1bf8c829570795b127b176341c169bb7ed6b2941c7898702c02a6ba63b33ab2
-
Filesize
67KB
MD569242911187aa790800554e0d94ba83e
SHA18da0aa4b2ab429f6882d2f8a25c33f5f41fa2457
SHA256e52eb097dc1b37cee9dd34c1f15aea34e13855ac37bfc324b24ca91ac2a425ea
SHA512177078b3f88082d16e6d03231db7f002eaf5b16f5384f823f0b914d28a82a2d9bd28ddef63c35d18383a471bbf320e20881a7ba8c68146cc0ffb0f3806ef71a5