Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 01:30
Static task
static1
Behavioral task
behavioral1
Sample
cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe
Resource
win10v2004-20241007-en
General
-
Target
cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe
-
Size
1.1MB
-
MD5
e1d77466b9d956f98108b8d54b01d4c8
-
SHA1
a27b1977e39e05e762918db8065ce14473831ed0
-
SHA256
cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d
-
SHA512
25cf3201450fc3a567267fe48d2b0cdc43682b18f977d9c1bf2bd4ccfab5ad481224f91d72d764824b27117f8ec2231580dfbf305e0009856c49b23e9008192a
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6FakCsU4yYhK3x9uZ3WYr:Xu0c++OCvkGs9Fak4BYr
Malware Config
Extracted
remcos
2.2.0 Pro
RemoteHost
185.217.1.142:3337
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
3
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-VBI2IL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Remcos family
-
Executes dropped EXE 4 IoCs
pid Process 2828 Dxpserver.exe 2096 Dxpserver.exe 2180 Dxpserver.exe 3024 Dxpserver.exe -
Loads dropped DLL 1 IoCs
pid Process 2828 Dxpserver.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Modifies WinLogon 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0006000000019401-20.dat autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2132 set thread context of 2740 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 30 PID 2828 set thread context of 2096 2828 Dxpserver.exe 36 PID 2180 set thread context of 3024 2180 Dxpserver.exe 42 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2536 schtasks.exe 1640 schtasks.exe 2288 schtasks.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2740 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 30 PID 2132 wrote to memory of 2740 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 30 PID 2132 wrote to memory of 2740 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 30 PID 2132 wrote to memory of 2740 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 30 PID 2132 wrote to memory of 2740 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 30 PID 2132 wrote to memory of 2740 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 30 PID 2740 wrote to memory of 2696 2740 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 31 PID 2740 wrote to memory of 2696 2740 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 31 PID 2740 wrote to memory of 2696 2740 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 31 PID 2740 wrote to memory of 2696 2740 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 31 PID 2132 wrote to memory of 2536 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 32 PID 2132 wrote to memory of 2536 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 32 PID 2132 wrote to memory of 2536 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 32 PID 2132 wrote to memory of 2536 2132 cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe 32 PID 1688 wrote to memory of 2828 1688 taskeng.exe 35 PID 1688 wrote to memory of 2828 1688 taskeng.exe 35 PID 1688 wrote to memory of 2828 1688 taskeng.exe 35 PID 1688 wrote to memory of 2828 1688 taskeng.exe 35 PID 2828 wrote to memory of 2096 2828 Dxpserver.exe 36 PID 2828 wrote to memory of 2096 2828 Dxpserver.exe 36 PID 2828 wrote to memory of 2096 2828 Dxpserver.exe 36 PID 2828 wrote to memory of 2096 2828 Dxpserver.exe 36 PID 2828 wrote to memory of 2096 2828 Dxpserver.exe 36 PID 2828 wrote to memory of 2096 2828 Dxpserver.exe 36 PID 2096 wrote to memory of 800 2096 Dxpserver.exe 37 PID 2096 wrote to memory of 800 2096 Dxpserver.exe 37 PID 2096 wrote to memory of 800 2096 Dxpserver.exe 37 PID 2096 wrote to memory of 800 2096 Dxpserver.exe 37 PID 2828 wrote to memory of 1640 2828 Dxpserver.exe 38 PID 2828 wrote to memory of 1640 2828 Dxpserver.exe 38 PID 2828 wrote to memory of 1640 2828 Dxpserver.exe 38 PID 2828 wrote to memory of 1640 2828 Dxpserver.exe 38 PID 1688 wrote to memory of 2180 1688 taskeng.exe 41 PID 1688 wrote to memory of 2180 1688 taskeng.exe 41 PID 1688 wrote to memory of 2180 1688 taskeng.exe 41 PID 1688 wrote to memory of 2180 1688 taskeng.exe 41 PID 2180 wrote to memory of 3024 2180 Dxpserver.exe 42 PID 2180 wrote to memory of 3024 2180 Dxpserver.exe 42 PID 2180 wrote to memory of 3024 2180 Dxpserver.exe 42 PID 2180 wrote to memory of 3024 2180 Dxpserver.exe 42 PID 2180 wrote to memory of 3024 2180 Dxpserver.exe 42 PID 2180 wrote to memory of 3024 2180 Dxpserver.exe 42 PID 3024 wrote to memory of 1788 3024 Dxpserver.exe 43 PID 3024 wrote to memory of 1788 3024 Dxpserver.exe 43 PID 3024 wrote to memory of 1788 3024 Dxpserver.exe 43 PID 3024 wrote to memory of 1788 3024 Dxpserver.exe 43 PID 2180 wrote to memory of 2288 2180 Dxpserver.exe 44 PID 2180 wrote to memory of 2288 2180 Dxpserver.exe 44 PID 2180 wrote to memory of 2288 2180 Dxpserver.exe 44 PID 2180 wrote to memory of 2288 2180 Dxpserver.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe"C:\Users\Admin\AppData\Local\Temp\cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe"C:\Users\Admin\AppData\Local\Temp\cfad180a76b4acfb7d6a3ee4173d3345a263941d214505e4ae71adcd9b99732d.exe"2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:2696
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2536
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {EA8729FF-7092-4AF8-8190-159E9C418522} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:800
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1640
-
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:1788
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2288
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658B
MD547484d86434e4e80803e351b8bf9589e
SHA1ba1b827b23a92f73a20a6cb83de13bfc1c962c45
SHA256c3166eec72116fb3648cf231e994507766694cc8baa688a31191330f53863a02
SHA5124c113f8bc6ccf11feee4d7fd2a9fab359db89417f4768ea7e34166910ff6a5df1874749ffac033a62995776cfed3da9b82d9347a2ea25568ab9b245a9e5e880b
-
Filesize
564B
MD5e221e7bd7e33aef4a5264f798818142e
SHA13545dbcc35de80c8f15da0daceab80acd0f1ae22
SHA256f37e43a3504c163fa4a82bacc92ceb8cccd37d1020fbba95cc954f316ce49516
SHA51204775d0fa21526bbbaa2deea13af1d5fab6183ea3a2809073539293da78e20f1cf4b9a4afdeafb1b4e8ce17a5be40f44364808ab73c174c98bce53ad8a1807d8
-
Filesize
1.1MB
MD55cdfdc23acd8d81876da2e96db92de55
SHA17fa80c5a231f50ce72f6e08586b4dc421bc126a2
SHA256bb8c0447ab6d4bcb6ca1c0ab048cec12973cc221ba622f5e42a94ee8ead172bb
SHA5126b578093c51680c5ab1e7065d2b91a59e050b5fb32f6b7a8da738c8bd6ce0959ca97862b289ed91c6895c14da80be212e446090482e1ae9d7268775d671e314f