Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 02:45
Behavioral task
behavioral1
Sample
7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe
Resource
win10v2004-20241007-en
General
-
Target
7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe
-
Size
469KB
-
MD5
ebf341ab1088ab009a9f9cf06619e616
-
SHA1
a31d5650c010c421fa81733e4841cf1b52d607d9
-
SHA256
7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955
-
SHA512
40c1481642f8ad2fed9514d0968a43151a189c61e53d60990183e81c16891cdd7a0983568b2910dc8a9098a408136468cff5660d0607cf06331275937c1f60e1
-
SSDEEP
12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSin9:uiLJbpI7I2WhQqZ7i9
Malware Config
Extracted
remcos
RemoteHost
else-directors.gl.at.ply.gg:56448
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
$77-Bitdefender.exe
-
copy_folder
Bitdefender
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Z3DS2J
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
VisualStudioServer
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\"" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\"" 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run $77-Bitdefender.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\"" $77-Bitdefender.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run iexplore.exe -
Deletes itself 1 IoCs
pid Process 2776 WScript.exe -
Executes dropped EXE 1 IoCs
pid Process 2620 $77-Bitdefender.exe -
Loads dropped DLL 2 IoCs
pid Process 2468 cmd.exe 2468 cmd.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\"" 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\"" 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\"" $77-Bitdefender.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\"" $77-Bitdefender.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\"" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\"" iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2620 set thread context of 2808 2620 $77-Bitdefender.exe 36 PID 2808 set thread context of 2456 2808 iexplore.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language $77-Bitdefender.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 3 IoCs
pid Process 2088 reg.exe 2476 reg.exe 2536 reg.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2620 $77-Bitdefender.exe 2808 iexplore.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2988 2552 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe 28 PID 2552 wrote to memory of 2988 2552 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe 28 PID 2552 wrote to memory of 2988 2552 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe 28 PID 2552 wrote to memory of 2988 2552 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe 28 PID 2988 wrote to memory of 2088 2988 cmd.exe 30 PID 2988 wrote to memory of 2088 2988 cmd.exe 30 PID 2988 wrote to memory of 2088 2988 cmd.exe 30 PID 2988 wrote to memory of 2088 2988 cmd.exe 30 PID 2552 wrote to memory of 2776 2552 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe 31 PID 2552 wrote to memory of 2776 2552 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe 31 PID 2552 wrote to memory of 2776 2552 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe 31 PID 2552 wrote to memory of 2776 2552 7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe 31 PID 2776 wrote to memory of 2468 2776 WScript.exe 32 PID 2776 wrote to memory of 2468 2776 WScript.exe 32 PID 2776 wrote to memory of 2468 2776 WScript.exe 32 PID 2776 wrote to memory of 2468 2776 WScript.exe 32 PID 2468 wrote to memory of 2620 2468 cmd.exe 34 PID 2468 wrote to memory of 2620 2468 cmd.exe 34 PID 2468 wrote to memory of 2620 2468 cmd.exe 34 PID 2468 wrote to memory of 2620 2468 cmd.exe 34 PID 2620 wrote to memory of 2784 2620 $77-Bitdefender.exe 35 PID 2620 wrote to memory of 2784 2620 $77-Bitdefender.exe 35 PID 2620 wrote to memory of 2784 2620 $77-Bitdefender.exe 35 PID 2620 wrote to memory of 2784 2620 $77-Bitdefender.exe 35 PID 2620 wrote to memory of 2808 2620 $77-Bitdefender.exe 36 PID 2620 wrote to memory of 2808 2620 $77-Bitdefender.exe 36 PID 2620 wrote to memory of 2808 2620 $77-Bitdefender.exe 36 PID 2620 wrote to memory of 2808 2620 $77-Bitdefender.exe 36 PID 2620 wrote to memory of 2808 2620 $77-Bitdefender.exe 36 PID 2808 wrote to memory of 1972 2808 iexplore.exe 38 PID 2808 wrote to memory of 1972 2808 iexplore.exe 38 PID 2808 wrote to memory of 1972 2808 iexplore.exe 38 PID 2808 wrote to memory of 1972 2808 iexplore.exe 38 PID 2784 wrote to memory of 2476 2784 cmd.exe 41 PID 2784 wrote to memory of 2476 2784 cmd.exe 41 PID 2784 wrote to memory of 2476 2784 cmd.exe 41 PID 2784 wrote to memory of 2476 2784 cmd.exe 41 PID 2808 wrote to memory of 2456 2808 iexplore.exe 40 PID 2808 wrote to memory of 2456 2808 iexplore.exe 40 PID 2808 wrote to memory of 2456 2808 iexplore.exe 40 PID 2808 wrote to memory of 2456 2808 iexplore.exe 40 PID 2808 wrote to memory of 2456 2808 iexplore.exe 40 PID 1972 wrote to memory of 2536 1972 cmd.exe 42 PID 1972 wrote to memory of 2536 1972 cmd.exe 42 PID 1972 wrote to memory of 2536 1972 cmd.exe 42 PID 1972 wrote to memory of 2536 1972 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe"C:\Users\Admin\AppData\Local\Temp\7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2088
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Bitdefender\$77-Bitdefender.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\ProgramData\Bitdefender\$77-Bitdefender.exeC:\ProgramData\Bitdefender\$77-Bitdefender.exe4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2476
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"5⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2536
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe6⤵PID:2456
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
469KB
MD5ebf341ab1088ab009a9f9cf06619e616
SHA1a31d5650c010c421fa81733e4841cf1b52d607d9
SHA2567422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955
SHA51240c1481642f8ad2fed9514d0968a43151a189c61e53d60990183e81c16891cdd7a0983568b2910dc8a9098a408136468cff5660d0607cf06331275937c1f60e1
-
Filesize
654B
MD5f7675c9acf9755bfcc451c94484b16d5
SHA13390f03e58304d06005d60a606ef4c4f2d425d17
SHA2563f0af15c7f89de33200c2791f510919000cbfc079c0bb29fd3b1b68fb58f240c
SHA512e98ca573b851194ece4f393998bce577ba94c3dd2563bdbec36429ca0304ea8a7d4ef3a5b47c743374805dcc8bd0cadf1c4a297c1c0c44f33a09f4ac2e64e032