Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 22:38
Static task
static1
Behavioral task
behavioral1
Sample
38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe
Resource
win10v2004-20241007-en
General
-
Target
38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe
-
Size
1.1MB
-
MD5
dd09e8863ee6d30492d5cba898538f85
-
SHA1
700f5ce79c5fd236ecb778ab0e14dbc7df22bc55
-
SHA256
38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53
-
SHA512
beff97a572ee4576d3ae1eda5e7692b42a0d679abf8f375a19d0df356fcb6726ba9cdfdb1359dc9a8b67a39553cea279acb29fece86f49cf5f53a3f074e87b28
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6FakCsU4yYhK3x9uZ3WYX:Xu0c++OCvkGs9Fak4BYX
Malware Config
Extracted
remcos
2.2.0 Pro
RemoteHost
185.217.1.142:3337
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
3
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-VBI2IL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Remcos family
-
Executes dropped EXE 6 IoCs
pid Process 2628 Dxpserver.exe 2736 Dxpserver.exe 908 Dxpserver.exe 2984 Dxpserver.exe 484 Dxpserver.exe 1260 Dxpserver.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Modifies WinLogon 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00060000000191cf-19.dat autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1896 set thread context of 2232 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 30 PID 2628 set thread context of 2736 2628 Dxpserver.exe 37 PID 908 set thread context of 2984 908 Dxpserver.exe 42 PID 484 set thread context of 1260 484 Dxpserver.exe 47 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2732 schtasks.exe 2836 schtasks.exe 1856 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1896 wrote to memory of 2232 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 30 PID 1896 wrote to memory of 2232 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 30 PID 1896 wrote to memory of 2232 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 30 PID 1896 wrote to memory of 2232 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 30 PID 1896 wrote to memory of 2232 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 30 PID 1896 wrote to memory of 2232 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 30 PID 2232 wrote to memory of 3016 2232 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 31 PID 2232 wrote to memory of 3016 2232 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 31 PID 2232 wrote to memory of 3016 2232 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 31 PID 2232 wrote to memory of 3016 2232 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 31 PID 1896 wrote to memory of 2732 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 33 PID 1896 wrote to memory of 2732 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 33 PID 1896 wrote to memory of 2732 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 33 PID 1896 wrote to memory of 2732 1896 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 33 PID 2636 wrote to memory of 2628 2636 taskeng.exe 36 PID 2636 wrote to memory of 2628 2636 taskeng.exe 36 PID 2636 wrote to memory of 2628 2636 taskeng.exe 36 PID 2636 wrote to memory of 2628 2636 taskeng.exe 36 PID 2628 wrote to memory of 2736 2628 Dxpserver.exe 37 PID 2628 wrote to memory of 2736 2628 Dxpserver.exe 37 PID 2628 wrote to memory of 2736 2628 Dxpserver.exe 37 PID 2628 wrote to memory of 2736 2628 Dxpserver.exe 37 PID 2628 wrote to memory of 2736 2628 Dxpserver.exe 37 PID 2628 wrote to memory of 2736 2628 Dxpserver.exe 37 PID 2736 wrote to memory of 2240 2736 Dxpserver.exe 38 PID 2736 wrote to memory of 2240 2736 Dxpserver.exe 38 PID 2736 wrote to memory of 2240 2736 Dxpserver.exe 38 PID 2736 wrote to memory of 2240 2736 Dxpserver.exe 38 PID 2628 wrote to memory of 2836 2628 Dxpserver.exe 39 PID 2628 wrote to memory of 2836 2628 Dxpserver.exe 39 PID 2628 wrote to memory of 2836 2628 Dxpserver.exe 39 PID 2628 wrote to memory of 2836 2628 Dxpserver.exe 39 PID 2636 wrote to memory of 908 2636 taskeng.exe 41 PID 2636 wrote to memory of 908 2636 taskeng.exe 41 PID 2636 wrote to memory of 908 2636 taskeng.exe 41 PID 2636 wrote to memory of 908 2636 taskeng.exe 41 PID 908 wrote to memory of 2984 908 Dxpserver.exe 42 PID 908 wrote to memory of 2984 908 Dxpserver.exe 42 PID 908 wrote to memory of 2984 908 Dxpserver.exe 42 PID 908 wrote to memory of 2984 908 Dxpserver.exe 42 PID 908 wrote to memory of 2984 908 Dxpserver.exe 42 PID 908 wrote to memory of 2984 908 Dxpserver.exe 42 PID 2984 wrote to memory of 2312 2984 Dxpserver.exe 43 PID 2984 wrote to memory of 2312 2984 Dxpserver.exe 43 PID 2984 wrote to memory of 2312 2984 Dxpserver.exe 43 PID 2984 wrote to memory of 2312 2984 Dxpserver.exe 43 PID 908 wrote to memory of 1856 908 Dxpserver.exe 44 PID 908 wrote to memory of 1856 908 Dxpserver.exe 44 PID 908 wrote to memory of 1856 908 Dxpserver.exe 44 PID 908 wrote to memory of 1856 908 Dxpserver.exe 44 PID 2636 wrote to memory of 484 2636 taskeng.exe 46 PID 2636 wrote to memory of 484 2636 taskeng.exe 46 PID 2636 wrote to memory of 484 2636 taskeng.exe 46 PID 2636 wrote to memory of 484 2636 taskeng.exe 46 PID 484 wrote to memory of 1260 484 Dxpserver.exe 47 PID 484 wrote to memory of 1260 484 Dxpserver.exe 47 PID 484 wrote to memory of 1260 484 Dxpserver.exe 47 PID 484 wrote to memory of 1260 484 Dxpserver.exe 47 PID 484 wrote to memory of 1260 484 Dxpserver.exe 47 PID 484 wrote to memory of 1260 484 Dxpserver.exe 47 PID 1260 wrote to memory of 788 1260 Dxpserver.exe 48 PID 1260 wrote to memory of 788 1260 Dxpserver.exe 48 PID 1260 wrote to memory of 788 1260 Dxpserver.exe 48 PID 1260 wrote to memory of 788 1260 Dxpserver.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe"C:\Users\Admin\AppData\Local\Temp\38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe"C:\Users\Admin\AppData\Local\Temp\38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe"2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:3016
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2732
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {8EF065FB-029F-4269-A3CE-AD8D1E3E016E} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:2240
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2836
-
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:2312
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1856
-
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:788
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658B
MD56e5dc5303fa3191374430f5a32236fdb
SHA18fc15d0baf88a969c44543205208a2de14805104
SHA256242e48c1ff0a20dfc8feec5bf685c31d6e6356cb931d9f51b3e8ff685c761998
SHA5126beb5430acc8bacf92a6d6bbed03dc163536c7aea1499d36b2580da683f4353cd4ca34dceff8e870c622c9f49ada1b66eb44a605e40e7949f1ce76cc52dde353
-
Filesize
564B
MD5e221e7bd7e33aef4a5264f798818142e
SHA13545dbcc35de80c8f15da0daceab80acd0f1ae22
SHA256f37e43a3504c163fa4a82bacc92ceb8cccd37d1020fbba95cc954f316ce49516
SHA51204775d0fa21526bbbaa2deea13af1d5fab6183ea3a2809073539293da78e20f1cf4b9a4afdeafb1b4e8ce17a5be40f44364808ab73c174c98bce53ad8a1807d8
-
Filesize
1.1MB
MD51c9f20b6a7865d76806fa46774df672e
SHA1c715b5871584197d8b460b8ac940562f188d71b9
SHA256e9d79115b1c0e17d4712c6927d8a2894105030c350da8ffc07c6d572de840bf7
SHA5121dc166f6ab6937c697cc679c4e0e299e073aa836a54ba7e5ce509b98b3e74fc51fb289ef9d90d0ffe593c3187422b102807fca4f6bd82b90eeb6326de88136b7