Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Kami Export - Marcus Plummer - AWT Syllabus.pdf
-
Size
435KB
-
Sample
250317-yqm33sxvfv
-
MD5
c376379bcf9f35bb154307200f251fbd
-
SHA1
f219958a10e2c0c70f00e79256454337153fd170
-
SHA256
7a1e837726b6dd6d567e3f9ce15154bf2b7784f718ca8c2e979af6ed5a2d2c5d
-
SHA512
38a7025b9433349c01c738573c5ceacc706a5cac43ab93ddfd0450064441773548cb77a58a222186da4a401378646fabafcf8b49339c13fd344ac882cd6da0bc
-
SSDEEP
6144:emneU2Kt2F/AmEmRPGS12EbftIoPFEh2YS1FoTpZAF107ieQg3:feU2Kt2FomrPGuXPFEEb1uT3AoQg3
Static task
static1
Behavioral task
behavioral1
Sample
Kami Export - Marcus Plummer - AWT Syllabus.pdf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Kami Export - Marcus Plummer - AWT Syllabus.pdf
Resource
win10v2004-20250313-en
Malware Config
Extracted
remcos
1.7 Pro
Host
nickman12-46565.portmap.io:46565
nickman12-46565.portmap.io:1735
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
Userdata.exe
-
copy_folder
Userdata
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%\System32
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%WinDir%\System32
-
mouse_option
false
-
mutex
remcos_vcexssuhap
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
revengerat
Guest
0.tcp.ngrok.io:19521
RV_MUTEX
Extracted
warzonerat
168.61.222.215:5400
Extracted
crimsonrat
185.136.161.124
Targets
-
-
Target
Kami Export - Marcus Plummer - AWT Syllabus.pdf
-
Size
435KB
-
MD5
c376379bcf9f35bb154307200f251fbd
-
SHA1
f219958a10e2c0c70f00e79256454337153fd170
-
SHA256
7a1e837726b6dd6d567e3f9ce15154bf2b7784f718ca8c2e979af6ed5a2d2c5d
-
SHA512
38a7025b9433349c01c738573c5ceacc706a5cac43ab93ddfd0450064441773548cb77a58a222186da4a401378646fabafcf8b49339c13fd344ac882cd6da0bc
-
SSDEEP
6144:emneU2Kt2F/AmEmRPGS12EbftIoPFEh2YS1FoTpZAF107ieQg3:feU2Kt2FomrPGuXPFEEb1uT3AoQg3
-
CrimsonRAT main payload
-
Crimsonrat family
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Remcos family
-
Revengerat family
-
UAC bypass
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
RevengeRat Executable
-
Warzone RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1