Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/01/2023, 11:15
Behavioral task
behavioral1
Sample
ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe
Resource
win10v2004-20220812-en
General
-
Target
ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe
-
Size
471KB
-
MD5
f4dfa2a79474f83952fb06cbefc3147a
-
SHA1
201d5b03e66a4f43b757bb685ba60665c258b078
-
SHA256
ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9
-
SHA512
211981b2e4840eaa3c1d72ad46e08adbf147ad3700dfdd9fbef1eefbc8249a4a1c36ecdceeace913dd8abf0a27abfed2449f0e11c7df1ad280b2a26f85d6af46
-
SSDEEP
6144:3LKPIsBiPVYkvO5OLRMIOeMqwCObQQkEf90gF8gHsAOZZZ1XzccXCm4:3LKP3QYkvOI9fOeVwCOcQvZsfZZ94
Malware Config
Extracted
remcos
worldclass
91.193.75.188:60005
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
worldclass.exe
-
copy_folder
worldclass
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-UPD1GY
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
worldclass
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 972 worldclass.exe -
Loads dropped DLL 2 IoCs
pid Process 1804 cmd.exe 1804 cmd.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ worldclass.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\worldclass = "\"C:\\Users\\Admin\\AppData\\Roaming\\worldclass\\worldclass.exe\"" worldclass.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ worldclass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\worldclass = "\"C:\\Users\\Admin\\AppData\\Roaming\\worldclass\\worldclass.exe\"" worldclass.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\worldclass = "\"C:\\Users\\Admin\\AppData\\Roaming\\worldclass\\worldclass.exe\"" ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\worldclass = "\"C:\\Users\\Admin\\AppData\\Roaming\\worldclass\\worldclass.exe\"" ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 972 worldclass.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1144 1096 ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe 26 PID 1096 wrote to memory of 1144 1096 ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe 26 PID 1096 wrote to memory of 1144 1096 ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe 26 PID 1096 wrote to memory of 1144 1096 ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe 26 PID 1144 wrote to memory of 1804 1144 WScript.exe 27 PID 1144 wrote to memory of 1804 1144 WScript.exe 27 PID 1144 wrote to memory of 1804 1144 WScript.exe 27 PID 1144 wrote to memory of 1804 1144 WScript.exe 27 PID 1804 wrote to memory of 972 1804 cmd.exe 29 PID 1804 wrote to memory of 972 1804 cmd.exe 29 PID 1804 wrote to memory of 972 1804 cmd.exe 29 PID 1804 wrote to memory of 972 1804 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe"C:\Users\Admin\AppData\Local\Temp\ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wbtqjixvrzja.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\worldclass\worldclass.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Roaming\worldclass\worldclass.exeC:\Users\Admin\AppData\Roaming\worldclass\worldclass.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:972
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434B
MD5a4a28eb230fc2e09b69530a935514936
SHA1094116e18776a84014e76cfe46e0b21de5245fbe
SHA2560e5fb1081178e158c0eeebc64c04edfd5692ced5fda83b963f7997c33c40e198
SHA512365e872a428c0bd15bece5bd1014beeb4618cce6ea572df1c9100ba8a6048ed5dfc6be5ec7999272082097830bf8703312f267dc2a92bc7e4d8b63a72e27cf5f
-
Filesize
471KB
MD5f4dfa2a79474f83952fb06cbefc3147a
SHA1201d5b03e66a4f43b757bb685ba60665c258b078
SHA256ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9
SHA512211981b2e4840eaa3c1d72ad46e08adbf147ad3700dfdd9fbef1eefbc8249a4a1c36ecdceeace913dd8abf0a27abfed2449f0e11c7df1ad280b2a26f85d6af46
-
Filesize
471KB
MD5f4dfa2a79474f83952fb06cbefc3147a
SHA1201d5b03e66a4f43b757bb685ba60665c258b078
SHA256ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9
SHA512211981b2e4840eaa3c1d72ad46e08adbf147ad3700dfdd9fbef1eefbc8249a4a1c36ecdceeace913dd8abf0a27abfed2449f0e11c7df1ad280b2a26f85d6af46
-
Filesize
471KB
MD5f4dfa2a79474f83952fb06cbefc3147a
SHA1201d5b03e66a4f43b757bb685ba60665c258b078
SHA256ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9
SHA512211981b2e4840eaa3c1d72ad46e08adbf147ad3700dfdd9fbef1eefbc8249a4a1c36ecdceeace913dd8abf0a27abfed2449f0e11c7df1ad280b2a26f85d6af46
-
Filesize
471KB
MD5f4dfa2a79474f83952fb06cbefc3147a
SHA1201d5b03e66a4f43b757bb685ba60665c258b078
SHA256ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9
SHA512211981b2e4840eaa3c1d72ad46e08adbf147ad3700dfdd9fbef1eefbc8249a4a1c36ecdceeace913dd8abf0a27abfed2449f0e11c7df1ad280b2a26f85d6af46