Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2023, 11:15
Behavioral task
behavioral1
Sample
ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe
Resource
win10v2004-20220812-en
General
-
Target
ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe
-
Size
471KB
-
MD5
f4dfa2a79474f83952fb06cbefc3147a
-
SHA1
201d5b03e66a4f43b757bb685ba60665c258b078
-
SHA256
ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9
-
SHA512
211981b2e4840eaa3c1d72ad46e08adbf147ad3700dfdd9fbef1eefbc8249a4a1c36ecdceeace913dd8abf0a27abfed2449f0e11c7df1ad280b2a26f85d6af46
-
SSDEEP
6144:3LKPIsBiPVYkvO5OLRMIOeMqwCObQQkEf90gF8gHsAOZZZ1XzccXCm4:3LKP3QYkvOI9fOeVwCOcQvZsfZZ94
Malware Config
Extracted
remcos
worldclass
91.193.75.188:60005
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
worldclass.exe
-
copy_folder
worldclass
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-UPD1GY
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
worldclass
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2220 worldclass.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\worldclass = "\"C:\\Users\\Admin\\AppData\\Roaming\\worldclass\\worldclass.exe\"" ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\worldclass = "\"C:\\Users\\Admin\\AppData\\Roaming\\worldclass\\worldclass.exe\"" ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ worldclass.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\worldclass = "\"C:\\Users\\Admin\\AppData\\Roaming\\worldclass\\worldclass.exe\"" worldclass.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ worldclass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\worldclass = "\"C:\\Users\\Admin\\AppData\\Roaming\\worldclass\\worldclass.exe\"" worldclass.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2220 worldclass.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4772 wrote to memory of 4988 4772 ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe 81 PID 4772 wrote to memory of 4988 4772 ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe 81 PID 4772 wrote to memory of 4988 4772 ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe 81 PID 4988 wrote to memory of 4636 4988 WScript.exe 82 PID 4988 wrote to memory of 4636 4988 WScript.exe 82 PID 4988 wrote to memory of 4636 4988 WScript.exe 82 PID 4636 wrote to memory of 2220 4636 cmd.exe 84 PID 4636 wrote to memory of 2220 4636 cmd.exe 84 PID 4636 wrote to memory of 2220 4636 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe"C:\Users\Admin\AppData\Local\Temp\ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\clquwqfuuojdouzgxj.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\worldclass\worldclass.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Roaming\worldclass\worldclass.exeC:\Users\Admin\AppData\Roaming\worldclass\worldclass.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2220
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434B
MD5a4a28eb230fc2e09b69530a935514936
SHA1094116e18776a84014e76cfe46e0b21de5245fbe
SHA2560e5fb1081178e158c0eeebc64c04edfd5692ced5fda83b963f7997c33c40e198
SHA512365e872a428c0bd15bece5bd1014beeb4618cce6ea572df1c9100ba8a6048ed5dfc6be5ec7999272082097830bf8703312f267dc2a92bc7e4d8b63a72e27cf5f
-
Filesize
471KB
MD5f4dfa2a79474f83952fb06cbefc3147a
SHA1201d5b03e66a4f43b757bb685ba60665c258b078
SHA256ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9
SHA512211981b2e4840eaa3c1d72ad46e08adbf147ad3700dfdd9fbef1eefbc8249a4a1c36ecdceeace913dd8abf0a27abfed2449f0e11c7df1ad280b2a26f85d6af46
-
Filesize
471KB
MD5f4dfa2a79474f83952fb06cbefc3147a
SHA1201d5b03e66a4f43b757bb685ba60665c258b078
SHA256ce34362e7d74de7ef421e07b354db41c35a11d1c7c5e3372ac03df2283caf9f9
SHA512211981b2e4840eaa3c1d72ad46e08adbf147ad3700dfdd9fbef1eefbc8249a4a1c36ecdceeace913dd8abf0a27abfed2449f0e11c7df1ad280b2a26f85d6af46