Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows10_x64 -
resource
win10 -
submitted
09/07/2020, 18:39
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation_SWIFT.xls
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Confirmation_SWIFT.xls
Resource
win10
0 signatures
0 seconds
General
-
Target
Confirmation_SWIFT.xls
-
Size
75KB
-
MD5
f01671ac94d1f55044d47cae49633150
-
SHA1
216adc71642235afb5d83386e2bdc42c50dda56e
-
SHA256
ec094f2965613b3845bbcd1936cdf27773e89e369052c27f4b5f07dd29b6cc62
-
SHA512
e3887dc534578dbfbadd41e5dcd5bffbbb00ea5d0e00acf79525c4b2ade83d13dc34815a9a7a8471851ff917acca185609d33ef7680be3d1f071dfe34f863e1c
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2608 YPMNM.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1468 2608 WerFault.exe 71 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1536 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1468 WerFault.exe Token: SeBackupPrivilege 1468 WerFault.exe Token: SeDebugPrivilege 1468 WerFault.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1536 EXCEL.EXE 1536 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1536 wrote to memory of 2608 1536 EXCEL.EXE 71 PID 1536 wrote to memory of 2608 1536 EXCEL.EXE 71 PID 1536 wrote to memory of 2608 1536 EXCEL.EXE 71
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Confirmation_SWIFT.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\YPMNM.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\YPMNM.exe"2⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 8683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-