Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
19/05/2021, 18:26
Behavioral task
behavioral1
Sample
cancel_sub_JPL12345678901234.xlsb
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cancel_sub_JPL12345678901234.xlsb
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
cancel_sub_JPL12345678901234.xlsb
-
Size
260KB
-
MD5
80fdec003c86c583473a9fbbabf40d2f
-
SHA1
991940040a50a0be56572e4a9ab73d6d4dbab050
-
SHA256
49e315aa89bf10972518c3069a767c869bbf7027c298afd11ab21040285b3f9e
-
SHA512
022475db6593d15bdcc1411f7c3b88a8822311f621506401ad3ba33ddc2a52ae6e97e4357e3742bf59ef287c033f5363cb5d2021be793d5552a3a8b73b85cfa5
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3056 740 cmd.exe 67 -
Loads dropped DLL 1 IoCs
pid Process 508 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2024 508 WerFault.exe 82 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 740 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2024 WerFault.exe Token: SeBackupPrivilege 2024 WerFault.exe Token: SeDebugPrivilege 2024 WerFault.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
pid Process 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE 740 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 740 wrote to memory of 3056 740 EXCEL.EXE 78 PID 740 wrote to memory of 3056 740 EXCEL.EXE 78 PID 3056 wrote to memory of 4048 3056 cmd.exe 80 PID 3056 wrote to memory of 4048 3056 cmd.exe 80 PID 3056 wrote to memory of 2300 3056 cmd.exe 81 PID 3056 wrote to memory of 2300 3056 cmd.exe 81 PID 2300 wrote to memory of 508 2300 rundll32.exe 82 PID 2300 wrote to memory of 508 2300 rundll32.exe 82 PID 2300 wrote to memory of 508 2300 rundll32.exe 82
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\cancel_sub_JPL12345678901234.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SYSTEM32\cmd.execmd /c certutil -decode C:\Users\Public\5015.x1 C:\Users\Public\5015.x2 && rundll32 C:\Users\Public\5015.x2,DF12⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\certutil.execertutil -decode C:\Users\Public\5015.x1 C:\Users\Public\5015.x23⤵PID:4048
-
-
C:\Windows\system32\rundll32.exerundll32 C:\Users\Public\5015.x2,DF13⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\rundll32.exerundll32 C:\Users\Public\5015.x2,DF14⤵
- Loads dropped DLL
PID:508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 8205⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
-
-