Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    166s
  • max time network
    170s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30/01/2022, 15:29

General

  • Target

    386ed7ba502e7bf0e60c546476c1c762cbc951eb2a2ba1f5b505be08d60310ef.xls

  • Size

    401KB

  • MD5

    02ba9703d1f250b411ea4c868d17fd2e

  • SHA1

    27d7eab43b66abd73cdc8da304dbb2daa9842df0

  • SHA256

    386ed7ba502e7bf0e60c546476c1c762cbc951eb2a2ba1f5b505be08d60310ef

  • SHA512

    c2803749c6dd777f02312ee635c12930082343eab4153c3691cf8bcfe8ec0925d134e094bffee2ceb918a58d59176f07b43fb7b0ba8573325a63eefca487f24c

Score
10/10

Malware Config

Signatures

  • CrimsonRAT Main Payload 2 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Executes dropped EXE 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\386ed7ba502e7bf0e60c546476c1c762cbc951eb2a2ba1f5b505be08d60310ef.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\ProgramData\Mldhrab\hargardius.exe
      C:\ProgramData\Mldhrab\hargardius.exe
      2⤵
      • Executes dropped EXE
      PID:580

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/580-312-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

    Filesize

    4KB

  • memory/2636-116-0x00007FF969B20000-0x00007FF969B30000-memory.dmp

    Filesize

    64KB

  • memory/2636-117-0x00007FF969B20000-0x00007FF969B30000-memory.dmp

    Filesize

    64KB

  • memory/2636-118-0x00007FF969B20000-0x00007FF969B30000-memory.dmp

    Filesize

    64KB

  • memory/2636-119-0x00007FF969B20000-0x00007FF969B30000-memory.dmp

    Filesize

    64KB

  • memory/2636-122-0x00007FF969B20000-0x00007FF969B30000-memory.dmp

    Filesize

    64KB

  • memory/2636-129-0x00007FF966FD0000-0x00007FF966FE0000-memory.dmp

    Filesize

    64KB

  • memory/2636-130-0x00007FF966FD0000-0x00007FF966FE0000-memory.dmp

    Filesize

    64KB

  • memory/2636-283-0x000001FE82FF0000-0x000001FE82FF4000-memory.dmp

    Filesize

    16KB