Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25/06/2022, 09:58

General

  • Target

    aae401230eba00929f36e9acf101afee527e8830b05fec0aa13834adbc9ef77e.xls

  • Size

    704KB

  • MD5

    787e54350192a8623a1da604e095bd1b

  • SHA1

    2a79af33c4f00721a63ff3d8a34ddc2d5d17d06d

  • SHA256

    aae401230eba00929f36e9acf101afee527e8830b05fec0aa13834adbc9ef77e

  • SHA512

    8082f42e1c76f91706b5158b435ab35103e562b9b3a9c33df481453510000ddc5737fbdf7102da540f2cb3da3e0adea7c1d5881813edd8589709220f421eac0c

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source

Signatures

  • TA505

    Cybercrime group active since 2015, responsible for families like Dridex and Locky.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\aae401230eba00929f36e9acf101afee527e8830b05fec0aa13834adbc9ef77e.xls"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:724

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\20report_.dll

      Filesize

      298KB

      MD5

      7981bcf1211b696fd0510ee807660772

      SHA1

      a182536ac1476a19b8b2ac3b33ff2d96c887114a

      SHA256

      9dff540081d64c60c0b8299a55aeace8dbe788ac839fa5381960373a0c3e8a95

      SHA512

      19b5b8eace50c76dfd4edc98acb7e39b4aee4e5fe97046150be3ede4f696dc4c40f06a49b100c7c45edf7c1e5b0c3270245b1c0cf2ae63b997794c0d5b88b250

    • memory/1452-135-0x00007FFA871C0000-0x00007FFA871D0000-memory.dmp

      Filesize

      64KB

    • memory/1452-141-0x00000192C9AFC000-0x00000192C9AFE000-memory.dmp

      Filesize

      8KB

    • memory/1452-134-0x00007FFA89350000-0x00007FFA89360000-memory.dmp

      Filesize

      64KB

    • memory/1452-130-0x00007FFA89350000-0x00007FFA89360000-memory.dmp

      Filesize

      64KB

    • memory/1452-136-0x00007FFA871C0000-0x00007FFA871D0000-memory.dmp

      Filesize

      64KB

    • memory/1452-137-0x00000192CC590000-0x00000192CC594000-memory.dmp

      Filesize

      16KB

    • memory/1452-138-0x00000192C9AFC000-0x00000192C9AFE000-memory.dmp

      Filesize

      8KB

    • memory/1452-139-0x00000192C15B2000-0x00000192C15B4000-memory.dmp

      Filesize

      8KB

    • memory/1452-132-0x00007FFA89350000-0x00007FFA89360000-memory.dmp

      Filesize

      64KB

    • memory/1452-133-0x00007FFA89350000-0x00007FFA89360000-memory.dmp

      Filesize

      64KB

    • memory/1452-131-0x00007FFA89350000-0x00007FFA89360000-memory.dmp

      Filesize

      64KB

    • memory/1452-143-0x0000000059220000-0x00000000592B9000-memory.dmp

      Filesize

      612KB

    • memory/1452-144-0x00000192C15B2000-0x00000192C15B4000-memory.dmp

      Filesize

      8KB

    • memory/1452-145-0x0000000059220000-0x00000000592B9000-memory.dmp

      Filesize

      612KB

    • memory/1452-146-0x00000192D2230000-0x00000192D2233000-memory.dmp

      Filesize

      12KB

    • memory/1452-148-0x00007FFA89350000-0x00007FFA89360000-memory.dmp

      Filesize

      64KB

    • memory/1452-149-0x00007FFA89350000-0x00007FFA89360000-memory.dmp

      Filesize

      64KB

    • memory/1452-150-0x00007FFA89350000-0x00007FFA89360000-memory.dmp

      Filesize

      64KB

    • memory/1452-151-0x00007FFA89350000-0x00007FFA89360000-memory.dmp

      Filesize

      64KB