Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
246s -
max time network
260s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2022, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
hotManchegoMacro.xlsm
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
hotManchegoMacro.xlsm
Resource
win10v2004-20220812-en
General
-
Target
hotManchegoMacro.xlsm
-
Size
4KB
-
MD5
ce76acb95a001594debe598f2c39b696
-
SHA1
97db0a6d9abb7b85c88000f684d49d2a74278ef5
-
SHA256
f2db88981ba6f6a97a3007ce7b7e78248d8d27b63d398c6e65686c305619c34f
-
SHA512
19de5fe22ff9653f7a1a8c457ba52e45edd81423cfc8f4bdf6ebf845055729b1056f97b918be5dd265f8486f88ff621a0dce519c230f809d2e592b69de671c9e
-
SSDEEP
48:9UKMyfv5OISZqw0wOCmY9OTLHOjaDDS6y61M3t62jjBQohSSDMqst9OP2Ltzz16H:uKjv8r8I0Et62msJE9OeLhz1M6o
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 4068 908 WerFault.exe 97 2140 1788 WerFault.exe 105 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 924 ipconfig.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2732 EXCEL.EXE -
Suspicious behavior: LoadsDriver 10 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found -
Suspicious use of SetWindowsHookEx 27 IoCs
pid Process 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4352 wrote to memory of 924 4352 cmd.exe 115 PID 4352 wrote to memory of 924 4352 cmd.exe 115
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\hotManchegoMacro.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2732
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 460 -p 908 -ip 9081⤵PID:4060
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 908 -s 29041⤵
- Program crash
PID:4068
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 564 -p 1788 -ip 17881⤵PID:2828
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1788 -s 29081⤵
- Program crash
PID:2140
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:924
-