Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
04/11/2022, 08:24
Behavioral task
behavioral1
Sample
033289fc9c493780387a378e49df474c5e1057310fd521fe04a946997a85fa1c.xls
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
033289fc9c493780387a378e49df474c5e1057310fd521fe04a946997a85fa1c.xls
Resource
win10-20220812-en
General
-
Target
033289fc9c493780387a378e49df474c5e1057310fd521fe04a946997a85fa1c.xls
-
Size
217KB
-
MD5
8442e5bdd2df12d6ca090d5b8272a2a0
-
SHA1
fe42e18f69f97aae9e7471c9c9a5699b63ea031c
-
SHA256
033289fc9c493780387a378e49df474c5e1057310fd521fe04a946997a85fa1c
-
SHA512
86cb6048fe0e41c2df29c5c95ace3aad8170813b36b9ec23e60ebf956bb434cc80cceedadd9c401c642126d948d0aee3c5ae49bb644ce3cc83117eee66fe7814
-
SSDEEP
6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg3yY+TAQXTHGUMEyP5p6f5jQmQ:TbGUMVWlbQ
Malware Config
Extracted
https://wijsneusmedia.nl/cgi-bin/DvxmZndf0/
http://brittknight.com/PHP/Aqxf09OugZ/
http://nlasandbox.com/facebookpage/JFqg2Aqkl3UPZi6xGz/
http://www.campusconindigital.org/moodle/LumMe/
Extracted
emotet
Epoch4
45.235.8.30:8080
94.23.45.86:4143
119.59.103.152:8080
169.60.181.70:8080
164.68.99.3:8080
172.105.226.75:8080
107.170.39.149:8080
206.189.28.199:8080
1.234.2.232:8080
188.44.20.25:443
186.194.240.217:443
103.43.75.120:443
149.28.143.92:443
159.89.202.34:443
209.97.163.214:443
183.111.227.137:8080
129.232.188.93:443
139.59.126.41:443
110.232.117.186:8080
139.59.56.73:8080
103.75.201.2:443
91.207.28.33:8080
164.90.222.65:443
197.242.150.244:8080
212.24.98.99:8080
51.161.73.194:443
115.68.227.76:8080
159.65.88.10:8080
201.94.166.162:443
95.217.221.146:8080
173.212.193.249:8080
82.223.21.224:8080
103.132.242.26:8080
213.239.212.5:443
153.126.146.25:7080
45.176.232.124:443
182.162.143.56:443
169.57.156.166:8080
159.65.140.115:443
163.44.196.120:8080
172.104.251.154:8080
167.172.253.162:8080
91.187.140.35:8080
45.118.115.99:8080
147.139.166.154:8080
72.15.201.15:8080
149.56.131.28:8080
167.172.199.165:8080
101.50.0.91:8080
160.16.142.56:8080
185.4.135.165:8080
104.168.155.143:8080
79.137.35.198:8080
5.135.159.50:443
187.63.160.88:80
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 5024 2692 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4492 2692 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4528 2692 regsvr32.exe 65 -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 5024 regsvr32.exe 4528 regsvr32.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rvpBnLDXurqykd.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\SKIECbvwYdR\\rvpBnLDXurqykd.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tZqzTgAifLsSy.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\CgrfaFhJsS\\tZqzTgAifLsSy.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2692 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5024 regsvr32.exe 5024 regsvr32.exe 4536 regsvr32.exe 4536 regsvr32.exe 4536 regsvr32.exe 4536 regsvr32.exe 4528 regsvr32.exe 4528 regsvr32.exe 1596 regsvr32.exe 1596 regsvr32.exe 1596 regsvr32.exe 1596 regsvr32.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2692 wrote to memory of 5024 2692 EXCEL.EXE 70 PID 2692 wrote to memory of 5024 2692 EXCEL.EXE 70 PID 5024 wrote to memory of 4536 5024 regsvr32.exe 73 PID 5024 wrote to memory of 4536 5024 regsvr32.exe 73 PID 2692 wrote to memory of 4492 2692 EXCEL.EXE 74 PID 2692 wrote to memory of 4492 2692 EXCEL.EXE 74 PID 2692 wrote to memory of 4528 2692 EXCEL.EXE 75 PID 2692 wrote to memory of 4528 2692 EXCEL.EXE 75 PID 4528 wrote to memory of 1596 4528 regsvr32.exe 77 PID 4528 wrote to memory of 1596 4528 regsvr32.exe 77
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\033289fc9c493780387a378e49df474c5e1057310fd521fe04a946997a85fa1c.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\SKIECbvwYdR\rvpBnLDXurqykd.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
PID:4492
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\CgrfaFhJsS\tZqzTgAifLsSy.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1596
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
529KB
MD5b26f9e56f0bb25e9b56f0993c7bacdce
SHA15385516e04aaabf2d57b41f0f055ef843d6195d4
SHA25613c7da69d2bf6ff43019c6c906fc4b132e6e4361160b892e5cfa641b411ae314
SHA51279376415eb5b31b395b9faf7da4c9506bc7598ee8f2217ddbc31f681ea6094ee9fcc4ead9678b36d451bac39dca3dc840d6101184a1c64078143cf01f79e75fc
-
Filesize
529KB
MD5ed7cfb6d6ec708931be0ed257500a99f
SHA1f5a1263c399fc4dc97415dccd1a3168a8b837955
SHA256260991072e60a01c41b556adc081eb5d8aadb4bf918a02cf67890b8fe3730fa2
SHA51278a930519cbb7fd41882cb277488f3889e62ce23dc431a7eac6f0fdf28a446c77be5f5612419574c3edca065812e92507e93745b0bb30b63360452313121ba8d
-
Filesize
529KB
MD5b26f9e56f0bb25e9b56f0993c7bacdce
SHA15385516e04aaabf2d57b41f0f055ef843d6195d4
SHA25613c7da69d2bf6ff43019c6c906fc4b132e6e4361160b892e5cfa641b411ae314
SHA51279376415eb5b31b395b9faf7da4c9506bc7598ee8f2217ddbc31f681ea6094ee9fcc4ead9678b36d451bac39dca3dc840d6101184a1c64078143cf01f79e75fc
-
Filesize
529KB
MD5ed7cfb6d6ec708931be0ed257500a99f
SHA1f5a1263c399fc4dc97415dccd1a3168a8b837955
SHA256260991072e60a01c41b556adc081eb5d8aadb4bf918a02cf67890b8fe3730fa2
SHA51278a930519cbb7fd41882cb277488f3889e62ce23dc431a7eac6f0fdf28a446c77be5f5612419574c3edca065812e92507e93745b0bb30b63360452313121ba8d