Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 00:33

General

  • Target

    dae06ec2c7cd6868d4369fd86ca2d09ca5d1e161455f7b8ac59fd2537d8caa98.exe

  • Size

    151KB

  • MD5

    1ce14b8e33ac73d894733e89f2d1e630

  • SHA1

    ef4b77f0c5d4cd5e4be0df7a7b566cf555715ff3

  • SHA256

    dae06ec2c7cd6868d4369fd86ca2d09ca5d1e161455f7b8ac59fd2537d8caa98

  • SHA512

    4580d7d48867312712ea4aeb00ce521755eb732b6a86ac44c2825df24db11a1f5a3e57a02c0947e5857a3a7629caf073e03c6bbdc7923eda2e192d245516665e

  • SSDEEP

    3072:MbZEhqr8+IQ9r/To2+GmTkUSqlDkYl/dvwN5emUstAxXl:MmqA+I47+GzwBWtAxXl

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dae06ec2c7cd6868d4369fd86ca2d09ca5d1e161455f7b8ac59fd2537d8caa98.exe
    "C:\Users\Admin\AppData\Local\Temp\dae06ec2c7cd6868d4369fd86ca2d09ca5d1e161455f7b8ac59fd2537d8caa98.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Program Files (x86)\Microsoft Office\Office14\winword.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\winword.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:328
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1824

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

      Filesize

      19.9MB

      MD5

      84af941c93daa669d1c28cd9732f1075

      SHA1

      006193ca78cfedb8580fd73012799bf2d0f5ab52

      SHA256

      e4334621d2b2989f3032c3964d48bac9e783e5810c42da2ced9005b2719d89ea

      SHA512

      39c1b2aa63927dd210e672a92c73c6427e8d27c88ce65237bf7be7967a7799e659d6b614a221ac196b681eafe34be6d10546b3dc9e069d7cb3d74a8ae4bd533d

    • \Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

      Filesize

      19.9MB

      MD5

      84af941c93daa669d1c28cd9732f1075

      SHA1

      006193ca78cfedb8580fd73012799bf2d0f5ab52

      SHA256

      e4334621d2b2989f3032c3964d48bac9e783e5810c42da2ced9005b2719d89ea

      SHA512

      39c1b2aa63927dd210e672a92c73c6427e8d27c88ce65237bf7be7967a7799e659d6b614a221ac196b681eafe34be6d10546b3dc9e069d7cb3d74a8ae4bd533d

    • \Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

      Filesize

      19.9MB

      MD5

      84af941c93daa669d1c28cd9732f1075

      SHA1

      006193ca78cfedb8580fd73012799bf2d0f5ab52

      SHA256

      e4334621d2b2989f3032c3964d48bac9e783e5810c42da2ced9005b2719d89ea

      SHA512

      39c1b2aa63927dd210e672a92c73c6427e8d27c88ce65237bf7be7967a7799e659d6b614a221ac196b681eafe34be6d10546b3dc9e069d7cb3d74a8ae4bd533d

    • \Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

      Filesize

      19.9MB

      MD5

      84af941c93daa669d1c28cd9732f1075

      SHA1

      006193ca78cfedb8580fd73012799bf2d0f5ab52

      SHA256

      e4334621d2b2989f3032c3964d48bac9e783e5810c42da2ced9005b2719d89ea

      SHA512

      39c1b2aa63927dd210e672a92c73c6427e8d27c88ce65237bf7be7967a7799e659d6b614a221ac196b681eafe34be6d10546b3dc9e069d7cb3d74a8ae4bd533d

    • \Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

      Filesize

      19.9MB

      MD5

      84af941c93daa669d1c28cd9732f1075

      SHA1

      006193ca78cfedb8580fd73012799bf2d0f5ab52

      SHA256

      e4334621d2b2989f3032c3964d48bac9e783e5810c42da2ced9005b2719d89ea

      SHA512

      39c1b2aa63927dd210e672a92c73c6427e8d27c88ce65237bf7be7967a7799e659d6b614a221ac196b681eafe34be6d10546b3dc9e069d7cb3d74a8ae4bd533d

    • memory/328-58-0x0000000072601000-0x0000000072604000-memory.dmp

      Filesize

      12KB

    • memory/328-72-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/328-62-0x000000007106D000-0x0000000071078000-memory.dmp

      Filesize

      44KB

    • memory/328-59-0x0000000070081000-0x0000000070083000-memory.dmp

      Filesize

      8KB

    • memory/328-60-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/328-73-0x000000007106D000-0x0000000071078000-memory.dmp

      Filesize

      44KB

    • memory/328-66-0x00000000058A0000-0x0000000006C71000-memory.dmp

      Filesize

      19.8MB

    • memory/328-67-0x00000000058A0000-0x0000000006C71000-memory.dmp

      Filesize

      19.8MB

    • memory/1664-54-0x0000000075591000-0x0000000075593000-memory.dmp

      Filesize

      8KB

    • memory/1664-55-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/1664-57-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/1824-71-0x000007FEFBAC1000-0x000007FEFBAC3000-memory.dmp

      Filesize

      8KB