27b54fa6862199542bbefe006e71e19800a94f910526398d65569beb964e8321 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

8

27b54fa686...21.xls

windows7-x64

27b54fa686...21.xls

windows10-2004-x64

1

Sharing

General

Target

27b54fa6862199542bbefe006e71e19800a94f910526398d65569beb964e8321
Size

296KB
Sample

221201-mf8fgsdb7t
MD5

624b4f02ab405c43cd1999e855d1b278
SHA1

f19cd9841cb2aba1ad3d2d7296d3df8e7dcd61b9
SHA256

27b54fa6862199542bbefe006e71e19800a94f910526398d65569beb964e8321
SHA512

0dad2bc36ced261c7b996683b7cebcc3eef03418f5a7fe5beedf928dbc1191a8f834c7f927e1afbf74ddbd0d559f845825bd6b2a7b3e5b0b2d6587a00d066345
SSDEEP

6144:R5JoU5+acqID6rUkCqVwFPJPvDlCdMAZrByCGk8pBK9eCw4/:qU51+VsyFPJJCSW10JC1/

Score

10^/10

evasion macro macro_on_action persistence xlm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

27b54fa6862199542bbefe006e71e19800a94f910526398d65569beb964e8321.xls

Resource

win7-20220812-en

evasion macro macro_on_action persistence xlm

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

27b54fa6862199542bbefe006e71e19800a94f910526398d65569beb964e8321.xls

Resource

win10v2004-20221111-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Targets

- Target
  
  27b54fa6862199542bbefe006e71e19800a94f910526398d65569beb964e8321
- Size
  
  296KB
- MD5
  
  624b4f02ab405c43cd1999e855d1b278
- SHA1
  
  f19cd9841cb2aba1ad3d2d7296d3df8e7dcd61b9
- SHA256
  
  27b54fa6862199542bbefe006e71e19800a94f910526398d65569beb964e8321
- SHA512
  
  0dad2bc36ced261c7b996683b7cebcc3eef03418f5a7fe5beedf928dbc1191a8f834c7f927e1afbf74ddbd0d559f845825bd6b2a7b3e5b0b2d6587a00d066345
- SSDEEP
  
  6144:R5JoU5+acqID6rUkCqVwFPJPvDlCdMAZrByCGk8pBK9eCw4/:qU51+VsyFPJJCSW10JC1/
Score

10^/10

evasion macro macro_on_action persistence xlm
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Office macro that triggers on suspicious action
  Office document macro which triggers in special circumstances - often malicious.
  macro macro_on_action
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Suspicious Office macro
  Office document equipped with 4.0 macros.
  macro xlm
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionmacromacro_on_actionpersistencexlm

behavioral2

© 2018-2025

Terms | Privacy