Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2023, 15:20

General

  • Target

    48f3ef54ff2ed0b44d5e4836c56a3a8f3214d7214278172ef84166f6d42cc067.xlsm

  • Size

    46KB

  • MD5

    07f30f1fa5420f050ea5929af0f95265

  • SHA1

    6310b51fca4003fb36252367f058c2e990ba5734

  • SHA256

    48f3ef54ff2ed0b44d5e4836c56a3a8f3214d7214278172ef84166f6d42cc067

  • SHA512

    f16cad27fc864c23ed1c753f5eb319bf79f9d96c40edc70924b25410d5547c2c1bbb4c06b002f8e2bb246d35408bd4fa0e2e526a36ceb344fa399324e2758c80

  • SSDEEP

    768:QmBlntZhEI2YmxNskmoKjBvK3HqK88F/G6YzATUfJnXYS6oRM:hBlntTEvDLmXi3JvG6YzATOJnXYSXRM

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://eles-tech.com/css/KzMysMqFMs/

xlm40.dropper

http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\48f3ef54ff2ed0b44d5e4836c56a3a8f3214d7214278172ef84166f6d42cc067.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe -s ..\xewn.dll
      2⤵
      • Process spawned unexpected child process
      PID:1516

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\xewn.dll

    Filesize

    1.0MB

    MD5

    90cb346e0822a4e2d363a0204fdc2473

    SHA1

    9ddef19bc8fa93be72c156054c7c09d1b8399496

    SHA256

    f1dd147cedb735830cfe8ab907c2b695916efc62708ee89871651424fc326739

    SHA512

    98eb591dc3831c1df1a0433547c98f480d92581bfd449c113a2221818644600626cc0d14e07ce05807a52195c8c344b0f438f1ebe660f38d967d102aad90b566

  • memory/1336-54-0x000000002F1C1000-0x000000002F1C4000-memory.dmp

    Filesize

    12KB

  • memory/1336-55-0x0000000071C11000-0x0000000071C13000-memory.dmp

    Filesize

    8KB

  • memory/1336-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1336-57-0x0000000072BFD000-0x0000000072C08000-memory.dmp

    Filesize

    44KB

  • memory/1336-58-0x00000000762F1000-0x00000000762F3000-memory.dmp

    Filesize

    8KB

  • memory/1336-59-0x0000000072BFD000-0x0000000072C08000-memory.dmp

    Filesize

    44KB