Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2023, 19:31

General

  • Target

    c2e5f1d7d6f695ce05e13a78e371771d.xls

  • Size

    166KB

  • MD5

    c2e5f1d7d6f695ce05e13a78e371771d

  • SHA1

    00ef694207dd24bcec1b8d851b936f065df0972a

  • SHA256

    41d16f38f7fcd1569f05c1b17dd869168ece6a626b65bbd2df1cd9a08b4fdb25

  • SHA512

    2fb3040123ffea0b4ec3a9a37b37559bab89ca823b71727f4815eef2f203b68ba8aa279795f2f611861c23a29e202a0fc0007bd21433a683e1927c7078a9439b

  • SSDEEP

    3072:6Ok3hOdsylKlgryzc4bNhZFGzE+cL2knL/Qfe3J2jcc0lbxOGiJtXwmyypRyT:6Ok3hOdsylKlgryzc4bNhZF+E+W2knLt

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes itself 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\c2e5f1d7d6f695ce05e13a78e371771d.xls
    1⤵
    • Deletes itself
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: RenamesItself
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1204
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:616
        • C:\Windows\SysWOW64\attrib.exe
          attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
          3⤵
          • Views/modifies file attributes
          PID:524
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
        2⤵
        • Process spawned unexpected child process
        PID:1780
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
        2⤵
        • Process spawned unexpected child process
        PID:1608

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/832-385-0x000000006BE51000-0x000000006BE53000-memory.dmp

      Filesize

      8KB

    • memory/832-55-0x0000000070F31000-0x0000000070F33000-memory.dmp

      Filesize

      8KB

    • memory/832-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/832-57-0x0000000075831000-0x0000000075833000-memory.dmp

      Filesize

      8KB

    • memory/832-58-0x0000000071F1D000-0x0000000071F28000-memory.dmp

      Filesize

      44KB

    • memory/832-388-0x0000000071F1D000-0x0000000071F28000-memory.dmp

      Filesize

      44KB

    • memory/832-54-0x000000002FFE1000-0x000000002FFE4000-memory.dmp

      Filesize

      12KB

    • memory/832-387-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/832-386-0x0000000071F1D000-0x0000000071F28000-memory.dmp

      Filesize

      44KB

    • memory/1204-60-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

      Filesize

      8KB