Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/02/2023, 18:54

General

  • Target

    paquete_3841728.xlsm

  • Size

    46KB

  • MD5

    848e5d22345ad8b064cf0da589a28db2

  • SHA1

    e1dd2f21d103c0e012dcb29ea7f982803b37689c

  • SHA256

    34ebe038a8b30eebad90de95dc17f118029a11a0450ceb36fee4741a4c226cb3

  • SHA512

    2e95cfd295e94e5d1e69710c16a20b5f6c4797695f670732c0607dccd0260c9d50f57dae59f277fb62b5959b8d88453a38cf5a4708d73fea810bd6601c2ee118

  • SSDEEP

    768:SEoTBvDOevZCwrvtWzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2ceI:9olvDmtT5fTR4Lh1NisFYBc3cr+UqVUz

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://moveconnects.com/wp-admin/network/7T8g9DAohsL/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\paquete_3841728.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx
      2⤵
      • Process spawned unexpected child process
      PID:4452

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\enu.ocx

    Filesize

    182KB

    MD5

    7db1ff0a75a3c2293ae95414f823a1f8

    SHA1

    e0e8ddbbf98804b5fe2d2d6d31ebef028ac8fb00

    SHA256

    c7c7f9a50622dc72bf609b99ce5095a1ef5f2ebe6f0dbc4c18397dca0b15105b

    SHA512

    cbc07ff2f3a1c2b9e9daaff6a6c3d23846dd9c4bb8e9887f506f2adbcc64dd9cb99329c43d48fdaa3e281907d3d4a9306af716c06b8e785e93e9bb5ff660f81e

  • memory/2664-115-0x00007FFED2330000-0x00007FFED2340000-memory.dmp

    Filesize

    64KB

  • memory/2664-116-0x00007FFED2330000-0x00007FFED2340000-memory.dmp

    Filesize

    64KB

  • memory/2664-117-0x00007FFED2330000-0x00007FFED2340000-memory.dmp

    Filesize

    64KB

  • memory/2664-118-0x00007FFED2330000-0x00007FFED2340000-memory.dmp

    Filesize

    64KB

  • memory/2664-127-0x00007FFECE830000-0x00007FFECE840000-memory.dmp

    Filesize

    64KB

  • memory/2664-128-0x00007FFECE830000-0x00007FFECE840000-memory.dmp

    Filesize

    64KB

  • memory/4452-297-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-301-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-281-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-282-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-283-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-284-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-285-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-286-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-287-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-288-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-289-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-290-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-292-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-293-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-294-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-295-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-296-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-279-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-298-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-299-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-300-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-280-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-302-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-303-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-304-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-305-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-306-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-308-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-310-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-311-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-312-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-314-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-316-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-315-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-317-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-318-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-313-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-309-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-307-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB

  • memory/4452-291-0x00000000775D0000-0x000000007775E000-memory.dmp

    Filesize

    1.6MB