Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
20/07/2023, 12:00
230720-n6c8psgh7z 620/04/2023, 11:47
230420-nyb1nsbf5y 122/03/2023, 11:13
230322-nbvjhaad5s 1022/03/2023, 11:03
230322-m552nagd53 422/03/2023, 10:57
230322-m18xraac81 1022/03/2023, 10:56
230322-m132haac8z 122/03/2023, 10:41
230322-mre83sac4v 1021/03/2023, 21:11
230321-z11ycsfb4x 10Analysis
-
max time kernel
75s -
max time network
76s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
22/03/2023, 11:13
Static task
static1
Behavioral task
behavioral1
Sample
e173ecebfd5b01766dd8184250d5f2d442507b9b097e4ced319c246b78550d85.one
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
e173ecebfd5b01766dd8184250d5f2d442507b9b097e4ced319c246b78550d85.one
Resource
win10v2004-20230220-en
General
-
Target
e173ecebfd5b01766dd8184250d5f2d442507b9b097e4ced319c246b78550d85.one
-
Size
280KB
-
MD5
b1a10568aa1e4a47ad2aa35788edc0af
-
SHA1
dd6ba6ae1680e4245f5ecc22ee12a18b9e16db2d
-
SHA256
e173ecebfd5b01766dd8184250d5f2d442507b9b097e4ced319c246b78550d85
-
SHA512
9dfd246820c9d705bd54f3118d581063ceadfdae04d0cd047dc66e19d6a5c29fee0195e7a5671854d5c9886a37a83f85d7e5aacd5d8c8df1cfa13384e3fa717e
-
SSDEEP
3072:e57pvc2vetOepE76wtghUVkJlD1HUjCuitewu4UhKg+jbJDDO7UckjjwQV:u1veXwtVElijRLwuzKg+jb1UkUa
Malware Config
Extracted
emotet
Epoch4
213.239.212.5:443
129.232.188.93:443
103.43.75.120:443
197.242.150.244:8080
1.234.2.232:8080
110.232.117.186:8080
95.217.221.146:8080
159.89.202.34:443
159.65.88.10:8080
82.223.21.224:8080
169.57.156.166:8080
45.176.232.124:443
45.235.8.30:8080
173.212.193.249:8080
107.170.39.149:8080
119.59.103.152:8080
167.172.199.165:8080
91.207.28.33:8080
185.4.135.165:8080
104.168.155.143:8080
206.189.28.199:8080
79.137.35.198:8080
103.132.242.26:8080
202.129.205.3:8080
103.75.201.2:443
149.56.131.28:8080
5.135.159.50:443
172.105.226.75:8080
201.94.166.162:443
115.68.227.76:8080
164.90.222.65:443
186.194.240.217:443
153.126.146.25:7080
187.63.160.88:80
209.126.85.32:8080
72.15.201.15:8080
153.92.5.27:8080
167.172.253.162:8080
147.139.166.154:8080
163.44.196.120:8080
183.111.227.137:8080
139.59.126.41:443
164.68.99.3:8080
188.44.20.25:443
94.23.45.86:4143
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE is not expected to spawn this process 1616 2440 WScript.exe 65 -
Blocklisted process makes network request 11 IoCs
flow pid Process 24 1616 WScript.exe 26 1616 WScript.exe 31 1616 WScript.exe 34 1616 WScript.exe 37 1616 WScript.exe 40 1616 WScript.exe 43 1616 WScript.exe 45 1616 WScript.exe 47 1616 WScript.exe 50 1616 WScript.exe 52 1616 WScript.exe -
Loads dropped DLL 1 IoCs
pid Process 5000 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2440 ONENOTE.EXE 2440 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2440 ONENOTE.EXE 2440 ONENOTE.EXE 5000 regsvr32.exe 5000 regsvr32.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE 2440 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1616 2440 ONENOTE.EXE 69 PID 2440 wrote to memory of 1616 2440 ONENOTE.EXE 69 PID 1616 wrote to memory of 5000 1616 WScript.exe 70 PID 1616 wrote to memory of 5000 1616 WScript.exe 70 PID 5000 wrote to memory of 4132 5000 regsvr32.exe 71 PID 5000 wrote to memory of 4132 5000 regsvr32.exe 71
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\e173ecebfd5b01766dd8184250d5f2d442507b9b097e4ced319c246b78550d85.one"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{F9D797E9-8D74-455A-A313-77C242BCF437}\NT\0\output1.js"2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\4g3tkco9w\GULcnOuEPP9Ds5DiY9FsbtSru0ZbH.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\QGPxcjFbqmEVcZb\flZO.dll"4⤵PID:4132
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
708B
MD525cc34afeb6ebbe685bb3d34ecf0ed03
SHA156e158953158721f21a70a523f3364e8989c10ac
SHA2564c25aec7c690c54344e24261ea3e716d475537c3266e3859ca459dc68d7c905d
SHA512efd6761d19db66855139912f3d29db8927035ad7e4ae4904a47748a52c5dfcc21b2cc77beed4befbeb67b1d085791cb3457a8c5bb8f94cc4ce015f09fb3a4134
-
Filesize
116KB
MD5ad0358aa96105ca02607a7605f3a1e80
SHA1d64a68d180d675170062ce13014a479ebe1de5d8
SHA256d8cca538ecd91252ed5294bd8bbbb5772245e8b1315fd9723e1f08ee4ef6958d
SHA5125fe4924d1dd39cde2899e8937d8271c3f9394d4a149818d6e1e4fc83b35b30c810fe6b68dfcdd49a77d0cb9de1b996903213b92bbba64ecde8bc9341f55a5342
-
Filesize
41KB
MD51beb6cb6862e215a84ee058f430b8036
SHA114562b101e8b0d1826da79bffb88633154c304b7
SHA25631e98a8bfc9d5317f3f3fecd28d23b707756d3c3f106b41ba0570e31920ebc8a
SHA512ef09ffd7ccb1c8a6a033358cfa40c65ba39a5c4c9d987792555e9956301763ab9382a0024070c4dd5f5e96bde8f10231a78a36fb697509cff2380028f4eacd7c
-
Filesize
92.4MB
MD56050ae1d5fdc8f368696a4bae6c9f564
SHA18749f356ff9a6eab0ed8585d33ebe9bfe46f8ead
SHA25691c6722005566b4ee7093adcc7dd6079df3f52203e65ab0094074bb938ff4819
SHA51202a0104af3627c720d5c0d2e503bdb24f136bd691c0997a2f1e1cc5972b8c336cee42225db67add3dbf521d332feb917b3e4e2e15bf156b114c8be074fd3e90a
-
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{F9D797E9-8D74-455A-A313-77C242BCF437}\NT\0\output1.js
Filesize116KB
MD5ad0358aa96105ca02607a7605f3a1e80
SHA1d64a68d180d675170062ce13014a479ebe1de5d8
SHA256d8cca538ecd91252ed5294bd8bbbb5772245e8b1315fd9723e1f08ee4ef6958d
SHA5125fe4924d1dd39cde2899e8937d8271c3f9394d4a149818d6e1e4fc83b35b30c810fe6b68dfcdd49a77d0cb9de1b996903213b92bbba64ecde8bc9341f55a5342
-
Filesize
968KB
MD5c780f377624705bdc24402a28fc0423a
SHA1b52a54adefc6d73cb0bcec628081b244e7dccaea
SHA256628f0159d165dba94eae60eeb79447eb5cc926fbc933bd9b3db4f239bdfe7776
SHA5120a3ffab8fd0ea90349b7a99888d3bd2309d2c59c7c57f098bc739a62f94cbfe497c1b4f76c8c0276a3f3f956f90db25b601b3763b5809b2585bb8263378a512b
-
Filesize
85KB
MD5b85e5767bf5001bd8c48ddad3250d1c0
SHA18e6f41ef924727493587494e0bf5facc9b40bbd0
SHA256b83680379ac89b857c64e28eb7dfdeda7ebc1d83de5a25799926ad3860fdc0fe
SHA512cb66f3441aeef054fda04c8f60d3e5406cde8ac24da81bd601425de5e4e96292cf9d902a9e7d9e23b45fd9d2d6fff4dcfdb2311963b14fb8cb6eb49a4dee0bc7
-
Filesize
91.4MB
MD527471aa5ea78dae8fc9407d4a2d1941c
SHA1a5a44401a4230dca13c408d5b3088f8ff9a7014b
SHA256d322f025655d41569cb611cfeb90de043e4fca4472199d738138df9f90f042db
SHA512258f7be01d5dea8995d3ea5685b9ac5f23cbde38d6689a6a4d961aafa9b70e2372e65d44f79ff07fb829d7a82e69a7332a8e13cde84d47aba7b5e99e448c6974