Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
Purchase List Xls.exe
Resource
win7-20230831-en
General
-
Target
Purchase List Xls.exe
-
Size
1.1MB
-
MD5
fdbce7853fd4e5e1e10d6060f6dae122
-
SHA1
32a258bccbeda4b9bba2d7bbc4679a31fa58bb81
-
SHA256
8838c8ec2ad1e7f3d9b4efcd3c0c2134507988c60915b2a2a6bf10eac2fb3cde
-
SHA512
d2c60a96d930296644ff3672f371c070bc9510ecb479fcc9585d9eedc3b7b2fe0186360570d16aa6ab813c772b821dcd8d55b81752e9de86c136435c0711fbf3
-
SSDEEP
24576:yV1gBwoZLueV335shh2AvxocjcmLH3yd2OluON4fA9uC:yV1zoQAZbAv2vmD3yd2OluON4fA9u
Malware Config
Extracted
darkcloud
- email_from
- email_to
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions Purchase List Xls.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools Purchase List Xls.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Purchase List Xls.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Purchase List Xls.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Purchase List Xls.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Purchase List Xls.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2220 set thread context of 2784 2220 Purchase List Xls.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2760 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2784 Purchase List Xls.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2784 Purchase List Xls.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2760 2220 Purchase List Xls.exe 30 PID 2220 wrote to memory of 2760 2220 Purchase List Xls.exe 30 PID 2220 wrote to memory of 2760 2220 Purchase List Xls.exe 30 PID 2220 wrote to memory of 2760 2220 Purchase List Xls.exe 30 PID 2220 wrote to memory of 2784 2220 Purchase List Xls.exe 32 PID 2220 wrote to memory of 2784 2220 Purchase List Xls.exe 32 PID 2220 wrote to memory of 2784 2220 Purchase List Xls.exe 32 PID 2220 wrote to memory of 2784 2220 Purchase List Xls.exe 32 PID 2220 wrote to memory of 2784 2220 Purchase List Xls.exe 32 PID 2220 wrote to memory of 2784 2220 Purchase List Xls.exe 32 PID 2220 wrote to memory of 2784 2220 Purchase List Xls.exe 32 PID 2220 wrote to memory of 2784 2220 Purchase List Xls.exe 32 PID 2220 wrote to memory of 2784 2220 Purchase List Xls.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase List Xls.exe"C:\Users\Admin\AppData\Local\Temp\Purchase List Xls.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCCATp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB1F1.tmp"2⤵
- Creates scheduled task(s)
PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase List Xls.exe"{path}"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e76011000a46ba8fd4414a0302de3091
SHA1f6f8ae08644043fd457d573ea09bb8ffaa9e02c8
SHA2563c446dff8aa7408bafcebebe4d78c95ad4c3ad6cd3091b96a67831e70398d505
SHA512c9d56ca11e3dd5ee473a6e1f8be777087d853fce0e3e870643ffa7f5e8a3dfe61299e7587099ffaece92cf9eb9ed393fcb7e33a2df61b924adb063b22afaf411