Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 02:07

General

  • Target

    23ebbb920e5e5c9815337e3069c90e2a.xls

  • Size

    36KB

  • MD5

    23ebbb920e5e5c9815337e3069c90e2a

  • SHA1

    bbd7400c042d387dd2b31b0a016d07b8f28fdebe

  • SHA256

    ef14dfd11872d5868c868d851f791f44d60a95ae4f1743fe3be0dc466c1d2e3a

  • SHA512

    3db70047fec5cbf07aef3932d8237ddca7548a08e6fc54e7095240f3147f54cb087a3898acd8d059304cf263e35e9cd691fe8725dd7c75495cc9b4a174025371

  • SSDEEP

    768:cPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJWGqJTF6qEv:Iok3hbdlylKsgqopeJBWhZFGkE+cL2Ny

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://markens.online/wp-data.php

xlm40.dropper

https://statedauto.com/wp-data.php

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\23ebbb920e5e5c9815337e3069c90e2a.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Users\Public\Documents\vUvBga.txt,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:2576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2180-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2180-1-0x0000000072A0D000-0x0000000072A18000-memory.dmp

    Filesize

    44KB

  • memory/2180-2-0x0000000072A0D000-0x0000000072A18000-memory.dmp

    Filesize

    44KB

  • memory/2180-3-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2180-4-0x0000000072A0D000-0x0000000072A18000-memory.dmp

    Filesize

    44KB