Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    158s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 04:06

General

  • Target

    27769a494737638fc8b75033bb03252e.xlsb

  • Size

    370KB

  • MD5

    27769a494737638fc8b75033bb03252e

  • SHA1

    4a8bd03a9e3d334cc4674f0f391bfea273343f02

  • SHA256

    558aacbcc50755ff47a4339dce681bd7158dc1c5c862fc390ded0e153edb95ae

  • SHA512

    219b1b9002a5dceeb0e31aaddae5cd6184f8ed9610db781274ad45757d580dbb3303df1a93d0c3a565a6175caf7b418f33e3e59e859ba7644cebb9d36996bde1

  • SSDEEP

    6144:oXPQ+z9ssjp/d6Ef2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNR:kPQ+z9ZlmL2OGY/TTy2jEIJc6FNu3uPs

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\27769a494737638fc8b75033bb03252e.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Windows\System32\Wbem\wmic.exe
      wmic process call create 'mshta C:\ProgramData\PwSqGAjCETBW.sct'
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of AdjustPrivilegeToken
      PID:4568
  • C:\Windows\system32\mshta.exe
    mshta C:\ProgramData\PwSqGAjCETBW.sct
    1⤵
    • Process spawned unexpected child process
    PID:236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\PwSqGAjCETBW.sct

    Filesize

    14KB

    MD5

    88eb928327ec6e7e4ad4e8516118e1b4

    SHA1

    ba10a34305ad802c00e2302848bfb3184f0db0a8

    SHA256

    e8da6248cd02e3cfbe9cab1f450c61887bd0752b9d81f46a9480b90fefd73597

    SHA512

    6afcb97b5ad5680c3d4c8c5dcd978784420c0684e5ca1e271755c6f06ed2f6d92b4d8b0ff14aae43030f858fc138d8f09c4a50626e87b8bca1da6f1ba4ebe698

  • memory/4360-12-0x00007FFE0E000000-0x00007FFE0E010000-memory.dmp

    Filesize

    64KB

  • memory/4360-4-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-3-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-5-0x00007FFE108D0000-0x00007FFE108E0000-memory.dmp

    Filesize

    64KB

  • memory/4360-6-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-7-0x00007FFE108D0000-0x00007FFE108E0000-memory.dmp

    Filesize

    64KB

  • memory/4360-0-0x00007FFE108D0000-0x00007FFE108E0000-memory.dmp

    Filesize

    64KB

  • memory/4360-8-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-9-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-10-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-2-0x00007FFE108D0000-0x00007FFE108E0000-memory.dmp

    Filesize

    64KB

  • memory/4360-11-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-1-0x00007FFE108D0000-0x00007FFE108E0000-memory.dmp

    Filesize

    64KB

  • memory/4360-23-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-24-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-25-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-19-0x00007FFE0E000000-0x00007FFE0E010000-memory.dmp

    Filesize

    64KB

  • memory/4360-47-0x00007FFE108D0000-0x00007FFE108E0000-memory.dmp

    Filesize

    64KB

  • memory/4360-48-0x00007FFE108D0000-0x00007FFE108E0000-memory.dmp

    Filesize

    64KB

  • memory/4360-49-0x00007FFE108D0000-0x00007FFE108E0000-memory.dmp

    Filesize

    64KB

  • memory/4360-51-0x00007FFE108D0000-0x00007FFE108E0000-memory.dmp

    Filesize

    64KB

  • memory/4360-50-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-52-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB

  • memory/4360-53-0x00007FFE50850000-0x00007FFE50A45000-memory.dmp

    Filesize

    2.0MB