Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 05:16

General

  • Target

    29a5ee5c62d2a1b6288ccd499d020f2d.xlsm

  • Size

    6KB

  • MD5

    29a5ee5c62d2a1b6288ccd499d020f2d

  • SHA1

    8e391c4bdd8ba4da4b18133753ea99f05831d193

  • SHA256

    55a0b4992d4b6721998ac92e3cc4fa9b3384c71edf0e12cabb666359c654516d

  • SHA512

    b6e5261e7fcfa3214bf31bb6bcd33cafba730f8d4e991eac3792ea7a42c4b8aac58819ed8a0a0428cc54fb821c6c0269eac1d255a75702936abec2d80e1dccf0

  • SSDEEP

    192:NDSxuS7brA2OmmfRG8UhHFBFYuAb98ySci3f+Fx:NiucM2w81FYxb98y8k

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://46.17.98.187/index.php

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\29a5ee5c62d2a1b6288ccd499d020f2d.xlsm"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 3936
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:5100
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 3936
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:4844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1428-20-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-1-0x00007FFE3D8B0000-0x00007FFE3D8C0000-memory.dmp

    Filesize

    64KB

  • memory/1428-2-0x00007FFE3D8B0000-0x00007FFE3D8C0000-memory.dmp

    Filesize

    64KB

  • memory/1428-3-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-4-0x00007FFE3D8B0000-0x00007FFE3D8C0000-memory.dmp

    Filesize

    64KB

  • memory/1428-5-0x00007FFE3D8B0000-0x00007FFE3D8C0000-memory.dmp

    Filesize

    64KB

  • memory/1428-6-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-7-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-9-0x00007FFE3B850000-0x00007FFE3B860000-memory.dmp

    Filesize

    64KB

  • memory/1428-8-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-10-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-12-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-14-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-17-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-18-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-19-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-22-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-21-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-38-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-16-0x00007FFE3B850000-0x00007FFE3B860000-memory.dmp

    Filesize

    64KB

  • memory/1428-15-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-13-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-11-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/1428-0-0x00007FFE3D8B0000-0x00007FFE3D8C0000-memory.dmp

    Filesize

    64KB

  • memory/5100-29-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/5100-32-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/5100-33-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/5100-31-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/5100-28-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/5100-26-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/5100-42-0x00007FFE3D8B0000-0x00007FFE3D8C0000-memory.dmp

    Filesize

    64KB

  • memory/5100-46-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/5100-45-0x00007FFE7D830000-0x00007FFE7DA25000-memory.dmp

    Filesize

    2.0MB

  • memory/5100-44-0x00007FFE3D8B0000-0x00007FFE3D8C0000-memory.dmp

    Filesize

    64KB

  • memory/5100-43-0x00007FFE3D8B0000-0x00007FFE3D8C0000-memory.dmp

    Filesize

    64KB

  • memory/5100-41-0x00007FFE3D8B0000-0x00007FFE3D8C0000-memory.dmp

    Filesize

    64KB