Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 07:11

General

  • Target

    2ce295dcd3764b8618daeade78c6e6c4.xlsb

  • Size

    344KB

  • MD5

    2ce295dcd3764b8618daeade78c6e6c4

  • SHA1

    46045b4d9f509a83cedfafaa48a05c19f52249a4

  • SHA256

    6de25ca57c86190d89f900b0d6c95bc5484102e46180f39c916e0f6b2ddca9f1

  • SHA512

    aeba76bd6561f5976724d8be3f07a909e105a9f306f5053d055d0d9bfb180716aea77abf61550af08a1d1b8b3acee6c22e6fdaa35acdf225ad11d6acb4519871

  • SSDEEP

    6144:ogkHHNfWH2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxN5j:kHNuWL2OGY/TTy2jEIJc6FNu3uPmNN

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\2ce295dcd3764b8618daeade78c6e6c4.xlsb
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2968
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic process call create 'mshta C:\ProgramData\NwLapcDikupcDN.sct'
      2⤵
      • Process spawned unexpected child process
      PID:2008
  • C:\Windows\system32\mshta.exe
    mshta C:\ProgramData\NwLapcDikupcDN.sct
    1⤵
    • Process spawned unexpected child process
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\NwLapcDikupcDN.sct

    Filesize

    15KB

    MD5

    47a1984764f641f98646dbbcea540752

    SHA1

    55db505e8937b8a0785182489cc2eae2416031ec

    SHA256

    b8800720ee043b8c52ff1f4d485e7b7a6ba2dd357c5cb90e87fb0790a473bb73

    SHA512

    9be49306a5f3e0a61fb77aef2a96ddb029a50b7adaedab7ad1f3adb4adbc19485bc0f482504ba31c71612e7d65920dc54e700614cd753c9667a08d3d9d204608

  • memory/2968-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2968-1-0x000000007240D000-0x0000000072418000-memory.dmp

    Filesize

    44KB

  • memory/2968-9-0x000000007240D000-0x0000000072418000-memory.dmp

    Filesize

    44KB

  • memory/2968-12-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2968-13-0x000000007240D000-0x0000000072418000-memory.dmp

    Filesize

    44KB