Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2024, 19:25

General

  • Target

    384965395d191f40adaac4566b07973c.xlsm

  • Size

    304KB

  • MD5

    384965395d191f40adaac4566b07973c

  • SHA1

    0dffcdff76b8aa1f4499074607898aab086f1f6a

  • SHA256

    dc5987a650cd86daff6f68088cac0477cd90ee752f53f29e53b86db76ca4ccd6

  • SHA512

    1a56feefa80e1ca45cc5dd1da0dec9f1241c44a001f3c41310edb4287052fe5c6f03fced9fd04370421991662875bad7902d16fdd9fe7f421f70a3ec22c61acb

  • SSDEEP

    6144:SqNSLcq+YXEsMcTJuBHrZdProzBpkfeyGsiwLjkwPs2f3e1s+fScMp2:BPYXEsl9WFNQBpfyqIkwU2fmG2

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\384965395d191f40adaac4566b07973c.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4228
    • C:\Windows\SYSTEM32\MSHTA.exe
      MSHTA C:\ProgramData\OxOCOwmY.sct
      2⤵
      • Process spawned unexpected child process
      PID:4980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\OxOCOwmY.sct

    Filesize

    25KB

    MD5

    aca67dc6f6dc2e2c3da3aa84a6382f41

    SHA1

    74696b041d3f47559d6febc653c9d8e1e404de2b

    SHA256

    159514dffb992ca9710a89024b567e6dc53dcac3d71885bbd6032f1f0110200b

    SHA512

    38472ba3c8012b80e535ac01cf6994a4624ad7e9ddcdd082117b335a9e372046932a2aba9f5f815439f4578d487e6b15c37b6e8c54e8f4ed6cad6fb8991458e2

  • memory/4228-14-0x00007FFD086D0000-0x00007FFD086E0000-memory.dmp

    Filesize

    64KB

  • memory/4228-57-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-2-0x00007FFD0AE50000-0x00007FFD0AE60000-memory.dmp

    Filesize

    64KB

  • memory/4228-5-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-4-0x00007FFD0AE50000-0x00007FFD0AE60000-memory.dmp

    Filesize

    64KB

  • memory/4228-6-0x00007FFD0AE50000-0x00007FFD0AE60000-memory.dmp

    Filesize

    64KB

  • memory/4228-7-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-8-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-9-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-10-0x00007FFD0AE50000-0x00007FFD0AE60000-memory.dmp

    Filesize

    64KB

  • memory/4228-11-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-15-0x00007FFD086D0000-0x00007FFD086E0000-memory.dmp

    Filesize

    64KB

  • memory/4228-3-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-13-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-12-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-22-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-23-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-24-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-1-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-52-0x00007FFD0AE50000-0x00007FFD0AE60000-memory.dmp

    Filesize

    64KB

  • memory/4228-54-0x00007FFD0AE50000-0x00007FFD0AE60000-memory.dmp

    Filesize

    64KB

  • memory/4228-53-0x00007FFD0AE50000-0x00007FFD0AE60000-memory.dmp

    Filesize

    64KB

  • memory/4228-55-0x00007FFD0AE50000-0x00007FFD0AE60000-memory.dmp

    Filesize

    64KB

  • memory/4228-56-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-0-0x00007FFD0AE50000-0x00007FFD0AE60000-memory.dmp

    Filesize

    64KB

  • memory/4228-59-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4228-58-0x00007FFD4ADD0000-0x00007FFD4AFC5000-memory.dmp

    Filesize

    2.0MB