Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/05/2024, 18:01

240517-wlx2dabf85 10

17/05/2024, 17:59

240517-wk1e4sbe9x 10

Analysis

  • max time kernel
    452s
  • max time network
    490s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/05/2024, 17:59

General

  • Target

    Setup/Office Installer+ x86.exe

  • Size

    9.0MB

  • MD5

    bb47521d553de207b420f7a16dddf152

  • SHA1

    ed2fb53becb4b161d58bd90ea42211751bc36c78

  • SHA256

    167fb686a8182b4380c699306a3c533eb3c264665925ad086329a752e0b2bde1

  • SHA512

    e0cda4ddccc70b9791a74b27a3c2b3453cbfa1d2a7e78fdb44c3150e90dea061b324e6b76e56a8ef6af7268516fbc97ee278e870b720a4a08887576b09b52801

  • SSDEEP

    196608:G73STvxTfg6AiQBhyQbEAkZQdnkW9AVSGfGIJXvaI6HMaJTtGb:G73ATfzyyu4JfdJX

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup\Office Installer+ x86.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup\Office Installer+ x86.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Windows\SysWOW64\reg.exe
      "reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d 1 /f
      2⤵
        PID:3476
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', 'C:\Users\Admin\AppData\Local\Temp\files\ver.txt') }"
        2⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4232

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gkzulsh1.zhl.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\files\ver.txt

      Filesize

      56KB

      MD5

      028389dd833ca78bfc8e9e10b978ced8

      SHA1

      7691fb72b4af44ba01d553caa301b3fe1936c304

      SHA256

      16f19e1dad900af1cdb630401825416399ea6438e29384d5fa9348e0743c9ec6

      SHA512

      8fb363b6096a972935cda152983b214841b467f2ded074ff6b764dfe4940356d734e751c5863fbd3f6dbb411aa5103283281e786103f4cd2cd65ea5e894f7c4b

    • memory/4232-7-0x0000000004DF0000-0x0000000004E12000-memory.dmp

      Filesize

      136KB

    • memory/4232-19-0x0000000005850000-0x0000000005BA7000-memory.dmp

      Filesize

      3.3MB

    • memory/4232-3-0x0000000073BCE000-0x0000000073BCF000-memory.dmp

      Filesize

      4KB

    • memory/4232-9-0x00000000057E0000-0x0000000005846000-memory.dmp

      Filesize

      408KB

    • memory/4232-8-0x0000000005090000-0x00000000050F6000-memory.dmp

      Filesize

      408KB

    • memory/4232-10-0x0000000073BC0000-0x0000000074371000-memory.dmp

      Filesize

      7.7MB

    • memory/4232-6-0x0000000005140000-0x000000000576A000-memory.dmp

      Filesize

      6.2MB

    • memory/4232-5-0x0000000073BC0000-0x0000000074371000-memory.dmp

      Filesize

      7.7MB

    • memory/4232-20-0x0000000005C90000-0x0000000005CAE000-memory.dmp

      Filesize

      120KB

    • memory/4232-21-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

      Filesize

      304KB

    • memory/4232-22-0x00000000072F0000-0x000000000796A000-memory.dmp

      Filesize

      6.5MB

    • memory/4232-23-0x00000000061A0000-0x00000000061BA000-memory.dmp

      Filesize

      104KB

    • memory/4232-27-0x0000000073BC0000-0x0000000074371000-memory.dmp

      Filesize

      7.7MB

    • memory/4232-4-0x00000000027A0000-0x00000000027D6000-memory.dmp

      Filesize

      216KB