Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 05:08

General

  • Target

    ComplianceReport-1235323747-Apr-20.xlsb

  • Size

    1.2MB

  • MD5

    51016d03eae776f91efa813adfa7d9fe

  • SHA1

    eaca11c28c4ce7751b8f0f3e6daa027ead329fe3

  • SHA256

    7db01ebd9e8d5bb25b52eb950fe2c43da26552fbb37377519acf787942824701

  • SHA512

    b6f3be602bc2534afaf0a311ab7ff0d132716bbbe8d64e729700fae7a9e82df361dd8db732f2f0fcaef4c730c1a1e7f26bfb21b43f2a8f9b40693a0984a3230c

  • SSDEEP

    24576:0iWxUUOy+cKrpxlDPTMFf9P0kmppxlDPTMFfypxlDPTMFf3h:dEcyUjDLMd+bjDLMdEjDLMd3h

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://5.254.118.241/2359222.dat

xlm40.dropper

http://139.99.133.171/2359222.dat

xlm40.dropper

http://185.244.149.152/2359222.dat

Signatures

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ComplianceReport-1235323747-Apr-20.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Windows\SYSTEM32\Regsvr32.exe
      Regsvr32 /s calc
      2⤵
      • Process spawned unexpected child process
      PID:3948
    • C:\Windows\SYSTEM32\Regsvr32.exe
      Regsvr32 C:\Flopers\Gorl\Vertu.OCX
      2⤵
      • Process spawned unexpected child process
      PID:4492
    • C:\Windows\SYSTEM32\Regsvr32.exe
      Regsvr32 C:\Flopers\Gorl\Vertua.OCX
      2⤵
      • Process spawned unexpected child process
      PID:3448
    • C:\Windows\SYSTEM32\Regsvr32.exe
      Regsvr32 C:\Flopers\Gorl\Vertub.OCX
      2⤵
      • Process spawned unexpected child process
      PID:4900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    2KB

    MD5

    a4f097f7167b8cbd846e3b4dc5d2114d

    SHA1

    df6098dda3a7be2ee0031fa4654dbd7a0d30c917

    SHA256

    5179b5926facab989cb684a06c0c96175c78d50863b35dfc917c58178fb54868

    SHA512

    864e7c75486f2c2f5349d0717c894da61fbfabc3115faad1c2d3ab1e06ad25f8080079c02bd77fe8da8988c6f6903d81d07229ce5b214e5067f8b096c5006cc2

  • memory/2636-14-0x00007FFF43230000-0x00007FFF43240000-memory.dmp

    Filesize

    64KB

  • memory/2636-6-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-3-0x00007FFF45AF0000-0x00007FFF45B00000-memory.dmp

    Filesize

    64KB

  • memory/2636-9-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-8-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-10-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-7-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-12-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-0-0x00007FFF45AF0000-0x00007FFF45B00000-memory.dmp

    Filesize

    64KB

  • memory/2636-13-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-4-0x00007FFF45AF0000-0x00007FFF45B00000-memory.dmp

    Filesize

    64KB

  • memory/2636-15-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-11-0x00007FFF43230000-0x00007FFF43240000-memory.dmp

    Filesize

    64KB

  • memory/2636-5-0x00007FFF45AF0000-0x00007FFF45B00000-memory.dmp

    Filesize

    64KB

  • memory/2636-2-0x00007FFF45AF0000-0x00007FFF45B00000-memory.dmp

    Filesize

    64KB

  • memory/2636-18-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-19-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-17-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-16-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-28-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-29-0x00007FFF85B0D000-0x00007FFF85B0E000-memory.dmp

    Filesize

    4KB

  • memory/2636-30-0x00007FFF85A70000-0x00007FFF85C65000-memory.dmp

    Filesize

    2.0MB

  • memory/2636-1-0x00007FFF85B0D000-0x00007FFF85B0E000-memory.dmp

    Filesize

    4KB