Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 05:08
Static task
static1
Behavioral task
behavioral1
Sample
ComplianceReport-1235323747-Apr-20.xlsb
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ComplianceReport-1235323747-Apr-20.xlsb
Resource
win10v2004-20240709-en
General
-
Target
ComplianceReport-1235323747-Apr-20.xlsb
-
Size
1.2MB
-
MD5
51016d03eae776f91efa813adfa7d9fe
-
SHA1
eaca11c28c4ce7751b8f0f3e6daa027ead329fe3
-
SHA256
7db01ebd9e8d5bb25b52eb950fe2c43da26552fbb37377519acf787942824701
-
SHA512
b6f3be602bc2534afaf0a311ab7ff0d132716bbbe8d64e729700fae7a9e82df361dd8db732f2f0fcaef4c730c1a1e7f26bfb21b43f2a8f9b40693a0984a3230c
-
SSDEEP
24576:0iWxUUOy+cKrpxlDPTMFf9P0kmppxlDPTMFfypxlDPTMFf3h:dEcyUjDLMd+bjDLMdEjDLMd3h
Malware Config
Extracted
http://5.254.118.241/2359222.dat
http://139.99.133.171/2359222.dat
http://185.244.149.152/2359222.dat
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3948 2636 Regsvr32.exe 82 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4492 2636 Regsvr32.exe 82 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3448 2636 Regsvr32.exe 82 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4900 2636 Regsvr32.exe 82 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2636 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2636 EXCEL.EXE 2636 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2636 wrote to memory of 3948 2636 EXCEL.EXE 92 PID 2636 wrote to memory of 3948 2636 EXCEL.EXE 92 PID 2636 wrote to memory of 4492 2636 EXCEL.EXE 93 PID 2636 wrote to memory of 4492 2636 EXCEL.EXE 93 PID 2636 wrote to memory of 3448 2636 EXCEL.EXE 94 PID 2636 wrote to memory of 3448 2636 EXCEL.EXE 94 PID 2636 wrote to memory of 4900 2636 EXCEL.EXE 95 PID 2636 wrote to memory of 4900 2636 EXCEL.EXE 95
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ComplianceReport-1235323747-Apr-20.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SYSTEM32\Regsvr32.exeRegsvr32 /s calc2⤵
- Process spawned unexpected child process
PID:3948
-
-
C:\Windows\SYSTEM32\Regsvr32.exeRegsvr32 C:\Flopers\Gorl\Vertu.OCX2⤵
- Process spawned unexpected child process
PID:4492
-
-
C:\Windows\SYSTEM32\Regsvr32.exeRegsvr32 C:\Flopers\Gorl\Vertua.OCX2⤵
- Process spawned unexpected child process
PID:3448
-
-
C:\Windows\SYSTEM32\Regsvr32.exeRegsvr32 C:\Flopers\Gorl\Vertub.OCX2⤵
- Process spawned unexpected child process
PID:4900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize2KB
MD5a4f097f7167b8cbd846e3b4dc5d2114d
SHA1df6098dda3a7be2ee0031fa4654dbd7a0d30c917
SHA2565179b5926facab989cb684a06c0c96175c78d50863b35dfc917c58178fb54868
SHA512864e7c75486f2c2f5349d0717c894da61fbfabc3115faad1c2d3ab1e06ad25f8080079c02bd77fe8da8988c6f6903d81d07229ce5b214e5067f8b096c5006cc2