Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    9s
  • max time network
    0s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    15/08/2024, 21:17

General

  • Target

    4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a.xls

  • Size

    1.2MB

  • MD5

    f3274d014851e6b44e0564cb13264cbe

  • SHA1

    80303483a7a7b6735a7330a3061f0e3ef212c216

  • SHA256

    4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a

  • SHA512

    85c734b41c8a740dc82f830a14fbdeda8ee110af730aad01ab6c306a73b2f1dc552a58d39bc778e93ca0cbb589ed03611267b2b9abcacd2246c51488c6a6b802

  • SSDEEP

    24576:/61wqQz5CIuVhDV9GPOVuux0SG0RKD8Uhgs:/+0AIuTDG6x0Se

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a.xls
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Users\Admin\AppData\Local\Temp\rad901C0.exe
      "C:\Users\Admin\AppData\Local\Temp\rad901C0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Users\Admin\AppData\Roaming\{15705dbe-a36c-44fc-ab26-062f0c296290}\netbtugc.exe
        "C:\Users\Admin\AppData\Roaming\{15705dbe-a36c-44fc-ab26-062f0c296290}\netbtugc.exe"
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of AdjustPrivilegeToken
        PID:4684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\{15705dbe-a36c-44fc-ab26-062f0c296290}\netbtugc.exe

    Filesize

    255KB

    MD5

    bdb501a004fea9db913551b41a3ea485

    SHA1

    e3a7074a6986ed85789957627b7f794dff727732

    SHA256

    5b7a23853a0f2617e0b8039816bf4040845554c16b8ad15f25202a3cf56f7211

    SHA512

    4ad2ff5fed113d4637498d6c164529b644a7d4080fba7e5e8c22279305e5f207e0347baff2282687e67bac30e1c8bf50d7c461e302462c231935915a9b145353

  • \Users\Admin\AppData\Local\Temp\rad901C0.exe

    Filesize

    254KB

    MD5

    e3b7d39be5e821b59636d0fe7c2944cc

    SHA1

    00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88

    SHA256

    389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97

    SHA512

    8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

  • memory/2508-72-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-39-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-77-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-31-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-32-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-33-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-146-0x00000000066E0000-0x00000000067E0000-memory.dmp

    Filesize

    1024KB

  • memory/2508-129-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-79-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-78-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-76-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-75-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-74-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-73-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-35-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-1-0x0000000072A4D000-0x0000000072A58000-memory.dmp

    Filesize

    44KB

  • memory/2508-37-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-69-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-41-0x00000000066E0000-0x00000000067E0000-memory.dmp

    Filesize

    1024KB

  • memory/2508-40-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-71-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-38-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-70-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-36-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-34-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-30-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2508-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2508-1581-0x0000000072A4D000-0x0000000072A58000-memory.dmp

    Filesize

    44KB

  • memory/2508-1583-0x00000000066E0000-0x00000000067E0000-memory.dmp

    Filesize

    1024KB

  • memory/2508-1582-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB