Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    59s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 05:38

General

  • Target

    4fbbd4c9591ac023cd7da6c9e9dd10e173c1e8db7302c424b401b5516ea09588.xls

  • Size

    44KB

  • MD5

    d597c69135c764796ccc916a9ed97d8f

  • SHA1

    25bdf2dffd2df9435578eecd4ec560be5ede5678

  • SHA256

    4fbbd4c9591ac023cd7da6c9e9dd10e173c1e8db7302c424b401b5516ea09588

  • SHA512

    51220484fe348f5f99157882799f38e48948dce7bd648cd9913483d3a3a72ca9202628e0fdbf3a4bb24c273c07a3a3b6c9f49972a8a184591d8c2dc280fb4c58

  • SSDEEP

    768:oPXk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJWL6uShYUQgcUcwWNvW1Tpl3ZeT:EXk3hbdlylKsgqopeJBWhZFGkE+cL2Nf

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4fbbd4c9591ac023cd7da6c9e9dd10e173c1e8db7302c424b401b5516ea09588.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Windows\explorer.exe
      explorer.exe C:\Users\Public\xAo26p.vbs
      2⤵
      • Process spawned unexpected child process
      PID:3744
    • C:\Windows\explorer.exe
      explorer.exe C:\Users\Public\xAo26p.vbs
      2⤵
      • Process spawned unexpected child process
      PID:440
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Public\xAo26p.vbs"
      2⤵
        PID:2136
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Public\xAo26p.vbs"
        2⤵
          PID:3212

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Public\xAo26p.vbs

        Filesize

        365B

        MD5

        586146af62044d054a54e6291ef51427

        SHA1

        339647bbdc4c0fc34984f5a7ad4d3b909c83b176

        SHA256

        571c451f89da319606bfad8fdff3c589954ca8ac52e4f1280cf3e3b67a1f2b5b

        SHA512

        9168ec7bb0d38a6ad0822ba42b0a38a895b7733644be6432cecf4cc4a4fc1b474d7acfb200a644c89564c209141337a11427274826dc61150cd711385ff19bc4

      • C:\Users\Public\xAo26p.vbs

        Filesize

        631B

        MD5

        c3722cb0f305f5f13f4b083920948014

        SHA1

        5c5e9710b6176e22cb3c36215130fdb3a5df592f

        SHA256

        034c223fec355a561797ae9703d837a4ef60a7bec72267d0d314187b5d225214

        SHA512

        eaf3b86029914f1c19dd5922cd015a1f94b39f43ab2ca44e58caa7250308a5bd11399b3f862423a2399255e7937a0a5c4e38048706145eb0094c114aeefe9d75

      • memory/3464-14-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-13-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-0-0x00007FF9913B0000-0x00007FF9913C0000-memory.dmp

        Filesize

        64KB

      • memory/3464-8-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-7-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-9-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-6-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-5-0x00007FF9913B0000-0x00007FF9913C0000-memory.dmp

        Filesize

        64KB

      • memory/3464-10-0x00007FF98ED60000-0x00007FF98ED70000-memory.dmp

        Filesize

        64KB

      • memory/3464-11-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-3-0x00007FF9D13CD000-0x00007FF9D13CE000-memory.dmp

        Filesize

        4KB

      • memory/3464-2-0x00007FF9913B0000-0x00007FF9913C0000-memory.dmp

        Filesize

        64KB

      • memory/3464-12-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-15-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-18-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-17-0x00007FF98ED60000-0x00007FF98ED70000-memory.dmp

        Filesize

        64KB

      • memory/3464-20-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-19-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-16-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB

      • memory/3464-4-0x00007FF9913B0000-0x00007FF9913C0000-memory.dmp

        Filesize

        64KB

      • memory/3464-1-0x00007FF9913B0000-0x00007FF9913C0000-memory.dmp

        Filesize

        64KB

      • memory/3464-35-0x00007FF9D1330000-0x00007FF9D1525000-memory.dmp

        Filesize

        2.0MB