Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/11/2024, 21:29
Behavioral task
behavioral1
Sample
ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6.xls
Resource
win10v2004-20241007-en
General
-
Target
ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6.xls
-
Size
95KB
-
MD5
f3ae09b1fad1eb357e7b7a58096db206
-
SHA1
a7858a75bea6f7d1c533cd0877ca9e7cb788536d
-
SHA256
ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6
-
SHA512
615dfffaf9eaafb79ea7c8652e729215c28ee21e8494b188a1ba4de6e8d6f41d17653372db690df587908d2b87282005ebc5fa895dee48add7fa972c588cae48
-
SSDEEP
1536:PFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgWHuS4hcTO97v7UYdEJmt6:tKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8
Malware Config
Extracted
http://francite.net/images/XI7zS0X1nY/
http://chadhymas.com/wp-admin/ZuFQrj/
https://cointrade.world/receipts/Sa6fYJpecEVqiRf05/
http://cupsolution.com/voreglas/kmXpSvyai/
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2760 2348 regsvr32.exe 29 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2768 2348 regsvr32.exe 29 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2732 2348 regsvr32.exe 29 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2700 2348 regsvr32.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2348 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2348 EXCEL.EXE 2348 EXCEL.EXE 2348 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2760 2348 EXCEL.EXE 32 PID 2348 wrote to memory of 2760 2348 EXCEL.EXE 32 PID 2348 wrote to memory of 2760 2348 EXCEL.EXE 32 PID 2348 wrote to memory of 2760 2348 EXCEL.EXE 32 PID 2348 wrote to memory of 2760 2348 EXCEL.EXE 32 PID 2348 wrote to memory of 2760 2348 EXCEL.EXE 32 PID 2348 wrote to memory of 2760 2348 EXCEL.EXE 32 PID 2348 wrote to memory of 2768 2348 EXCEL.EXE 33 PID 2348 wrote to memory of 2768 2348 EXCEL.EXE 33 PID 2348 wrote to memory of 2768 2348 EXCEL.EXE 33 PID 2348 wrote to memory of 2768 2348 EXCEL.EXE 33 PID 2348 wrote to memory of 2768 2348 EXCEL.EXE 33 PID 2348 wrote to memory of 2768 2348 EXCEL.EXE 33 PID 2348 wrote to memory of 2768 2348 EXCEL.EXE 33 PID 2348 wrote to memory of 2732 2348 EXCEL.EXE 34 PID 2348 wrote to memory of 2732 2348 EXCEL.EXE 34 PID 2348 wrote to memory of 2732 2348 EXCEL.EXE 34 PID 2348 wrote to memory of 2732 2348 EXCEL.EXE 34 PID 2348 wrote to memory of 2732 2348 EXCEL.EXE 34 PID 2348 wrote to memory of 2732 2348 EXCEL.EXE 34 PID 2348 wrote to memory of 2732 2348 EXCEL.EXE 34 PID 2348 wrote to memory of 2700 2348 EXCEL.EXE 35 PID 2348 wrote to memory of 2700 2348 EXCEL.EXE 35 PID 2348 wrote to memory of 2700 2348 EXCEL.EXE 35 PID 2348 wrote to memory of 2700 2348 EXCEL.EXE 35 PID 2348 wrote to memory of 2700 2348 EXCEL.EXE 35 PID 2348 wrote to memory of 2700 2348 EXCEL.EXE 35 PID 2348 wrote to memory of 2700 2348 EXCEL.EXE 35
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci1.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2760
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci2.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2768
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci3.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2732
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci4.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD568d2b9a86fc15cfdab84ab590c026cf8
SHA10497383d95b7eb7bcdd619b5ca406b455193e70b
SHA256ec10825dfbb77fc0ce70ae08efa1b38db3a9f2683a12ec3db0d14a3fd96abb45
SHA512d60c43e8af309f1083b9f71a82e52b17785036b3b735b73b6dc435e8c096bf21706cb47da096cc30de4246892bcff9e4594f728328ebbefe90280ab410da9b64