Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2024, 21:29

General

  • Target

    ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6.xls

  • Size

    95KB

  • MD5

    f3ae09b1fad1eb357e7b7a58096db206

  • SHA1

    a7858a75bea6f7d1c533cd0877ca9e7cb788536d

  • SHA256

    ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6

  • SHA512

    615dfffaf9eaafb79ea7c8652e729215c28ee21e8494b188a1ba4de6e8d6f41d17653372db690df587908d2b87282005ebc5fa895dee48add7fa972c588cae48

  • SSDEEP

    1536:PFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgWHuS4hcTO97v7UYdEJmt6:tKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://francite.net/images/XI7zS0X1nY/

xlm40.dropper

http://chadhymas.com/wp-admin/ZuFQrj/

xlm40.dropper

https://cointrade.world/receipts/Sa6fYJpecEVqiRf05/

xlm40.dropper

http://cupsolution.com/voreglas/kmXpSvyai/

Signatures

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6.xls
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci1.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2760
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci2.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2768
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci3.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2732
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci4.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\soci3.ocx

    Filesize

    1KB

    MD5

    68d2b9a86fc15cfdab84ab590c026cf8

    SHA1

    0497383d95b7eb7bcdd619b5ca406b455193e70b

    SHA256

    ec10825dfbb77fc0ce70ae08efa1b38db3a9f2683a12ec3db0d14a3fd96abb45

    SHA512

    d60c43e8af309f1083b9f71a82e52b17785036b3b735b73b6dc435e8c096bf21706cb47da096cc30de4246892bcff9e4594f728328ebbefe90280ab410da9b64

  • memory/2348-1-0x000000007293D000-0x0000000072948000-memory.dmp

    Filesize

    44KB

  • memory/2348-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2348-22-0x000000007293D000-0x0000000072948000-memory.dmp

    Filesize

    44KB