Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 21:29

General

  • Target

    ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6.xls

  • Size

    95KB

  • MD5

    f3ae09b1fad1eb357e7b7a58096db206

  • SHA1

    a7858a75bea6f7d1c533cd0877ca9e7cb788536d

  • SHA256

    ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6

  • SHA512

    615dfffaf9eaafb79ea7c8652e729215c28ee21e8494b188a1ba4de6e8d6f41d17653372db690df587908d2b87282005ebc5fa895dee48add7fa972c588cae48

  • SSDEEP

    1536:PFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgWHuS4hcTO97v7UYdEJmt6:tKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://francite.net/images/XI7zS0X1nY/

xlm40.dropper

http://chadhymas.com/wp-admin/ZuFQrj/

xlm40.dropper

https://cointrade.world/receipts/Sa6fYJpecEVqiRf05/

xlm40.dropper

http://cupsolution.com/voreglas/kmXpSvyai/

Signatures

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ed6023ae4f18301c0c3e9c2997955d11cf7cdad80aa0303a8d6837d861379bb6.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci1.ocx
      2⤵
      • Process spawned unexpected child process
      PID:464
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci2.ocx
      2⤵
      • Process spawned unexpected child process
      PID:1112
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci3.ocx
      2⤵
      • Process spawned unexpected child process
      PID:2628
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci4.ocx
      2⤵
      • Process spawned unexpected child process
      PID:4716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    15bf4fd3ebd96e4301da68a931840f1f

    SHA1

    f2eba2b5dc8b35f8fa124c64051a787688cc2c66

    SHA256

    1518c9be3298d61a99a6e3a2018a47642c43f4303453b42ef204b3cf0649a91a

    SHA512

    8ac677c2d5beb012c5e0311769feaf7958742d3ee1751c2c4e47143cc2b1de300423185be165bd41269c8be4825167f3f8078b4099c20adb3c2968caed721086

  • C:\Users\Admin\soci3.ocx

    Filesize

    1KB

    MD5

    fac397ca3d45a08e7ad3555b9e0bbd18

    SHA1

    25715a7cf32c917132d77ba4f98a88b73311bb50

    SHA256

    7d6c39aa1f8f18a1a726ab0d3149589042f7cc760727af8e07b737b12d6e7528

    SHA512

    bafbd308d942262c819aa2d0432de9d919a711ecc6386e3d671ea36e0a805fff3c09a87b08a660997eb701d63dab38111a97ded4fff4af990ddac40f11b05790

  • memory/4596-10-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-11-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-2-0x00007FFF540B0000-0x00007FFF540C0000-memory.dmp

    Filesize

    64KB

  • memory/4596-4-0x00007FFF540B0000-0x00007FFF540C0000-memory.dmp

    Filesize

    64KB

  • memory/4596-6-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-8-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-9-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-15-0x00007FFF52050000-0x00007FFF52060000-memory.dmp

    Filesize

    64KB

  • memory/4596-14-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-13-0x00007FFF52050000-0x00007FFF52060000-memory.dmp

    Filesize

    64KB

  • memory/4596-1-0x00007FFF940CD000-0x00007FFF940CE000-memory.dmp

    Filesize

    4KB

  • memory/4596-0-0x00007FFF540B0000-0x00007FFF540C0000-memory.dmp

    Filesize

    64KB

  • memory/4596-12-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-17-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-19-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-18-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-20-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-16-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-7-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-5-0x00007FFF540B0000-0x00007FFF540C0000-memory.dmp

    Filesize

    64KB

  • memory/4596-44-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-45-0x00007FFF94030000-0x00007FFF94225000-memory.dmp

    Filesize

    2.0MB

  • memory/4596-3-0x00007FFF540B0000-0x00007FFF540C0000-memory.dmp

    Filesize

    64KB