Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2024, 21:35

General

  • Target

    7886885fd08fcaa4b173e0b0dd06752926b872eb5f8ee191e25bf936cb6aedc2.xls

  • Size

    45KB

  • MD5

    5c00c538a4692acfac72ade253d3a3f9

  • SHA1

    92152d8cdf87dc60b1505b5cc6792cc67cac478e

  • SHA256

    7886885fd08fcaa4b173e0b0dd06752926b872eb5f8ee191e25bf936cb6aedc2

  • SHA512

    44d4f310106730f198062ef64465d69f8c560d132ed0ac8883d9a58904a860ab83740f9397890d4ebc699068ce44411dbc775588b063293a207e9cff04bb455e

  • SSDEEP

    768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJlV:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/d9

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://fpd.cl/cgi-bin/83E0xgTMc/

xlm40.dropper

https://el-energiaki.gr/wp-content/plugins/really-simple-ssl/testssl/serverport443/WUV5PJA/

xlm40.dropper

https://www.manchesterslt.co.uk/a-to-z-of-slt/Ntrci3Ry/

xlm40.dropper

http://contactworks.nl/layouts/fFxKZabh/

xlm40.dropper

http://baykusoglu.com.tr/wp-admin/Y3sRBcOfZ34wg2sO/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\7886885fd08fcaa4b173e0b0dd06752926b872eb5f8ee191e25bf936cb6aedc2.xls
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe ..\xdwno.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:1316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabF2DA.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF389.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\xdwno.ocx

    Filesize

    25KB

    MD5

    8cd3c109905ddb9afe61a50b08309b04

    SHA1

    e102c758a1df661078e4f94daa92547aeb438126

    SHA256

    f531beb78f404dce76f46154b9a79744d3b6341f30cc42edd2b83ab69c154d20

    SHA512

    9720ca0830540ea301f907568e6607d32766b95a08e2589f9d27c4cecaba78b044c19bfbfa755614da715a7bb7586836d8453c34f2852f5222584fb61be80b57

  • memory/1628-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1628-1-0x000000007295D000-0x0000000072968000-memory.dmp

    Filesize

    44KB

  • memory/1628-63-0x000000007295D000-0x0000000072968000-memory.dmp

    Filesize

    44KB