Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/11/2024, 21:39
Behavioral task
behavioral1
Sample
de186acb16395ab13e5667112e5339c74c12429b458acee74acbcd0afd198e95.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de186acb16395ab13e5667112e5339c74c12429b458acee74acbcd0afd198e95.xlsm
Resource
win10v2004-20241007-en
General
-
Target
de186acb16395ab13e5667112e5339c74c12429b458acee74acbcd0afd198e95.xlsm
-
Size
38KB
-
MD5
6bb9192199aa0108e00a1c9683b1bc38
-
SHA1
22c792a8f5a588e50604b7f72c20d718144bd369
-
SHA256
de186acb16395ab13e5667112e5339c74c12429b458acee74acbcd0afd198e95
-
SHA512
3adec800b735d17b9067933a596fab486fe67678c3bc85926950884292b04445d07d5c7a2d0c30a2a59dfaacb5d0907c63a4bb8c08b17910de6acbb130bc7d62
-
SSDEEP
768:ZsnACdQR84jOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIX:SA6gvOZZ1ZYpoQ/pMAeVIyP54T
Malware Config
Extracted
https://landingpageis.com/alfacgiapi/IhZmV1LIJwi6O/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2320 3044 regsvr32.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3044 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3044 EXCEL.EXE 3044 EXCEL.EXE 3044 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2320 3044 EXCEL.EXE 32 PID 3044 wrote to memory of 2320 3044 EXCEL.EXE 32 PID 3044 wrote to memory of 2320 3044 EXCEL.EXE 32 PID 3044 wrote to memory of 2320 3044 EXCEL.EXE 32 PID 3044 wrote to memory of 2320 3044 EXCEL.EXE 32 PID 3044 wrote to memory of 2320 3044 EXCEL.EXE 32 PID 3044 wrote to memory of 2320 3044 EXCEL.EXE 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\de186acb16395ab13e5667112e5339c74c12429b458acee74acbcd0afd198e95.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\roil.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54ba662b867ded919a3f4f1ab5df23762
SHA1eba66e5236dde7581568ea24ff78202c09c67173
SHA256b10a76c7908dde4d171cbb920b5f339747c07cbb7d03d8b4385eb08b68759cef
SHA512669a8dd735a99f2ae2240817c2497a6b812e19f3e0ff69b1f12d0f43562512fcb0bcf3d6dbaf1e3a39095afa7fef1d0a2d8126a13061b87b46fb7186b63613da