Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/11/2024, 21:38
Behavioral task
behavioral1
Sample
69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0.xls
Resource
win10v2004-20241007-en
General
-
Target
69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0.xls
-
Size
47KB
-
MD5
569282d3f4b16dbbf8f08fecb4ed1238
-
SHA1
a68f628dd386eb91153094039747e539559a9354
-
SHA256
69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0
-
SHA512
a88773aed711b960c491411995639acbd3b0e49dadfa28e12701915eb723bfd1f277bb8f6e1f47c0a713d16f300abbeef7d41ea866ccceece10495ba8e499455
-
SSDEEP
768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFG:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gT
Malware Config
Extracted
https://www.escueladecinemza.com.ar/_installation/IBlj/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1240 2772 regsvr32.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2772 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2772 EXCEL.EXE 2772 EXCEL.EXE 2772 EXCEL.EXE 2772 EXCEL.EXE 2772 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2772 wrote to memory of 1240 2772 EXCEL.EXE 31 PID 2772 wrote to memory of 1240 2772 EXCEL.EXE 31 PID 2772 wrote to memory of 1240 2772 EXCEL.EXE 31 PID 2772 wrote to memory of 1240 2772 EXCEL.EXE 31 PID 2772 wrote to memory of 1240 2772 EXCEL.EXE 31 PID 2772 wrote to memory of 1240 2772 EXCEL.EXE 31 PID 2772 wrote to memory of 1240 2772 EXCEL.EXE 31
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe ..\wnrul.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:1240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD53ffd9a2715e478a2442c309536507f93
SHA11d3a2db3cf0e80f972084f0d83adbf7f77578f75
SHA25635e3dd8043744d5c6ea3f008188d397312d355ada64cbed3b2c641daf28f5ae3
SHA512311c4b871903a69053910b65e01285d181659d1117d9e5332c12ad801a3d9f5087ae7ae9ecfe507121126205bcb5b40debfc6589715b8ccfed6e8e7cfe6317b9