Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 21:38
Behavioral task
behavioral1
Sample
69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0.xls
Resource
win10v2004-20241007-en
General
-
Target
69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0.xls
-
Size
47KB
-
MD5
569282d3f4b16dbbf8f08fecb4ed1238
-
SHA1
a68f628dd386eb91153094039747e539559a9354
-
SHA256
69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0
-
SHA512
a88773aed711b960c491411995639acbd3b0e49dadfa28e12701915eb723bfd1f277bb8f6e1f47c0a713d16f300abbeef7d41ea866ccceece10495ba8e499455
-
SSDEEP
768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFG:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gT
Malware Config
Extracted
https://www.escueladecinemza.com.ar/_installation/IBlj/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1004 3184 regsvr32.exe 84 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3184 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3184 EXCEL.EXE 3184 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3184 wrote to memory of 1004 3184 EXCEL.EXE 95 PID 3184 wrote to memory of 1004 3184 EXCEL.EXE 95
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\69df28d8d6fe5462f43d6220a7fd1550b05bf678e63edb53e72c2a80b2117eb0.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe ..\wnrul.ocx2⤵
- Process spawned unexpected child process
PID:1004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize2KB
MD58881bfd671929f232599ceca354fb42e
SHA106198c6b2dc384ffbe3306d3b8330b449af598e7
SHA25605eb76ac5263882b53501f842fe8648c5c03acaf9d4f59748e5ee9a49c3282f6
SHA512a7ae906c2bca6d467153eb94ac540470f3a3075f1b1b897fe4acbede2e3e782a3c394de12ad2e9f7c92f0555fc72be1f6351367caf811ba6cf8712d01ab4e628
-
Filesize
86KB
MD53ffd9a2715e478a2442c309536507f93
SHA11d3a2db3cf0e80f972084f0d83adbf7f77578f75
SHA25635e3dd8043744d5c6ea3f008188d397312d355ada64cbed3b2c641daf28f5ae3
SHA512311c4b871903a69053910b65e01285d181659d1117d9e5332c12ad801a3d9f5087ae7ae9ecfe507121126205bcb5b40debfc6589715b8ccfed6e8e7cfe6317b9