Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 21:45

General

  • Target

    9efd0d62962b1325fb2912927cfacce83438c36364139299374a5410c3a47977.xls

  • Size

    61KB

  • MD5

    2a0a228c93e6a791f1a88873d3b2e0b3

  • SHA1

    9816e445f426f184ff20adcd2853eda581216822

  • SHA256

    9efd0d62962b1325fb2912927cfacce83438c36364139299374a5410c3a47977

  • SHA512

    f69f0079cf57e07fefdcbbfd760de63ed43744b2a31b4559b86a1aadf6b1dbb652100b0c4c85c10369a09dacfcc1632bba057511e790b8ea979296310722817b

  • SSDEEP

    1536:sp+KpbdrHYrMue8q7QPX+5xtekEdi8/dgJ5+4kKF3XOCmGanK8oWIq:sIKpbdrHYrMue8q7QPX+5xtekEdi8/dP

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://littlesweet.co.uk/wp-admin/vko/

xlm40.dropper

https://stratuswebsolutions.co.nz/wp-content/wyEEj5jH8xq50rp1/

xlm40.dropper

http://wvfsbrasil.com.br/Acrasieae/LIYNOqCthfZuCWQz3/

xlm40.dropper

https://lydt.cc/wp-includes/6sfYo/

xlm40.dropper

http://lpm.fk.ub.ac.id/Fox-C/faKwS6p6/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9efd0d62962b1325fb2912927cfacce83438c36364139299374a5410c3a47977.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    d8975f0989980a3baed16de0fcb0d18f

    SHA1

    a6d1db7fde6d02adb2b5408ed072fd87be24dc06

    SHA256

    1fdc691ba8ba2a75d59c4ade8e4a91145ccb662a8ff64170c221cc3a143a2ac8

    SHA512

    5cce466f17c8508cc3a164e80127d6c56a98a04913c5233e8d5c5f7d67a0cf7ddf565a4a777b2f44eeb08c788f1eb0e93fc802fe2a8d8296be8a31d2ef673c60

  • memory/2240-15-0x00007FFD9A0E0000-0x00007FFD9A0F0000-memory.dmp

    Filesize

    64KB

  • memory/2240-35-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-5-0x00007FFD9C970000-0x00007FFD9C980000-memory.dmp

    Filesize

    64KB

  • memory/2240-2-0x00007FFD9C970000-0x00007FFD9C980000-memory.dmp

    Filesize

    64KB

  • memory/2240-1-0x00007FFDDC98D000-0x00007FFDDC98E000-memory.dmp

    Filesize

    4KB

  • memory/2240-11-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-10-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-9-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-14-0x00007FFD9A0E0000-0x00007FFD9A0F0000-memory.dmp

    Filesize

    64KB

  • memory/2240-13-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-12-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-0-0x00007FFD9C970000-0x00007FFD9C980000-memory.dmp

    Filesize

    64KB

  • memory/2240-4-0x00007FFD9C970000-0x00007FFD9C980000-memory.dmp

    Filesize

    64KB

  • memory/2240-8-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-19-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-22-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-21-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-20-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-16-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-18-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-7-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-6-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-17-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-36-0x00007FFDDC98D000-0x00007FFDDC98E000-memory.dmp

    Filesize

    4KB

  • memory/2240-37-0x00007FFDDC8F0000-0x00007FFDDCAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2240-3-0x00007FFD9C970000-0x00007FFD9C980000-memory.dmp

    Filesize

    64KB