Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/11/2024, 21:20
Behavioral task
behavioral1
Sample
41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55.xlsm
Resource
win10v2004-20241007-en
General
-
Target
41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55.xlsm
-
Size
20KB
-
MD5
23218a235b0feb7477598fb1e730b46f
-
SHA1
26d9dcf5ba8c5c743f2aff0eddff8a4294d02439
-
SHA256
41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55
-
SHA512
859cdf08cf8cf2abd8efa8c6c8cd96cafd08e4f74fc73ce089d1dafc5cbdf1be707d85dd9bdbad1dc4b63f02b0d0177be7066d19e88ff666b64c07f52ec961d2
-
SSDEEP
384:GKAVb1GNjYTo4CGzPd6ZIwL0AOKb5CzgObff9kC+xbX7jvIv:GKYINmo4FLyCBn9kC+xbLA
Malware Config
Extracted
https://www.manchesterslt.co.uk/a-to-z-of-slt/9wq2ESVcG/
http://festival.artdialog.ch/contact/RGhcwH4DRBM/
http://bramynapilota.com.pl/wp-admin/NHk/
http://brwconsultoria.com.br/img/Vl0i9o/
http://buildershyper.co.za/s6Oe/
http://business-tailor.nl/ww12/Kz7GjU/
https://eephysiotherapy.co.uk/blog/mn1d1JScv1CIg4aTy/
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2384 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2384 EXCEL.EXE 2384 EXCEL.EXE 2384 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2384