Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/11/2024, 22:14

General

  • Target

    801bc508ee3e79c02718261919ef99fef9be96e469ee781638e71740fcb80b87.xlsm

  • Size

    20KB

  • MD5

    264085a18e691e70013e1fef23855ad4

  • SHA1

    b167b60aa513a30ba39490e357cb9b57430f9b80

  • SHA256

    801bc508ee3e79c02718261919ef99fef9be96e469ee781638e71740fcb80b87

  • SHA512

    d8b0d7af373f75a5d4b79e44b2a333841858a66c6fb315fee51879e35c5b47c14b37eefd12969380b0ddf75e4ffa0cf0240a708804a3f8b979fbe23a10767263

  • SSDEEP

    384:uHM0Vb1GNjDo4CGzPd6ZIwA1hKb5CzgObff9kC+xbX7qE7h:T0INfo4FLH2CBn9kC+xbLq+

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://canismallorca.es/wp-admin/OTyeYrx9C9BvYvVb3/

xlm40.dropper

http://capslock.co.za/wp-includes/LMngUUTuanBofr5zK/

xlm40.dropper

http://www.cafe-kwebbel.nl/layouts/3Wkev/

xlm40.dropper

http://bkps.ac.th/b91-std63/Ixv52m8gu4aaUiyb/

xlm40.dropper

http://borbajardinagem.com.br/erros/vlB3f6XpsZG/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\801bc508ee3e79c02718261919ef99fef9be96e469ee781638e71740fcb80b87.xlsm
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\kytk.dll

    Filesize

    3KB

    MD5

    cc666088a917dd7f5da8b6689069aec0

    SHA1

    f688de634ccd20939a522391abb5049483e726bd

    SHA256

    332d102987273318f13e7fc89a043613c6dd5dd7eb7d21033a2ab73dd438a405

    SHA512

    77a15aebeb10d355e3723fdebd2ea59a09a60d54f09ab9a6f06c52dbfa3bea0965ff49b7a1c2e6f4ff94f3fe903e6301188de2f80801a8a978c8c09b3356c8dc

  • memory/2460-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2460-1-0x00000000724DD000-0x00000000724E8000-memory.dmp

    Filesize

    44KB

  • memory/2460-7-0x00000000724DD000-0x00000000724E8000-memory.dmp

    Filesize

    44KB