Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 22:14
Behavioral task
behavioral1
Sample
801bc508ee3e79c02718261919ef99fef9be96e469ee781638e71740fcb80b87.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
801bc508ee3e79c02718261919ef99fef9be96e469ee781638e71740fcb80b87.xlsm
Resource
win10v2004-20241007-en
General
-
Target
801bc508ee3e79c02718261919ef99fef9be96e469ee781638e71740fcb80b87.xlsm
-
Size
20KB
-
MD5
264085a18e691e70013e1fef23855ad4
-
SHA1
b167b60aa513a30ba39490e357cb9b57430f9b80
-
SHA256
801bc508ee3e79c02718261919ef99fef9be96e469ee781638e71740fcb80b87
-
SHA512
d8b0d7af373f75a5d4b79e44b2a333841858a66c6fb315fee51879e35c5b47c14b37eefd12969380b0ddf75e4ffa0cf0240a708804a3f8b979fbe23a10767263
-
SSDEEP
384:uHM0Vb1GNjDo4CGzPd6ZIwA1hKb5CzgObff9kC+xbX7qE7h:T0INfo4FLH2CBn9kC+xbLq+
Malware Config
Extracted
https://canismallorca.es/wp-admin/OTyeYrx9C9BvYvVb3/
http://capslock.co.za/wp-includes/LMngUUTuanBofr5zK/
http://www.cafe-kwebbel.nl/layouts/3Wkev/
http://bkps.ac.th/b91-std63/Ixv52m8gu4aaUiyb/
http://borbajardinagem.com.br/erros/vlB3f6XpsZG/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2724 2460 regsvr32.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2460 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2724 2460 EXCEL.EXE 32 PID 2460 wrote to memory of 2724 2460 EXCEL.EXE 32 PID 2460 wrote to memory of 2724 2460 EXCEL.EXE 32 PID 2460 wrote to memory of 2724 2460 EXCEL.EXE 32 PID 2460 wrote to memory of 2724 2460 EXCEL.EXE 32 PID 2460 wrote to memory of 2724 2460 EXCEL.EXE 32 PID 2460 wrote to memory of 2724 2460 EXCEL.EXE 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\801bc508ee3e79c02718261919ef99fef9be96e469ee781638e71740fcb80b87.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5cc666088a917dd7f5da8b6689069aec0
SHA1f688de634ccd20939a522391abb5049483e726bd
SHA256332d102987273318f13e7fc89a043613c6dd5dd7eb7d21033a2ab73dd438a405
SHA51277a15aebeb10d355e3723fdebd2ea59a09a60d54f09ab9a6f06c52dbfa3bea0965ff49b7a1c2e6f4ff94f3fe903e6301188de2f80801a8a978c8c09b3356c8dc