Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 21:53
Behavioral task
behavioral1
Sample
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f.xlsm
Resource
win10v2004-20241007-en
General
-
Target
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f.xlsm
-
Size
38KB
-
MD5
4099c8ad062e5995a4c8857876b964c3
-
SHA1
ccd142be7d0eb568b6220dbd7e7bc52d9ddf3366
-
SHA256
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f
-
SHA512
d711aa5af9c76231fe640b97f0fd76f7db9571d18aec2624b0fda6b2613360616cabad9b8ceadb104edd2f44aa7c3f0863a53a0ca02754ef07e33287d9520890
-
SSDEEP
768:2bdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:uwDOZZ1ZYpoQ/pMAeVIyYzaT
Malware Config
Extracted
https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/
https://risamfg.com/wp-admin/JtqFQW/
https://thailand-rocco.com/wp-content/gE7UvFwLh/
https://pregy.org/test/rXTl1DEv0CWCE/
https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/
https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/
https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2072 1996 regsvr32.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1996 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1996 EXCEL.EXE 1996 EXCEL.EXE 1996 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2072 1996 EXCEL.EXE 32 PID 1996 wrote to memory of 2072 1996 EXCEL.EXE 32 PID 1996 wrote to memory of 2072 1996 EXCEL.EXE 32 PID 1996 wrote to memory of 2072 1996 EXCEL.EXE 32 PID 1996 wrote to memory of 2072 1996 EXCEL.EXE 32 PID 1996 wrote to memory of 2072 1996 EXCEL.EXE 32 PID 1996 wrote to memory of 2072 1996 EXCEL.EXE 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2072
-