Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 21:53
Behavioral task
behavioral1
Sample
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f.xlsm
Resource
win10v2004-20241007-en
General
-
Target
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f.xlsm
-
Size
38KB
-
MD5
4099c8ad062e5995a4c8857876b964c3
-
SHA1
ccd142be7d0eb568b6220dbd7e7bc52d9ddf3366
-
SHA256
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f
-
SHA512
d711aa5af9c76231fe640b97f0fd76f7db9571d18aec2624b0fda6b2613360616cabad9b8ceadb104edd2f44aa7c3f0863a53a0ca02754ef07e33287d9520890
-
SSDEEP
768:2bdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:uwDOZZ1ZYpoQ/pMAeVIyYzaT
Malware Config
Extracted
https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/
https://risamfg.com/wp-admin/JtqFQW/
https://thailand-rocco.com/wp-content/gE7UvFwLh/
https://pregy.org/test/rXTl1DEv0CWCE/
https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/
https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/
https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3648 2816 regsvr32.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2816 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE 2816 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2816 wrote to memory of 3648 2816 EXCEL.EXE 102 PID 2816 wrote to memory of 3648 2816 EXCEL.EXE 102 PID 2816 wrote to memory of 3648 2816 EXCEL.EXE 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:3648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize3KB
MD517a148b932404ee06ce6933702aaf8b1
SHA1e0e4d2b344ee7fe7cb2ea194cf631945476de528
SHA2560a2a624d5760221d20823b983270aef83b0392bbf8f88f9702a26fef46ad2243
SHA512ccf1ad6d479101a82cd36b673c48df5c6108500bb7e725123f61fd754eb9eebe9a605d1da27aad7a4c18b4abd8613bc769def66ac4a8837687656d07712c0ec3