Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 21:55

General

  • Target

    5eb7be9b041c540ea9df794dead79f02a091afb020f4cf745186d08b916933b0.xlsm

  • Size

    40KB

  • MD5

    ce495c94862e6dee6bfe9074c5164297

  • SHA1

    95ccf304252f0f87dd92e804fdc88977d1573c32

  • SHA256

    5eb7be9b041c540ea9df794dead79f02a091afb020f4cf745186d08b916933b0

  • SHA512

    3523517a3272297e69895a15de67129cd6fb3667ae057f01e621c902e10054330d961eae8513c1feb664b94497762083ced68f3ecfd23d5be4be13fcc40b7e28

  • SSDEEP

    768:mbomCS/DOevZCwt7OyKfcrND59V+L9Rw4eWrXcTqZ0VfddDhw:Oomd/DmylND59V4jwmXc2CVfdxi

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://linkmys.com/stats/nnF/

xlm40.dropper

https://livejagat.com/h/UDwLU4FTwf/

xlm40.dropper

https://ticsnp.azurewebsites.net/anko-agust/treN2T/

xlm40.dropper

https://paintingsouq.com/l93mxsk/Ich7kJF7n3Fu5v/

xlm40.dropper

https://sanvicente.group/wp-content/dBsh5232WHIsiwyQAln/

xlm40.dropper

https://novinex.net/wp-admin/p9FV5/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5eb7be9b041c540ea9df794dead79f02a091afb020f4cf745186d08b916933b0.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    2cde49b26c423d946ce0e0a309e110db

    SHA1

    d6002e25eb35a010ff7be6ed72f2846eadacfd29

    SHA256

    67e082ae3edf6546e915c36ea963841d9a96646faef964c98149963b3bc8ec80

    SHA512

    8151ff1754155798ecfd7002769dda2684b1b2b9e349b215f8013bae7e3ce3855028e9e923cb515652001a078e5f798baacc3c46c56b7152d043b2b2bc58f7a6

  • memory/2988-13-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-4-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

    Filesize

    64KB

  • memory/2988-2-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

    Filesize

    64KB

  • memory/2988-1-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

    Filesize

    64KB

  • memory/2988-6-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-5-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-7-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

    Filesize

    64KB

  • memory/2988-10-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-0-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

    Filesize

    64KB

  • memory/2988-14-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-11-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-12-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-15-0x00007FFA3A950000-0x00007FFA3A960000-memory.dmp

    Filesize

    64KB

  • memory/2988-9-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-8-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-16-0x00007FFA3A950000-0x00007FFA3A960000-memory.dmp

    Filesize

    64KB

  • memory/2988-17-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-40-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-41-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

    Filesize

    2.0MB

  • memory/2988-3-0x00007FFA7C9CD000-0x00007FFA7C9CE000-memory.dmp

    Filesize

    4KB