Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    20/11/2024, 21:57

General

  • Target

    55515c1a89221b1acfb819ed867024dac74f4d4cd254e7a833fc02b84812b63d.xls

  • Size

    47KB

  • MD5

    8b34eab8511cdd95f3c244f88dc6f63c

  • SHA1

    b807eb50ef501d0d1548930eba9d656da9f7730a

  • SHA256

    55515c1a89221b1acfb819ed867024dac74f4d4cd254e7a833fc02b84812b63d

  • SHA512

    dd13cebea40f5cadb470c4fe475b26c99b77b8ce4a1a5f373e6fa172730f16dd4c28faa89887fe490336a879c5b7d5cfe57b5d5b7df7cb6c3a9f8603e765e9d2

  • SSDEEP

    768:yDM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JOiX6DGwUk7qHDSEuRZjiBp5n:y62tfQXi8vgLZkTOHkQT51Vp6AwPe8g1

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://eleselektromekanik.com/69Iq5Pwbd0/s/

xlm40.dropper

https://demo.icn.com.np/stories/Qk/

xlm40.dropper

http://demo34.ckg.hk/service/Atk7RQfUV673M/

xlm40.dropper

https://bitmovil.mx/css/TrgyPiTXy3/

xlm40.dropper

http://dupot.cz/tvhost/DUnMUvwZOhQs/

xlm40.dropper

http://focanainternet.com.br/erros/DepAK3p1Y/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\55515c1a89221b1acfb819ed867024dac74f4d4cd254e7a833fc02b84812b63d.xls
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe ..\wnrul.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\wnrul.ocx

    Filesize

    3KB

    MD5

    cc666088a917dd7f5da8b6689069aec0

    SHA1

    f688de634ccd20939a522391abb5049483e726bd

    SHA256

    332d102987273318f13e7fc89a043613c6dd5dd7eb7d21033a2ab73dd438a405

    SHA512

    77a15aebeb10d355e3723fdebd2ea59a09a60d54f09ab9a6f06c52dbfa3bea0965ff49b7a1c2e6f4ff94f3fe903e6301188de2f80801a8a978c8c09b3356c8dc

  • memory/1776-1-0x000000007226D000-0x0000000072278000-memory.dmp

    Filesize

    44KB

  • memory/1776-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1776-2-0x000000007226D000-0x0000000072278000-memory.dmp

    Filesize

    44KB