Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 21:57

General

  • Target

    55515c1a89221b1acfb819ed867024dac74f4d4cd254e7a833fc02b84812b63d.xls

  • Size

    47KB

  • MD5

    8b34eab8511cdd95f3c244f88dc6f63c

  • SHA1

    b807eb50ef501d0d1548930eba9d656da9f7730a

  • SHA256

    55515c1a89221b1acfb819ed867024dac74f4d4cd254e7a833fc02b84812b63d

  • SHA512

    dd13cebea40f5cadb470c4fe475b26c99b77b8ce4a1a5f373e6fa172730f16dd4c28faa89887fe490336a879c5b7d5cfe57b5d5b7df7cb6c3a9f8603e765e9d2

  • SSDEEP

    768:yDM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JOiX6DGwUk7qHDSEuRZjiBp5n:y62tfQXi8vgLZkTOHkQT51Vp6AwPe8g1

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://eleselektromekanik.com/69Iq5Pwbd0/s/

xlm40.dropper

https://demo.icn.com.np/stories/Qk/

xlm40.dropper

http://demo34.ckg.hk/service/Atk7RQfUV673M/

xlm40.dropper

https://bitmovil.mx/css/TrgyPiTXy3/

xlm40.dropper

http://dupot.cz/tvhost/DUnMUvwZOhQs/

xlm40.dropper

http://focanainternet.com.br/erros/DepAK3p1Y/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\55515c1a89221b1acfb819ed867024dac74f4d4cd254e7a833fc02b84812b63d.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe ..\wnrul.ocx
      2⤵
      • Process spawned unexpected child process
      PID:1504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\wnrul.ocx

    Filesize

    3KB

    MD5

    cc666088a917dd7f5da8b6689069aec0

    SHA1

    f688de634ccd20939a522391abb5049483e726bd

    SHA256

    332d102987273318f13e7fc89a043613c6dd5dd7eb7d21033a2ab73dd438a405

    SHA512

    77a15aebeb10d355e3723fdebd2ea59a09a60d54f09ab9a6f06c52dbfa3bea0965ff49b7a1c2e6f4ff94f3fe903e6301188de2f80801a8a978c8c09b3356c8dc

  • memory/2316-11-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-0-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

    Filesize

    64KB

  • memory/2316-2-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

    Filesize

    64KB

  • memory/2316-5-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-6-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-4-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

    Filesize

    64KB

  • memory/2316-7-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-9-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-8-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

    Filesize

    64KB

  • memory/2316-10-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-14-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-13-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-15-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-16-0x00007FFD1C0E0000-0x00007FFD1C0F0000-memory.dmp

    Filesize

    64KB

  • memory/2316-3-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

    Filesize

    64KB

  • memory/2316-12-0x00007FFD1C0E0000-0x00007FFD1C0F0000-memory.dmp

    Filesize

    64KB

  • memory/2316-36-0x00007FFD5E3CD000-0x00007FFD5E3CE000-memory.dmp

    Filesize

    4KB

  • memory/2316-35-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-1-0x00007FFD5E3CD000-0x00007FFD5E3CE000-memory.dmp

    Filesize

    4KB

  • memory/2316-37-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-41-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-42-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-40-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-39-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-38-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-43-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-45-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-47-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-46-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-44-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB

  • memory/2316-51-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

    Filesize

    2.0MB