Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/11/2024, 23:04

General

  • Target

    103ba9f15e2da46a4ff8be0e05b0a45c21a94a5a72d0042fe791b81a677f6787.xlsm

  • Size

    95KB

  • MD5

    b8ef30e42daf23205594b91d18714f12

  • SHA1

    f175735d8b57549094a99ceebb4a154e06fdf1d4

  • SHA256

    103ba9f15e2da46a4ff8be0e05b0a45c21a94a5a72d0042fe791b81a677f6787

  • SHA512

    fa5e670cf4e3c523516a297810da289f6c2882ba3d7cf6ae1433b841603a17777dee02bab5b9c2f6bfe84c05a43cd86cc137d6e4128d7faf2d64c780e460252d

  • SSDEEP

    1536:sQxfGWXG8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVFfw:s2318DsVhonV69o2bchgGaWBcpA+fw

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/

xlm40.dropper

https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/

xlm40.dropper

https://forfreeiptv.com/wp-admin/s5Oxoskqv8/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\103ba9f15e2da46a4ff8be0e05b0a45c21a94a5a72d0042fe791b81a677f6787.xlsm
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\dw1.ocx

    Filesize

    497B

    MD5

    bd4e1ad2e26d979a673057562d292182

    SHA1

    f439b2ac1cf5de437c34272f10e746355fee0a36

    SHA256

    29377cec8db2b3a986799c88f8e3fe7ae435cd8d7b9eb67368aff0b137c2a766

    SHA512

    5e5023fc5da5bc374dada3e8c889d6e0a9f9f6de2c17d3cad4e5e981611d766c0b0b21a3adeedf1d3b85e82d27af20ea8fd38719c5b7d372b8725415c29d0fab

  • memory/3036-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/3036-1-0x000000007289D000-0x00000000728A8000-memory.dmp

    Filesize

    44KB

  • memory/3036-26-0x000000007289D000-0x00000000728A8000-memory.dmp

    Filesize

    44KB