Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 23:07

General

  • Target

    e415540a80c90a58bafcacd615a2f3ffb72779732087c6dea42625199b013f2c.xlsm

  • Size

    40KB

  • MD5

    ef9d311612e0afd8d4050da7b83b810f

  • SHA1

    f5e0fae33e0e0efa4e347e690bbc9d1379dda639

  • SHA256

    e415540a80c90a58bafcacd615a2f3ffb72779732087c6dea42625199b013f2c

  • SHA512

    c9df02e01e27bc076abfb9070917cb0dbf5eeee9ad11d969d7aadeea15568f658044d665cc10a4287102d302da8627a9ef5e9dd8de3f473496f66f7d2028bff6

  • SSDEEP

    768:i9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:i9oms7tylND59V4jwmXc2RVfW+

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://queaventurasathya.com/licenses/r903sDTMHYLyn8ykMU/

xlm40.dropper

https://escuelageneraljosedesanmartin.com/tmp/5vJR7J/

xlm40.dropper

https://indianbusinessclub.org/wtzrlyx/Nfisb7Le5JH/

xlm40.dropper

https://cartelac.pt/wp-includes/VJMcayYWquGgVAGa/

xlm40.dropper

https://axial-ing.fr/old/98WgLPFy5u2Xf/

xlm40.dropper

https://luape.es/wp-admin/moJpURVz/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e415540a80c90a58bafcacd615a2f3ffb72779732087c6dea42625199b013f2c.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    d5b62dfcb686556875ec98a47646a9b6

    SHA1

    04af5bb7e04d9366202f127d59fe7b08ff321339

    SHA256

    65be7f9770056188ebcba0d083321f06ea7fbee1856fcf9675459eef58f45467

    SHA512

    5785ee8d9a9d4484f1b4b364fe7edd76ce90b9c6d50c48dba73cc6002567f937baf42c6b9033e847e21220bd1277e5f419b13d5c4f3fe0bf86885dc86263fcae

  • memory/3440-10-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-38-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-2-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

    Filesize

    64KB

  • memory/3440-5-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

    Filesize

    64KB

  • memory/3440-4-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

    Filesize

    64KB

  • memory/3440-8-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-7-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-11-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-13-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-12-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-14-0x00007FF9DFFC0000-0x00007FF9DFFD0000-memory.dmp

    Filesize

    64KB

  • memory/3440-1-0x00007FFA2206D000-0x00007FFA2206E000-memory.dmp

    Filesize

    4KB

  • memory/3440-3-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

    Filesize

    64KB

  • memory/3440-16-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-9-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-6-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-17-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-18-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-19-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-20-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-37-0x00007FFA2206D000-0x00007FFA2206E000-memory.dmp

    Filesize

    4KB

  • memory/3440-15-0x00007FF9DFFC0000-0x00007FF9DFFD0000-memory.dmp

    Filesize

    64KB

  • memory/3440-39-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-40-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-0-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

    Filesize

    64KB