Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 22:39
Behavioral task
behavioral1
Sample
e05ae88fdae10ca621f0a49ce9278d1f677004358beae1450cea0cd7b442aae8.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e05ae88fdae10ca621f0a49ce9278d1f677004358beae1450cea0cd7b442aae8.xlsm
Resource
win10v2004-20241007-en
General
-
Target
e05ae88fdae10ca621f0a49ce9278d1f677004358beae1450cea0cd7b442aae8.xlsm
-
Size
40KB
-
MD5
c0b0fa3a9fe1a94c0ca1f2ac1353d57d
-
SHA1
e52e0f919d08efc0fc3a076a887a2bbb6f46b2ca
-
SHA256
e05ae88fdae10ca621f0a49ce9278d1f677004358beae1450cea0cd7b442aae8
-
SHA512
4d3169ecfa3717c223324290739d3aea37ea6d729fc64af444ff6170aa85bac296b0b714a3d8c9dc255f76f33c7422deea55400bc6e5082b4cae58c093e3323c
-
SSDEEP
768:qXomZDOevZCwtvyKfcrND59V+L9Rw4eWrXcTqZ0VPH+t:2omZDzylND59V4jwmXc2CVPu
Malware Config
Extracted
http://radiomedenine.com/kidfngb/h3a3D5WRS/
https://mobapkapps.com/wp-includes/JcEqRwhEw0/
https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/
https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/
https://deine-bewerbung.com/wp-content/HHotdOzCFlW/
https://wewin21.com/wp-content/NITdYcwbO3C1uJd/
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2428 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\e05ae88fdae10ca621f0a49ce9278d1f677004358beae1450cea0cd7b442aae8.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2428