Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 00:04
Behavioral task
behavioral1
Sample
48b206fa3001ff4f06394a3ec2c366a9859f5722461511418dbc5585c86bf407.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
48b206fa3001ff4f06394a3ec2c366a9859f5722461511418dbc5585c86bf407.xls
Resource
win10v2004-20241007-en
General
-
Target
48b206fa3001ff4f06394a3ec2c366a9859f5722461511418dbc5585c86bf407.xls
-
Size
60KB
-
MD5
d7636a31f21b3c86bcac82757a3fe351
-
SHA1
3f8fb437e613fb7de41fa4ada398793e66bf6787
-
SHA256
48b206fa3001ff4f06394a3ec2c366a9859f5722461511418dbc5585c86bf407
-
SHA512
206a1e30eef32d43896260460a93a76a6c8570e1b5534bdb20814bac3553c1546b9b2038e5d83159b04c65f787cecf3cb15a00fc3b819b8a15668cba6abe2530
-
SSDEEP
1536:NpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgUDOJiA6Cv/UGLI36yOAR5N:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgQ
Malware Config
Extracted
http://www.valyval.com/pun/VAYL/
http://cabans.com/CeudWYRQEzZgrHPcI/
http://calzadoyuyin.com/cgj-bin/jZPff/
http://cagranus.com/slide/mcqAFuMhaekn/
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1188 4004 regsvr32.exe 82 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 208 4004 regsvr32.exe 82 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 756 4004 regsvr32.exe 82 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2912 4004 regsvr32.exe 82 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4004 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4004 EXCEL.EXE 4004 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4004 wrote to memory of 1188 4004 EXCEL.EXE 87 PID 4004 wrote to memory of 1188 4004 EXCEL.EXE 87 PID 4004 wrote to memory of 208 4004 EXCEL.EXE 98 PID 4004 wrote to memory of 208 4004 EXCEL.EXE 98 PID 4004 wrote to memory of 756 4004 EXCEL.EXE 99 PID 4004 wrote to memory of 756 4004 EXCEL.EXE 99 PID 4004 wrote to memory of 2912 4004 EXCEL.EXE 100 PID 4004 wrote to memory of 2912 4004 EXCEL.EXE 100
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\48b206fa3001ff4f06394a3ec2c366a9859f5722461511418dbc5585c86bf407.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\xgev1.ocx2⤵
- Process spawned unexpected child process
PID:1188
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\xgev2.ocx2⤵
- Process spawned unexpected child process
PID:208
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\xgev3.ocx2⤵
- Process spawned unexpected child process
PID:756
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\xgev4.ocx2⤵
- Process spawned unexpected child process
PID:2912
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5b9e843116a6f5abfe6e02068acae60df
SHA1430a43b946bc6b9b3be4955b8cd2180d467dc9ae
SHA256a00590771cffe181ec37d58de963276c414bd7c45df6dc8d0afe5d7e68b3301b
SHA5129e55de6da5d127565ae17ff3e063b7c2d454eafac4e88bfa3a91799aae7484dbfd8a33260087de6f10f49e381c7b63e0be7840e70c84073cc693d984b19dbb91
-
Filesize
81KB
MD5c6275209939fba5ea75b0c1de220836e
SHA1108bffdc1f9befb8d2e4228cd950a4e04dea06ff
SHA25608fca3a8cbefa68b5ea7ff9ed46d91df7fcf437fcd2ffb141054bf2949c211ae
SHA5127c12c5f1cc205ea9d476e9d7e96dc88018910b9c6c02fe6c1de04e5eb7e03aa5aa0380bb5d403e2a05826be2f833f2c200e8b8ccc6ad55cf6ed09299dfbab04f