Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/11/2024, 00:40
General
-
Target
6e6c674d5cc7b727661f90019d29578733e3aa791a26747298f4fd1e8fce8cf9.xlsm
-
Size
29KB
-
MD5
3e3a01295ed9448b02ba3f26ad3b142c
-
SHA1
4e592a05b7d687745e245b9d3c8153c7bf80f3ca
-
SHA256
6e6c674d5cc7b727661f90019d29578733e3aa791a26747298f4fd1e8fce8cf9
-
SHA512
4c612b17db67103ad34a5cae43375dd1c39ffe253d24eb86d904b1f47a21ac030b07562a8296dc3638329a982198cc98d5a66f66ac7dd1d3a9c121b64539d5ae
-
SSDEEP
384:RvANFOv+7UaivQ2BNZJibbwBUA6+h4wyqJeAqcctU1jrYsu8HP7jFFtCvI:ZqUtVNZAXby9y+cccS1AsuIjxl
Malware Config
Extracted
https://iqraacfindia.org/wp-admin/dG/
https://he.adar-and-ido.com/wp-admin/xk7D/
https://www.digigoal.fr/wp-admin/VfU0aIj/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6e6c674d5cc7b727661f90019d29578733e3aa791a26747298f4fd1e8fce8cf9.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55fc439891e30be677896468e3818c4cb
SHA1ad2250036759ceea8296dcc170127c836ca963d8
SHA2561632fd93c4299d670b61f53aba7c99db16fbf1debefa77df768612b678176b08
SHA51272159e16872587299f6ae1593a74983a18a3585ba0a4b52d2dda14f5e1e552c5dfb167262302f964348033eeba57476728530ac0c966563b45b96898886401cf
-
Filesize
7KB
MD5ef72a58ea81d84f65a7b20dbee6d0323
SHA1b4799070b7b4188f37f0d78a8ff9ba38a7cc1e34
SHA256b4c2f20aec4feba1478a07529afdccfa13f351224c08c645727fc7acec6c9d8a
SHA512d97dbf9841778c4111a3faad38e4cb660cbc172b921e605398548034b557b38dead0876ca50d804865d7d19a6d18c8d2449949280dde51de9e0d76cc58c3f8eb
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB