Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
2024.12.31止尾款结算对账核对表xlsx.exe
Resource
win7-20240903-en
General
-
Target
2024.12.31止尾款结算对账核对表xlsx.exe
-
Size
1.0MB
-
MD5
33961801df7df4040fb2282d6103286c
-
SHA1
1c0b29fa3a333974788a71c896e30f38e2bf3769
-
SHA256
782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a
-
SHA512
0d7a73ff1312de597fc71d3d5d0dda34e326ad2268a762695487547361a734568f21f1d0856dd9a502b704a9d5caa7ebc547baa329dc0f906ec003ca23dbd44a
-
SSDEEP
24576:CMjhKbkkc7tiPbWJF9WUqMFWsRvtciqgQRgOD39wKX:RI4kOtiTQWU4SciuRgC9T
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 656 2024.12.31止尾款结算对账核对表xlsx.tmp 2768 2024.12.31止尾款结算对账核对表xlsx.tmp -
Loads dropped DLL 8 IoCs
pid Process 1644 2024.12.31止尾款结算对账核对表xlsx.exe 656 2024.12.31止尾款结算对账核对表xlsx.tmp 656 2024.12.31止尾款结算对账核对表xlsx.tmp 1332 2024.12.31止尾款结算对账核对表xlsx.exe 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 2744 regsvr32.exe 2648 regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2244 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 2768 2024.12.31止尾款结算对账核对表xlsx.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2768 2024.12.31止尾款结算对账核对表xlsx.tmp -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 1644 wrote to memory of 656 1644 2024.12.31止尾款结算对账核对表xlsx.exe 30 PID 1644 wrote to memory of 656 1644 2024.12.31止尾款结算对账核对表xlsx.exe 30 PID 1644 wrote to memory of 656 1644 2024.12.31止尾款结算对账核对表xlsx.exe 30 PID 1644 wrote to memory of 656 1644 2024.12.31止尾款结算对账核对表xlsx.exe 30 PID 1644 wrote to memory of 656 1644 2024.12.31止尾款结算对账核对表xlsx.exe 30 PID 1644 wrote to memory of 656 1644 2024.12.31止尾款结算对账核对表xlsx.exe 30 PID 1644 wrote to memory of 656 1644 2024.12.31止尾款结算对账核对表xlsx.exe 30 PID 656 wrote to memory of 2924 656 2024.12.31止尾款结算对账核对表xlsx.tmp 31 PID 656 wrote to memory of 2924 656 2024.12.31止尾款结算对账核对表xlsx.tmp 31 PID 656 wrote to memory of 2924 656 2024.12.31止尾款结算对账核对表xlsx.tmp 31 PID 656 wrote to memory of 2924 656 2024.12.31止尾款结算对账核对表xlsx.tmp 31 PID 2924 wrote to memory of 2244 2924 cmd.exe 33 PID 2924 wrote to memory of 2244 2924 cmd.exe 33 PID 2924 wrote to memory of 2244 2924 cmd.exe 33 PID 2924 wrote to memory of 2244 2924 cmd.exe 33 PID 2924 wrote to memory of 1332 2924 cmd.exe 34 PID 2924 wrote to memory of 1332 2924 cmd.exe 34 PID 2924 wrote to memory of 1332 2924 cmd.exe 34 PID 2924 wrote to memory of 1332 2924 cmd.exe 34 PID 2924 wrote to memory of 1332 2924 cmd.exe 34 PID 2924 wrote to memory of 1332 2924 cmd.exe 34 PID 2924 wrote to memory of 1332 2924 cmd.exe 34 PID 1332 wrote to memory of 2768 1332 2024.12.31止尾款结算对账核对表xlsx.exe 35 PID 1332 wrote to memory of 2768 1332 2024.12.31止尾款结算对账核对表xlsx.exe 35 PID 1332 wrote to memory of 2768 1332 2024.12.31止尾款结算对账核对表xlsx.exe 35 PID 1332 wrote to memory of 2768 1332 2024.12.31止尾款结算对账核对表xlsx.exe 35 PID 1332 wrote to memory of 2768 1332 2024.12.31止尾款结算对账核对表xlsx.exe 35 PID 1332 wrote to memory of 2768 1332 2024.12.31止尾款结算对账核对表xlsx.exe 35 PID 1332 wrote to memory of 2768 1332 2024.12.31止尾款结算对账核对表xlsx.exe 35 PID 2768 wrote to memory of 2744 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 36 PID 2768 wrote to memory of 2744 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 36 PID 2768 wrote to memory of 2744 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 36 PID 2768 wrote to memory of 2744 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 36 PID 2768 wrote to memory of 2744 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 36 PID 2768 wrote to memory of 2744 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 36 PID 2768 wrote to memory of 2744 2768 2024.12.31止尾款结算对账核对表xlsx.tmp 36 PID 2744 wrote to memory of 2648 2744 regsvr32.exe 37 PID 2744 wrote to memory of 2648 2744 regsvr32.exe 37 PID 2744 wrote to memory of 2648 2744 regsvr32.exe 37 PID 2744 wrote to memory of 2648 2744 regsvr32.exe 37 PID 2744 wrote to memory of 2648 2744 regsvr32.exe 37 PID 2744 wrote to memory of 2648 2744 regsvr32.exe 37 PID 2744 wrote to memory of 2648 2744 regsvr32.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\is-MD45U.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp"C:\Users\Admin\AppData\Local\Temp\is-MD45U.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp" /SL5="$400E0,702433,203776,C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2244
-
-
C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\is-3BA9U.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp"C:\Users\Admin\AppData\Local\Temp\is-3BA9U.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp" /SL5="$301EA,702433,203776,C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\system32\regsvr32.exe/s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"7⤵
- Loads dropped DLL
PID:2648
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5f7af43ee4b917ecc5051c5cb3a0ffe5c
SHA1786c74765b5121ab1fa431fc02d8dfd54eae9458
SHA256a43e88349c0757c3f122657e6696becde5316f9c31764eaee04e722a87f4b15b
SHA5126d7872e536e1c4aad3dc06f3d244c2f40bfe2dda417c7555b2387b98fe9bab88654db05ba9dfeadd29959cf9c44a16205e6a95d3465fbda77e6c95344a09b5b7
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.2MB
MD575c6fbc94f75010aebb8c0c11a646fcc
SHA100de6a9f9b02ac9e24db302fc705420740ca9029
SHA256ba9099f858da9b41bae8a46ca4b8a61b099a18cdbf43bcd3a2c31c0b8e30bede
SHA512e7f8d81d430258a3ddb07e2798cceb2a8cdd2e3150cdce8e88b745dfdf14f3491076212256a7d3c1b43217c47dd182c9822b4e9da34dbcf7760cbf05d525602b