Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/01/2025, 15:26
Behavioral task
behavioral1
Sample
Orden.xls
Resource
win7-20241010-en
General
-
Target
Orden.xls
-
Size
60KB
-
MD5
b599ebf4acf3f137ea8818e3d8e33250
-
SHA1
c96df6824d877a8c29b865bf492868b66e36fc4d
-
SHA256
6cec1f390f674cb7808f727c4c1e147cc35728aada372e22a72a1a2a75c1c982
-
SHA512
fd70ab2a4f43dc3d5fc6614a9f1664c056b665399f007c25d42664feeee95891fc74709ecebc486b49f99e0a8eefefca93a90dacf62054ea6e13bd5726591f21
-
SSDEEP
1536:+nxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAZ6/EmoP+Lszm:+nxEtjPOtioVjDGUU1qfDlaGGx+cL2Qt
Malware Config
Extracted
lokibot
http://46.183.222.162/jcxgfhgsf/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Downloads MZ/PE file 1 IoCs
flow pid Process 3 3012 EXCEL.EXE -
Executes dropped EXE 3 IoCs
pid Process 2840 ZHRSW.exe 1472 ZHRSW.exe 2548 ZHRSW.exe -
Loads dropped DLL 4 IoCs
pid Process 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ZHRSW.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook ZHRSW.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ZHRSW.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2840 set thread context of 1472 2840 ZHRSW.exe 32 PID 2840 set thread context of 2548 2840 ZHRSW.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZHRSW.exe -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3012 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2840 ZHRSW.exe Token: SeDebugPrivilege 1472 ZHRSW.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2840 3012 EXCEL.EXE 30 PID 3012 wrote to memory of 2840 3012 EXCEL.EXE 30 PID 3012 wrote to memory of 2840 3012 EXCEL.EXE 30 PID 3012 wrote to memory of 2840 3012 EXCEL.EXE 30 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 1472 2840 ZHRSW.exe 32 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 PID 2840 wrote to memory of 2548 2840 ZHRSW.exe 33 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ZHRSW.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ZHRSW.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Orden.xls1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\ZHRSW.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\ZHRSW.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\ZHRSW.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\ZHRSW.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1472
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\ZHRSW.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\ZHRSW.exe"3⤵
- Executes dropped EXE
PID:2548
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3692679935-4019334568-335155002-1000\0f5007522459c86e95ffcc62f32308f1_6110149a-fcf0-442a-a749-601093ba4822
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3692679935-4019334568-335155002-1000\0f5007522459c86e95ffcc62f32308f1_6110149a-fcf0-442a-a749-601093ba4822
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
Filesize
381KB
MD52def95f27b211db3c3998f796c98c830
SHA13f796c6d4eeda8aa797585ae06ecc906b8162941
SHA256177d57510fc53694f024c276d3173cc1ee7d4997038a25931526c592e400c666
SHA512d650ae1736a8adb7eb4278062f68fefe17717bb193492b2bc455e8b14d6baae590683cd26c602e28e59d123b4124032688bc2df4ef4c662e5a4f3dbbaae69ff6