Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
138s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08/07/2020, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
fax_3123.xls
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fax_3123.xls
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
fax_3123.xls
-
Size
144KB
-
MD5
ae6cec0d6053f9dc4f6f93a5615001fc
-
SHA1
34639c2f8d2933f7cef1a99b5f3d8996d718e941
-
SHA256
1615c46ae8e9b2f243ed4e124edffeea4cd452fd5a2ad92b496260e1c963ae86
-
SHA512
a83dd1e7b04f7f6d0528982200a31b21dd78cfff0a143d189be2aa0044f41d0e1d75ce4ef9ca2b6442ebbd407a9571be005ebc8518d391dfc2963227028007a4
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE 1068 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1068 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3336 1068 explorer.exe 67 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1068 wrote to memory of 3336 1068 EXCEL.EXE 72 PID 1068 wrote to memory of 3336 1068 EXCEL.EXE 72 PID 3956 wrote to memory of 1740 3956 explorer.exe 74 PID 3956 wrote to memory of 1740 3956 explorer.exe 74 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings explorer.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fax_3123.xls"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Enumerates system info in registry
PID:1068 -
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\mR6pEukb.vbs2⤵
- Process spawned unexpected child process
PID:3336
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
PID:3956 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mR6pEukb.vbs"2⤵PID:1740
-