Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
20s -
platform
windows7_x64 -
resource
win7 -
submitted
14/07/2020, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
14e5fd44d43f96426d7499e41626560e.xls
Resource
win7
Behavioral task
behavioral2
Sample
14e5fd44d43f96426d7499e41626560e.xls
Resource
win10v200430
General
-
Target
14e5fd44d43f96426d7499e41626560e.xls
-
Size
515KB
-
MD5
14e5fd44d43f96426d7499e41626560e
-
SHA1
53c22aeecd280d71ff69d91ddaf967c36e449db9
-
SHA256
df28f2ba0fd1e2a5acee743c36a04155abfb0229c743b180cb39403ded922772
-
SHA512
41a060ecba5406e0dcef629c444016462f1f5d21e44fee462ef6c81ce014f34396293da6584863c6f801dd5f9e8db5420b96af0c3728cd0055905ddcc47f16c1
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1124 EXCEL.EXE 1124 EXCEL.EXE 1124 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1124 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1448 1124 DW20.EXE 23 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1448 1124 EXCEL.EXE 24 PID 1124 wrote to memory of 1448 1124 EXCEL.EXE 24 PID 1124 wrote to memory of 1448 1124 EXCEL.EXE 24 PID 1124 wrote to memory of 1448 1124 EXCEL.EXE 24 PID 1124 wrote to memory of 1448 1124 EXCEL.EXE 24 PID 1448 wrote to memory of 1464 1448 DW20.EXE 25 PID 1448 wrote to memory of 1464 1448 DW20.EXE 25 PID 1448 wrote to memory of 1464 1448 DW20.EXE 25 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1464 dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1124 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\14e5fd44d43f96426d7499e41626560e.xls1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
PID:1124 -
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11562⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11563⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1464
-
-