Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14/07/2021, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
order.xlsx
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
order.xlsx
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
order.xlsx
-
Size
1.1MB
-
MD5
9ca6188ffa6e7610504240a8e653a1af
-
SHA1
c0cdd372d847acda3f851f9b96f74a48f9f6ba0b
-
SHA256
e56be44ff82710e8a304f15c2db34bed017876b9fb36efc1b84c7ace02e6b88a
-
SHA512
d6f8f7823aa448bf010cf6a76179d7194e2369d343ee1aac1819b149ba0b0f56c2b76e749687a7dcd524f9d2709b1487bd103a26b9c1f8fa9e57080f6bb386ce
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 656 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE 656 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\order.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:656