Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02/11/2022, 15:44

General

  • Target

    975578ca70be47e8f74b40350607b9b54d2d5bcdcc05d3a6527b4074501d07c5.xlsx

  • Size

    39KB

  • MD5

    f75d68ecfb9dad239099835ee3ee5110

  • SHA1

    0754a0a747e4ce4e1a57268d5fc7c0480bc3627b

  • SHA256

    975578ca70be47e8f74b40350607b9b54d2d5bcdcc05d3a6527b4074501d07c5

  • SHA512

    0bb3ea360349b5f46165a3c6d484021e2f48590247af6b83e2a4944e4886a08bc000281733a041fdc2d31a88cc3857eb70c500ba5e1e85af8817b110ebb0f9c8

  • SSDEEP

    768:W14FT+iJk9i3W7L1YBZw7DpseCpZu2RjBZ82yMOj0sMmpL:+gcA34eZGDCxpZnr82e0M1

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\975578ca70be47e8f74b40350607b9b54d2d5bcdcc05d3a6527b4074501d07c5.xlsx
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1380

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1380-54-0x000000002F391000-0x000000002F394000-memory.dmp

    Filesize

    12KB

  • memory/1380-55-0x0000000070E91000-0x0000000070E93000-memory.dmp

    Filesize

    8KB

  • memory/1380-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1380-57-0x0000000071E7D000-0x0000000071E88000-memory.dmp

    Filesize

    44KB

  • memory/1380-58-0x0000000075A11000-0x0000000075A13000-memory.dmp

    Filesize

    8KB

  • memory/1380-59-0x0000000071E7D000-0x0000000071E88000-memory.dmp

    Filesize

    44KB

  • memory/1380-60-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1380-61-0x0000000071E7D000-0x0000000071E88000-memory.dmp

    Filesize

    44KB