Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03/11/2022, 23:15
Behavioral task
behavioral1
Sample
ea1be07a3131523fba4f72708cce8db9350711a4146f7b4765d12ee42d8e7f68.xls
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
ea1be07a3131523fba4f72708cce8db9350711a4146f7b4765d12ee42d8e7f68.xls
Resource
win10-20220901-en
General
-
Target
ea1be07a3131523fba4f72708cce8db9350711a4146f7b4765d12ee42d8e7f68.xls
-
Size
217KB
-
MD5
ecd5e1711b9e049edde7b42824bfa60e
-
SHA1
559d90a1ab5227bcd56601b04e88e469edb9497d
-
SHA256
ea1be07a3131523fba4f72708cce8db9350711a4146f7b4765d12ee42d8e7f68
-
SHA512
a769a219cb1e8b003ce0422fa00db0400506451373f313ae45e29a595eb5f2c095765be1365471a379a325f99c1246d4faf9d89e880eefb2ff50402ecfa68e24
-
SSDEEP
6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgXyY+TAQXTHGUMEyP5p6f5jQm2:DbGUMVWlb2
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3740 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE 3740 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ea1be07a3131523fba4f72708cce8db9350711a4146f7b4765d12ee42d8e7f68.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3740