Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    205s
  • max time network
    212s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 18:27

General

  • Target

    大邑—安仁金安小区外线资料/光缆信息表-安仁金安小区.xls

  • Size

    20KB

  • MD5

    20fdccef0d5f3168f78044598db51164

  • SHA1

    6b30da004b2b821cbcb7c6f8a4deff5c61eb2cce

  • SHA256

    6110d29b4b826a0e94fbb02f07cbed11750f2438cf38ff6cfb7cc639e5d42020

  • SHA512

    d8245a3ab88f5f021fbf4304d227a7993210beeab8c41c7fe32b19740f76b76903db42e5bd1139ff46cf7c7539fca6b920942b7763b9ce50194e9e607e9bf8b5

  • SSDEEP

    384:1+++zJtV8ceKbsQvPe8k1SsC5qQ+2et5+4qwp9G6Lg29Lhqbp4/sNopKWX4/TyVJ:1+++zJtV8ceKbsQvPe8k1SsC5qQ+2ejH

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\大邑—安仁金安小区外线资料\光缆信息表-安仁金安小区.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:308

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/308-132-0x00007FFB8CBB0000-0x00007FFB8CBC0000-memory.dmp

    Filesize

    64KB

  • memory/308-133-0x00007FFB8CBB0000-0x00007FFB8CBC0000-memory.dmp

    Filesize

    64KB

  • memory/308-134-0x00007FFB8CBB0000-0x00007FFB8CBC0000-memory.dmp

    Filesize

    64KB

  • memory/308-135-0x00007FFB8CBB0000-0x00007FFB8CBC0000-memory.dmp

    Filesize

    64KB

  • memory/308-136-0x00007FFB8CBB0000-0x00007FFB8CBC0000-memory.dmp

    Filesize

    64KB

  • memory/308-137-0x00007FFB8A520000-0x00007FFB8A530000-memory.dmp

    Filesize

    64KB

  • memory/308-138-0x00007FFB8A520000-0x00007FFB8A530000-memory.dmp

    Filesize

    64KB