Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...��.doc
windows7-x64
4报恩寺�...��.doc
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...��.doc
windows7-x64
4报恩寺�...��.doc
windows10-2004-x64
1报恩寺�...��.doc
windows7-x64
4报恩寺�...��.doc
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...��.xls
windows7-x64
1报恩寺�...��.xls
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 00:08
Static task
static1
Behavioral task
behavioral1
Sample
报恩寺路设计图/主要经济技术指标表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
报恩寺路设计图/主要经济技术指标表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
报恩寺路设计图/低等级直曲表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
报恩寺路设计图/低等级直曲表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
报恩寺路设计图/土方计算表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
报恩寺路设计图/土方计算表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
报恩寺路设计图/水泥路总说明.doc
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
报恩寺路设计图/水泥路总说明.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
报恩寺路设计图/用地表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
报恩寺路设计图/用地表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
报恩寺路设计图/竖曲线表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
报恩寺路设计图/竖曲线表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
报恩寺路设计图/第一册.doc
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
报恩寺路设计图/第一册.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
报恩寺路设计图/路 基 设 计 表.doc
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
报恩寺路设计图/路 基 设 计 表.doc
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
报恩寺路设计图/路基超高加宽表1.xlsx
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
报恩寺路设计图/路基超高加宽表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
报恩寺路设计图/路面加宽表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
报恩寺路设计图/路面加宽表1.xlsx
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
报恩寺路设计图/路面工程数量.xls
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
报恩寺路设计图/路面工程数量.xls
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
报恩寺路设计图/逐桩坐标表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
报恩寺路设计图/逐桩坐标表1.xlsx
Resource
win10v2004-20221111-en
General
-
Target
报恩寺路设计图/低等级直曲表1.xlsx
-
Size
25KB
-
MD5
e6645e979166e188392cff0c06c91f97
-
SHA1
a4832b8a5edd5285a28848a40de7090976d5ed94
-
SHA256
d944e44fefe710b818915e34dafa973a8e3aa72000c2387fbd8bb0aa71ecff95
-
SHA512
def864ef2a89aba387752d9cca8601d9e354ab8ea42754e62bf8bb19dc4b6c2d7105f1f9559f539616194002c439c46de29a3f01196356e985187a8e24ef1994
-
SSDEEP
384:NhsjFxARK1LbhpoZyUH1V+jzeZqqOz5NuMyXrEQBGJc2A+VjFpB8kbucnO1YL:NhvKlbhpoZyUVVVZq3t4Q0GXA+1TucO6
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1324 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\报恩寺路设计图\低等级直曲表1.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1324