Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 19:57
Behavioral task
behavioral1
Sample
ca8a1c6d24b64eb3ed9ddde5094fe00e548a323e23646b9037403c80373e1d88.xls
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
ca8a1c6d24b64eb3ed9ddde5094fe00e548a323e23646b9037403c80373e1d88.xls
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
ca8a1c6d24b64eb3ed9ddde5094fe00e548a323e23646b9037403c80373e1d88.xls
-
Size
59KB
-
MD5
87802bbe0e4e286a3dfc467c0cf14d4c
-
SHA1
b057e1d4daa74e7bfa02bc5d8a552c14c4973dde
-
SHA256
ca8a1c6d24b64eb3ed9ddde5094fe00e548a323e23646b9037403c80373e1d88
-
SHA512
df8ed7ccad36a6d5e42b89a3c91fd96508f87e9e704c3df05fe95fbf3839be80f8240a5051e0d20bbd4a6bc2900bcccb58eaf83306ec6fc798be83bbf64e248b
-
SSDEEP
1536:pQQQQa9ovgZD7KnFRae5ZQKib09ctKCCEyPHLbKBdq8Ub:PCCsRM
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1712 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ca8a1c6d24b64eb3ed9ddde5094fe00e548a323e23646b9037403c80373e1d88.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1712