Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
259s -
max time network
262s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2023, 23:22
Static task
static1
Behavioral task
behavioral1
Sample
MSCBVMSP_strangles.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
MSCBVMSP_strangles.xlsx
Resource
win10v2004-20221111-en
General
-
Target
MSCBVMSP_strangles.xlsx
-
Size
1.6MB
-
MD5
c49cd07655da3583ba9494c3fd175b71
-
SHA1
7fe2f14846d6ce4e0564983941b20f0420725ee6
-
SHA256
959f8472ca7256b42185bd857bfc218d601db2857e2be272f927dc0277d940c5
-
SHA512
a4007d3073c9d435dc64fc6862d2fa281259af5a33402cdf3d100288941668e5d3fb1569d1b29198e01370c93122522512b631d6c3f319bb6cb7faff3df13226
-
SSDEEP
49152:gzH7eJ6bJt0pMg2Mku0HSXGizcc/0+GxuZSS7ICK:Q60tAf0yXxccDAEICK
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4704 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE 4704 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\MSCBVMSP_strangles.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4704