Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2023, 17:35
Behavioral task
behavioral1
Sample
4c4dfd862696a77d4bb13e2b4d2748d3.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4c4dfd862696a77d4bb13e2b4d2748d3.xls
Resource
win10v2004-20220812-en
General
-
Target
4c4dfd862696a77d4bb13e2b4d2748d3.xls
-
Size
95KB
-
MD5
4c4dfd862696a77d4bb13e2b4d2748d3
-
SHA1
7ac7b3e22f0307f6a5fe682f9a92c1c09d5421f9
-
SHA256
0c5dbda05771b14e69b7fa41e788ad7322a27ab47309470232f6d2f69c5cfeef
-
SHA512
58945def5df7e78f2683d03f89b6b9bb3aea32876ae94281f3b583439fea0a3ce22e7a17dea9d84464075dbf1e8c7d61421b183ff5a846b249f6079f7d1d9ab7
-
SSDEEP
1536:euuuoHPa4Rz/Sbj13z/vHfQse0Z95rt3rYMPaw2jcc0lbxOvTgEfoRt/WwF16Qm:Rt3iw2jcc0lbxOrxGphm
Malware Config
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1656 4612 cmd.exe 76 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1812 4612 cmd.exe 76 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1304 4612 cmd.exe 76 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\46965E00\:Zone.Identifier:$DATA EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4612 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4612 wrote to memory of 1656 4612 EXCEL.EXE 83 PID 4612 wrote to memory of 1656 4612 EXCEL.EXE 83 PID 4612 wrote to memory of 1812 4612 EXCEL.EXE 85 PID 4612 wrote to memory of 1812 4612 EXCEL.EXE 85 PID 4612 wrote to memory of 1304 4612 EXCEL.EXE 87 PID 4612 wrote to memory of 1304 4612 EXCEL.EXE 87 PID 1656 wrote to memory of 2732 1656 cmd.exe 89 PID 1656 wrote to memory of 2732 1656 cmd.exe 89 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2732 attrib.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4c4dfd862696a77d4bb13e2b4d2748d3.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\system32\attrib.exeattrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"3⤵
- Views/modifies file attributes
PID:2732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
PID:1812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
PID:1304
-