Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2023, 23:09
Behavioral task
behavioral1
Sample
0b61c8441a3c857e7bf69d2045656c5e1ae643f080f0959e1287bc9395998bda.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0b61c8441a3c857e7bf69d2045656c5e1ae643f080f0959e1287bc9395998bda.xls
Resource
win10v2004-20221111-en
General
-
Target
0b61c8441a3c857e7bf69d2045656c5e1ae643f080f0959e1287bc9395998bda.xls
-
Size
4.8MB
-
MD5
a488b6228a18d684a15193eea58123f9
-
SHA1
6ee15175930903eefa212dfda2cea7d7a9d9a559
-
SHA256
0b61c8441a3c857e7bf69d2045656c5e1ae643f080f0959e1287bc9395998bda
-
SHA512
bc7d4735c70864a6b508e9574d9924776d97a374368e96a4a147843c8a48b8fad1c76d0c4e565a6af69620c628e610e5194f8662ad9567646f79a0bef92e3f92
-
SSDEEP
98304:8v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX8:8vpvFa+g8RWLdPk/84tCEr0RtNiC5eS9
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3300 EXCEL.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3300 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0b61c8441a3c857e7bf69d2045656c5e1ae643f080f0959e1287bc9395998bda.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3300