Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2023, 02:22
Behavioral task
behavioral1
Sample
ed87b60d77096d0eab29e895bfe5f092503535dd3ec56d96dc16948a67dc5cc5.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ed87b60d77096d0eab29e895bfe5f092503535dd3ec56d96dc16948a67dc5cc5.xls
Resource
win10v2004-20220812-en
General
-
Target
ed87b60d77096d0eab29e895bfe5f092503535dd3ec56d96dc16948a67dc5cc5.xls
-
Size
217KB
-
MD5
cb5a66c49fdb3439090161e6cb0dc0a8
-
SHA1
a2ae194d202a1eb0cce7952f9c18d7c0ce01baf8
-
SHA256
ed87b60d77096d0eab29e895bfe5f092503535dd3ec56d96dc16948a67dc5cc5
-
SHA512
977f14ec194c215f9f6a0c8995bfa08216c66b87b6e99f2cf8fc6af4b83b0d83902709650dd259dbde28c232913044f14937d18889a2ea1a54cca0a2ac9b1067
-
SSDEEP
6144:HKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgByY+TAQXTHGUMEyP5p6f5jQmH:BbGUMVWlbH
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4956 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE 4956 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ed87b60d77096d0eab29e895bfe5f092503535dd3ec56d96dc16948a67dc5cc5.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4956