Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

03373999.xls

windows7-x64

10

03373999.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03373999.xls

  • Size

    1.8MB

  • Sample

    230609-hyqwyabc89

  • MD5

    fd4ea629d606346a6bce6b46ef0578f8

  • SHA1

    703f80d2bfbf6e2c4803e43a1a9fc994798a4dc1

  • SHA256

    62cbed8b8215059d60eb35d6b35ebc55bb0d5960fc71c3ac368bab71ddaa85a6

  • SHA512

    20a980058b2187dd057e5b3905446a8bb4202311770063acd5ba417d8ad9d4043f63340f212831c4a69cc77488ce8e9ecea10a06f8ad3b0c48407c9c17342d05

  • SSDEEP

    49152:4LK5g6ghO0EO0ida6Hg6ghO0EO0mda6V6Ds:oQgZmid/dgZmmd/QD

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      03373999.xls

    • Size

      1.8MB

    • MD5

      fd4ea629d606346a6bce6b46ef0578f8

    • SHA1

      703f80d2bfbf6e2c4803e43a1a9fc994798a4dc1

    • SHA256

      62cbed8b8215059d60eb35d6b35ebc55bb0d5960fc71c3ac368bab71ddaa85a6

    • SHA512

      20a980058b2187dd057e5b3905446a8bb4202311770063acd5ba417d8ad9d4043f63340f212831c4a69cc77488ce8e9ecea10a06f8ad3b0c48407c9c17342d05

    • SSDEEP

      49152:4LK5g6ghO0EO0ida6Hg6ghO0EO0mda6V6Ds:oQgZmid/dgZmmd/QD

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks