Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2023, 06:00

General

  • Target

    RFQ# RE-2301707.xls

  • Size

    1.2MB

  • MD5

    b9b21e99991c542b6c2298548c004f28

  • SHA1

    09ab1bbc0baff1fee59e5409303297d9d2e80c47

  • SHA256

    ceeb7b4c98464f0429796c743d1c78e2d18c331c4e7c87448440726b7531e1d1

  • SHA512

    a9693452c08a496ec9063500d328d0772b45fc4b688557497593cda36cc291d760b70af3fce5b308d73ecc227f0ae0408365b3177e3185337624c2e226028713

  • SSDEEP

    24576:90nKZyUw6Vtln+Zykw6VINX0wI6XiHP5n2wyL/gGD1p3H:90U06Vtlok6V+X35iPdxe/gON

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RFQ# RE-2301707.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BD42E7B6.emf

    Filesize

    1.4MB

    MD5

    d69c22a341e111feea69df6d8c655d60

    SHA1

    ac862337f2efa43627508927f5052ce694012206

    SHA256

    05b2053bf1d070d6034b45cd79b54d80da3c6d88d016671a345e75048b1a68db

    SHA512

    d4db33ed046b3c9ba09c4b3feac17b1fe2e75fce67f4154fd795d504708c295a1e3c8331ed3d6c3ee9950c936c4cc25b5d690558c26f2e1f7771bd5eb275822c

  • memory/2204-149-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-150-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-136-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/2204-137-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-138-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/2204-139-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-140-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/2204-141-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-142-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-143-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-144-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-145-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-146-0x00007FFA99290000-0x00007FFA992A0000-memory.dmp

    Filesize

    64KB

  • memory/2204-147-0x00007FFA99290000-0x00007FFA992A0000-memory.dmp

    Filesize

    64KB

  • memory/2204-135-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/2204-148-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-152-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-151-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-133-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/2204-153-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-154-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-156-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-157-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-166-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-170-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-134-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2204-207-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/2204-208-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/2204-209-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/2204-210-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/2204-211-0x00007FFADB9B0000-0x00007FFADBBA5000-memory.dmp

    Filesize

    2.0MB