Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2023, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
1.xls
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1.xls
Resource
win10v2004-20230703-en
General
-
Target
1.xls
-
Size
172KB
-
MD5
61cb38716a87e273057cb9b4bc753ec4
-
SHA1
42e387d0019c0750fd50b98e9768439dc82b95c3
-
SHA256
e31c1ef794df4e997ed02315de8f9252fe45bfd7dad9dcf55f80e2b54ed474c0
-
SHA512
2914f27cfa7964057dcfe3402c7efc81f40784b9d81ac68e811828fd461c21d4aa9cb5e2a1f9678aaff4fc3a4e7a428637f2bf9a83b145ee5a55d1c081870b32
-
SSDEEP
3072:3fk1o6PVrasJt6vyYlZecMVCD7tpYxcZLLbsFjB2b1QSlRSfdYO5D91lN2T0:3fk1n9rasJOyYacMVCEalLbsBB2VvS++
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3636 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3636 EXCEL.EXE 3636 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3636