Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2023, 08:17
Static task
static1
Behavioral task
behavioral1
Sample
Marmalade Non IP 24 07 2023.xls
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Marmalade Non IP 24 07 2023.xls
Resource
win10v2004-20230703-en
General
-
Target
Marmalade Non IP 24 07 2023.xls
-
Size
246KB
-
MD5
2cc33da82821d6e7b62cca1fe1e73177
-
SHA1
7774fa4eef3d6fe281c9438b7acdcde1a06722d3
-
SHA256
be1628c5778eceeb7fc3e52acecf9c412e85863504f430e73de3274e44aeb01d
-
SHA512
2e21aa262c5ce68d58a604c03518dff141b3318428db963e7f1a6a11c129eb9be84bf07ae72d46bc19f28610eb40971864dd410f5b111b5c42e4d758d595eb75
-
SSDEEP
6144:bOBHUBheBB5OPQsVTx1FwYs55DzY02pDpRdGeie:bOuBhmBIPQsbHwz9pYpD
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3176 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE 3176 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Marmalade Non IP 24 07 2023.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3176