Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 08:48
Behavioral task
behavioral1
Sample
Mashadi Mokone Rosettas Invoice 19-08-2023.xls
Resource
win7-20230712-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mashadi Mokone Rosettas Invoice 19-08-2023.xls
Resource
win10v2004-20230703-en
3 signatures
150 seconds
General
-
Target
Mashadi Mokone Rosettas Invoice 19-08-2023.xls
-
Size
252KB
-
MD5
f9b887f5f2256f976585336e4b1058f9
-
SHA1
6451c86cc3268299665695b445405e656cacd252
-
SHA256
b907b464d94598ebc0f0572272ece2a5846d216d0aaa3805242f0ca4f195197c
-
SHA512
987a5152df10ce30f82e233e523410a6819c0a5be388f1c33e022dbe3362feec8105d96e92467ba112c1938d4919363298acac34a97d4dcd306cc724f90401d3
-
SSDEEP
6144:a8rmjPOtyoVjDGL61EfDlavx+W/IEZ14EwSygNgpLnJPHCl7qgqmFdPEKb9jpppW:15q1PHi7bq6V9H00Ykg
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4716 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4716 EXCEL.EXE 4716 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE 4716 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Mashadi Mokone Rosettas Invoice 19-08-2023.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4716