Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2023, 08:53
Static task
static1
Behavioral task
behavioral1
Sample
order #393405.xls
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
order #393405.xls
Resource
win10v2004-20230703-en
General
-
Target
order #393405.xls
-
Size
1.3MB
-
MD5
a913096f787c53f96a34dfff28a68ac1
-
SHA1
43ea14976d150ca3146c0fde2f44947df9e2f4af
-
SHA256
da1f2444a6a87363c210ff73a4111ccea458b1d35b2cbe7c1c54fa471c8f752f
-
SHA512
ec32f7db5917cfb7162d32386c3dd38cc1373a6635668c3ffe158130e8d4d1eeadb69ca0a6ee6fb9d09168b83e24f1b9ee923d96a7f668b2a9d09f0e3a32d81f
-
SSDEEP
24576:UaZy0w6VgjKaWlEzp7aUZydw6VzjKaWlEzp7azzd6f/b7QAUQp5E/zwwx:UE86VgjKjOzRJ6VzjKjOzEdU7/UX/zf
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4316 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4316 EXCEL.EXE 4316 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\order #393405.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4316
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5d69c22a341e111feea69df6d8c655d60
SHA1ac862337f2efa43627508927f5052ce694012206
SHA25605b2053bf1d070d6034b45cd79b54d80da3c6d88d016671a345e75048b1a68db
SHA512d4db33ed046b3c9ba09c4b3feac17b1fe2e75fce67f4154fd795d504708c295a1e3c8331ed3d6c3ee9950c936c4cc25b5d690558c26f2e1f7771bd5eb275822c