Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/09/2023, 05:26
230919-f48ylafa5y 119/09/2023, 05:23
230919-f24k4afa5t 119/09/2023, 05:03
230919-fpsm3aeh8t 119/09/2023, 04:59
230919-fmqqpaeh6x 119/09/2023, 04:47
230919-fenlcsgh93 6Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
19/09/2023, 05:26
General
-
Target
Cyber-Security-Risk-Assessment-Checklist.xlsm
-
Size
2.4MB
-
MD5
84e43ceb986a39ff1380981d49c44bf8
-
SHA1
1dd3905867402c113d4451bb7dbc43f6f527ac01
-
SHA256
86469bcb1253f04fb7d982c0ece648ce2669d69c5fa4a902cfd8d7e431473dfc
-
SHA512
cc698516543350145f560ea06f137d9498bd4e2662a24e5c359831c8d55e09fd3c6f1e62e225a07cf3ef5a619de190790a0bd20092b3df9a99717f44aaad446b
-
SSDEEP
49152:34eo+vAhocukoyv9W7twhyubLXQ/zVdzsvPeAlCQQO0BA80aed:3rHvkbvI7zkmvzsvPeoC1Bid
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 9 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 28 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Cyber-Security-Risk-Assessment-Checklist.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD59000599169581d2222295d664340ee4b
SHA18710ee71333ba85b945d167d6c2730764813aa4a
SHA25637bd3aa25cbc46b10f663ccb4861645234fe92ae69c403b5a44d887e19991660
SHA51203d124af5269273b4a737102634e870081e253cf807e35b3d0d940b0fba374856fcbea30b63635dbe209e8e59c497d3675e2a226f8b1cef98e740a7227a15754
-
Filesize
76B
MD50f8eb2423d2bf6cb5b8bdb44cb170ca3
SHA1242755226012b4449a49b45491c0b1538ebf6410
SHA256385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944
SHA512a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886
-
Filesize
76B
MD50f8eb2423d2bf6cb5b8bdb44cb170ca3
SHA1242755226012b4449a49b45491c0b1538ebf6410
SHA256385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944
SHA512a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886
-
Filesize
56KB
MD55a9102626bfe0c48132e46585aa59671
SHA1f87579e6160690debb46699db3e1ac7508c84562
SHA256747235fb44d38040f3734aa8c060bdc5d3a73b948732c1ab27f2830238be2c28
SHA51283b3d6072306568e2b1974fe9fa7b6eff858ba111ecfeb4d70645dae4abd9161a2555f03e08e5bbda222418d4b98b6c140197e26ae8fcaa7120a679a0264ab5b
-
Filesize
52KB
MD508de29cf7bca4307501d7693c86ee8f6
SHA1033808a8bea050f331b94aea3565d403c9713f96
SHA25665ff0e4495cdb811388a8def36629133d91ec70eb38c9f588332e9f18bbc10a0
SHA5126bee09abcd334aff9a737fc7eabade54a5d37d0f748020fac8ba81f5551c55fbd3b5362ef949f6dc4a5f184ffb9ad2cb52ca6bae6d3307043ef11e0fdc2295a1
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB