Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/09/2023, 05:26
230919-f48ylafa5y 119/09/2023, 05:23
230919-f24k4afa5t 119/09/2023, 05:03
230919-fpsm3aeh8t 119/09/2023, 04:59
230919-fmqqpaeh6x 119/09/2023, 04:47
230919-fenlcsgh93 6Analysis
-
max time kernel
148s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
19/09/2023, 04:59
General
-
Target
Cyber-Security-Risk-Assessment-Checklist.xlsm
-
Size
2.4MB
-
MD5
84e43ceb986a39ff1380981d49c44bf8
-
SHA1
1dd3905867402c113d4451bb7dbc43f6f527ac01
-
SHA256
86469bcb1253f04fb7d982c0ece648ce2669d69c5fa4a902cfd8d7e431473dfc
-
SHA512
cc698516543350145f560ea06f137d9498bd4e2662a24e5c359831c8d55e09fd3c6f1e62e225a07cf3ef5a619de190790a0bd20092b3df9a99717f44aaad446b
-
SSDEEP
49152:34eo+vAhocukoyv9W7twhyubLXQ/zVdzsvPeAlCQQO0BA80aed:3rHvkbvI7zkmvzsvPeoC1Bid
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 9 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 28 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Cyber-Security-Risk-Assessment-Checklist.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD574e406eacb4c40421d2dd74aa490a8be
SHA1faf5cbb9c93f5b127b0dbb916919d04839a36a86
SHA256f448c62472c6594f90e068eb24cb9b1630597a06fe8863ed3dadc94e5ef499b6
SHA512ad8486567957690ac5e454f846f0970f029f280a436de0f3138727eec7c91623ccb157b2d1e3bd006c1572676d38aa570623f0f2cc6e25e244f1c34f5aa86ecf
-
Filesize
76B
MD50f8eb2423d2bf6cb5b8bdb44cb170ca3
SHA1242755226012b4449a49b45491c0b1538ebf6410
SHA256385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944
SHA512a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886
-
Filesize
76B
MD50f8eb2423d2bf6cb5b8bdb44cb170ca3
SHA1242755226012b4449a49b45491c0b1538ebf6410
SHA256385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944
SHA512a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886
-
Filesize
56KB
MD57483fd9a1ca145670fcd242974e1a672
SHA1f592343bbfd1e2ac54da078f6caf8218cccf7e7d
SHA256dc8113196b84c70c296b07fe7be919b14aad52477bb1b04a476f62c36888c206
SHA512314a2899f598e8f60f5031f037d34e5ea47232f560c34cc12ba0da5bb9e455b9a0d96c823bd8c2463cb9d67b6f30b5e95d8f55f23adb92e358445789987cdd28
-
Filesize
52KB
MD598855f8d538362bdbb642c8ee6e877bc
SHA18176d96adb0d66d4f20ca8850b15002bb5e6ef0f
SHA256978ed192d7f7195b24e92093465b13a6fef22a5f8560fcb1ba99c5579673261e
SHA512c539b93fe425f778b6fc707270a590eafb92b6b73c4c40312f751a827353089c969d91faf30d54f060eaf3860d51dace2e3b389b5f91d32b5e8ddb607cda57ae
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
956KB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB