Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2023, 13:01
Static task
static1
Behavioral task
behavioral1
Sample
BL384046.xls
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
BL384046.xls
Resource
win10v2004-20230915-en
General
-
Target
BL384046.xls
-
Size
1.1MB
-
MD5
2e23100c5aec0677e59c67a91a65f866
-
SHA1
44a6b4bd21d112323e09d34377a4d4da790678ee
-
SHA256
0b6fb77ce47570600e62ff20a47b545ea4a43c24b68960d23e654fbd78eb3354
-
SHA512
e1ced652d23942fe93f44d89f4d4d12029ed16c2e36f41f138d41ac9d7fe0604ab78040da0bf8cbe68454277535d0a25bb498c7af52a29a01ccacd710d0c82d2
-
SSDEEP
24576:AWQmmav30x6Zy7w6VZmIUDUZyfw6VukJUKokM9n8UIfExsdeI5jPwUx:VQmmQ30qf6VRL6V/e8rfxdeI5Tf
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4412 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4412 EXCEL.EXE 4412 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE 4412 EXCEL.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\BL384046.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5a01b9617553432807b9b58025b338d97
SHA1439bdcc450408b9735b2428c2d53d2e6977fa58c
SHA2567a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce
SHA512312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee
-
Filesize
238KB
MD52ab2b2a662145b7bc22edbbcb4bb019c
SHA11c700eb0876ff926da0d019ec3089ed8296d20c9
SHA256fc311a5da8113f91cc3f919a72f33f4294b013fcebc89c9dca64cfc5565d8d15
SHA512220a5787fe2585726ce1b15cd31d5a5b2e752206cf3c46e1c2e5c24b58c18d7e5b431ef3f17369068773422e8229f35a21ee525be5302acec7ed6c08e6231f29