Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
10/10/2023, 21:45
231010-1mh13afd59 110/10/2023, 21:40
231010-1jgc3afa44 110/10/2023, 21:35
231010-1fpv2ace8y 1010/10/2023, 17:50
231010-wezlmafb9s 1Analysis
-
max time kernel
37s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
10/10/2023, 21:40
General
-
Target
Orden Roch-CVE6422-TVOP.xlam
-
Size
666KB
-
MD5
5edda4e170c74a69835e8bd822c51803
-
SHA1
daf25f4e5eff37fe7677ce3139b0042a3ec5e236
-
SHA256
0b8fa64ce20b4cedd71c6e36261052f0ac8948ea296c6ada5791c90d563c7e6a
-
SHA512
b254db2d0d3c23490334df11c368d3bf6c8b4647bd1c4ea5e413bef5e8d9e6aa6cb2b936bb59b85b3767d9630fed389edc30ed2b5bfc13402b22b6f0a1587fe8
-
SSDEEP
12288:WTaUMotvoZmtEEPnBu4fYbHI4LXP+FEXpH1YUyKgOm9oQbvs6:/UNEsnBu4fgIm+FiVYUyKgl9oQTN
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Orden Roch-CVE6422-TVOP.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB