Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
25s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 14:44
Static task
static1
Behavioral task
behavioral1
Sample
Notice Errors for 10-13.xlsx
Resource
win10v2004-20230915-en
5 signatures
150 seconds
General
-
Target
Notice Errors for 10-13.xlsx
-
Size
11KB
-
MD5
5bb214affd7896a62b48f22005011045
-
SHA1
3326d39b751b87b7199dced123e15fec47403711
-
SHA256
4671fc2de5e0cd5d1a8bde1a1a2a84708c419e6591a7737614fa28721da799d6
-
SHA512
d308fb098000fe186665e1163b5a74f0d711bf54833ccdb65f4f8892f1bc99ddd1e75159d92840e19ae0b902322df22a03d71e382d602434d941cd0aaf96b950
-
SSDEEP
192:KrEhtX5zb3UTJ4aaFUlbVvevUqzYGBAl570R3wnZStt:Kc3KaUlM9zYIR3wZStt
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1380 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1380 EXCEL.EXE 1380 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE 1380 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Notice Errors for 10-13.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1380