Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
29/10/2023, 01:20
General
-
Target
6fb30f4760c71e5dd852e73a34222a6fae6f44a0046d0f913e5bcb68ce514590.xls
-
Size
1.1MB
-
MD5
3b7736009133ab2366038e6d9a3e0c2f
-
SHA1
ba1ccf6ca0888c15f6475bcac6e285cb479d8939
-
SHA256
6fb30f4760c71e5dd852e73a34222a6fae6f44a0046d0f913e5bcb68ce514590
-
SHA512
d0d5fa14eb9b797150d1e76e0017b9cda71fd235d3cbee2be246cbaa480ad3d07f3ff6557a2b9a688526ebea478e614983f5545cef987ed3ed562d89f476b80f
-
SSDEEP
24576:wxBXZyrw6/2THaZylw6/90U++g4JRuJngtQETYRMO+4yi0CLnsd7UNl:UF6/ek76/+UBg4TUngtzTUGFCDkC
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6fb30f4760c71e5dd852e73a34222a6fae6f44a0046d0f913e5bcb68ce514590.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5b18cb5fa447b1a4bf326e98b33c4a24b
SHA16173b616428275ba59bdaf681e6dac2c7baf26a6
SHA2568cd068ed135d64cde8d1e4abba94a69f584d9c4e54ac1c3758a1d7151728df76
SHA5125711d662556de2fe1186276761cf480d071b55c9e8e8b6b781d38235ad04a1884ca6d748611f640c479e6ddb0f438b5cbabb743ea295e96ef4dec510ba345e5e
-
Filesize
1.4MB
MD51fcb3f34b5588f6a647a06dff1811bf9
SHA11f5ef0e6e41c14795decedcefc883ab9000fac9a
SHA256a99e8172248dac0b2a6243d06a862901989857b0c2ecbed5f25ddb0d1a95154e
SHA51247e951583afff444f9adb09beab0d83f9792b46d3e1fabf05d21068218d64b3cba48e2dc22fe0a7bd3252a0e0c8866faa244b5dc3784bd336ecbc9f2924fb2aa
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB