Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
14/11/2023, 08:13
General
-
Target
NEAS.20728d460c5c42cbd40ad4c4bcffa85013f4763501b561acccf23d76c871894d.xls
-
Size
938KB
-
MD5
b6e5689997ab86f037c75abe3478ed5d
-
SHA1
8f274288e21c4907690c0925e9a4fd44293cf3af
-
SHA256
20728d460c5c42cbd40ad4c4bcffa85013f4763501b561acccf23d76c871894d
-
SHA512
44a4dd6dbad49bf2ef26259d9e82711a23badae938e891103f24eb2ed9fa37749ef5434807bed1728419a10a71409c02465415f434aece6c7f976b314a55d123
-
SSDEEP
24576:g/BHw6/BZy83bVmEgTIZ3v5bJvuwAYyv4OL5udmwNx:D6/rt3bVm7TGRVvuwcQO1ni
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\NEAS.20728d460c5c42cbd40ad4c4bcffa85013f4763501b561acccf23d76c871894d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD551abd2269e975009d94359d0f494ea5c
SHA1991dfd541fb079b2c56e9ae44320e202b451e2bf
SHA256bb32f5d0bd59d3e5ff66174d3016f510f027b51854a9fa954b94f9f20986f593
SHA51265a0327baca080eda6a20240afdd2ed8680551a92de229eb9730bab7b04e4d8483f4de2be2e5acf4b4a7c8ddf57459320dd6e1d449c70c7c61d8ae04d6a4825b
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB