Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2023, 12:08
Behavioral task
behavioral1
Sample
Planning 2024/Notes(Install-Utilisation).pdf
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Planning 2024/Notes(Install-Utilisation).pdf
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Planning 2024/Planning Hebdo 2024.xlsm
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
Planning 2024/Planning Hebdo 2024.xlsm
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
Planning 2024/Sécurité Microsoft.pdf
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
Planning 2024/Sécurité Microsoft.pdf
Resource
win10v2004-20231025-en
General
-
Target
Planning 2024/Planning Hebdo 2024.xlsm
-
Size
3.3MB
-
MD5
265cfce96c02c61cbc97d75faaeb502e
-
SHA1
104de8ba24a8da78240e74be2b09a04d14293507
-
SHA256
1853624b11a348b1921a2d6984710fdf497beeffcc06d0426e6f25fa289e4e70
-
SHA512
4664fe6d0a2f5968d32b96d3694375213f486503aa644621e12113bc172fbc400f3e7e1f92d749a4cf4c8cc33f90a44eaeb6ec4889270baca6467da970fd2b6d
-
SSDEEP
98304:P8ABsGfoFxAm/Pv/w1E2ulcMKJHjTVhw0ZGWX:P8azaKHjTVhwm
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4728 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4728 EXCEL.EXE 4728 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Planning 2024\Planning Hebdo 2024.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4728