Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 11:12
Static task
static1
Behavioral task
behavioral1
Sample
69f0318591269a3eb4049ee6b7321540.xlsm
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
69f0318591269a3eb4049ee6b7321540.xlsm
Resource
win10v2004-20231215-en
General
-
Target
69f0318591269a3eb4049ee6b7321540.xlsm
-
Size
41KB
-
MD5
69f0318591269a3eb4049ee6b7321540
-
SHA1
f1e02773ef90fe9a6beb2752acab8fcdb7b50403
-
SHA256
0f754a268c1769eb4ed2c2494f22755a1e6529878057deb4655c2f482e6e86e2
-
SHA512
8b65ff35750be49007e97e57693eaa9c541e7601f5aa0b34033593b53190d72158810e776151535e070d65ce2d2d0ee6ef88413f8855ac6f737479cec53e72d7
-
SSDEEP
768:nh6ebfxG3IrZN0DGCfkyX3eks4pSGn0Qic3qB2d+x64z0Cq1:h6EVGzfPeUv02S2dSjzFu
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 884 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 884 EXCEL.EXE 884 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE 884 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\69f0318591269a3eb4049ee6b7321540.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:884