Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
6_850A9CE91...92.exe
windows7-x64
1_850A9CE91...92.exe
windows10-2004-x64
1_85775FE8A...C0.pdf
windows7-x64
1_85775FE8A...C0.pdf
windows10-2004-x64
1_857C1A063...C.xlsx
windows7-x64
1_857C1A063...C.xlsx
windows10-2004-x64
1_861C5A066...68.jar
windows7-x64
1_861C5A066...68.jar
windows10-2004-x64
7_874D15677...9B.jar
windows7-x64
1_874D15677...9B.jar
windows10-2004-x64
7_8799F7153...1D.dll
windows7-x64
1_8799F7153...1D.dll
windows10-2004-x64
1_88ECC22CD...A.html
windows7-x64
1_88ECC22CD...A.html
windows10-2004-x64
1_89C4639AC...1C.jar
windows7-x64
1_89C4639AC...1C.jar
windows10-2004-x64
7_8A4455BF4...A8.dll
windows7-x64
3_8A4455BF4...A8.dll
windows10-2004-x64
3_8A902ECF1...DD.jar
windows7-x64
1_8A902ECF1...DD.jar
windows10-2004-x64
7_8AE3EAF93...D.html
windows7-x64
1_8AE3EAF93...D.html
windows10-2004-x64
1_8AF2F97B5...AF.jar
windows7-x64
1_8AF2F97B5...AF.jar
windows10-2004-x64
7_8CAD92531...44.jar
windows7-x64
1_8CAD92531...44.jar
windows10-2004-x64
7_8EFD210D2...6A.jar
windows7-x64
1_8EFD210D2...6A.jar
windows10-2004-x64
7_8FCD084FE...B4.jar
windows7-x64
1_8FCD084FE...B4.jar
windows10-2004-x64
7_903967F51...E1.exe
windows7-x64
1_903967F51...E1.exe
windows10-2004-x64
1Analysis
-
max time kernel
186s -
max time network
228s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 07:56
Behavioral task
behavioral1
Sample
_850A9CE912B13565AF29B34E031CC792.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
_850A9CE912B13565AF29B34E031CC792.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
_85775FE8A80EE9570FE7A08C75F4D5C0.pdf
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
_85775FE8A80EE9570FE7A08C75F4D5C0.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
_857C1A06388DBA2B12F1ABD19D5F03EC.xlsx
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
_857C1A06388DBA2B12F1ABD19D5F03EC.xlsx
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
_861C5A066E0E465A9C73D7A8BC735568.jar
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
_861C5A066E0E465A9C73D7A8BC735568.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
_874D1567799B7B9AFBEE570F7726949B.jar
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
_874D1567799B7B9AFBEE570F7726949B.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
_8799F7153471BC8E3B333E972437C11D.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
_8799F7153471BC8E3B333E972437C11D.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
_88ECC22CD04E30B687F996108FEE9A6A.html
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
_88ECC22CD04E30B687F996108FEE9A6A.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
_89C4639AC9A69DE25B22FD180B6C971C.jar
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
_89C4639AC9A69DE25B22FD180B6C971C.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
_8A4455BF480BBD2E5E1D2EE0DD0807A8.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
_8A4455BF480BBD2E5E1D2EE0DD0807A8.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
_8A902ECF1774235EEA788809EA57F5DD.jar
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
_8A902ECF1774235EEA788809EA57F5DD.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
_8AE3EAF9387809565C1C3DD8855EEF8D.html
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
_8AE3EAF9387809565C1C3DD8855EEF8D.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
_8AF2F97B51B0701F1C5EE9E312FBBDAF.jar
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
_8AF2F97B51B0701F1C5EE9E312FBBDAF.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
_8CAD92531FCEE9FA6989F889207CDA44.jar
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
_8CAD92531FCEE9FA6989F889207CDA44.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
_8EFD210D2566AB9E39E038BBD504596A.jar
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
_8EFD210D2566AB9E39E038BBD504596A.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
_8FCD084FEA1DEADAC814BE0A01BAFCB4.jar
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
_8FCD084FEA1DEADAC814BE0A01BAFCB4.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
_903967F51CF6ABB3C214038FB99275E1.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
_903967F51CF6ABB3C214038FB99275E1.exe
Resource
win10v2004-20231222-en
General
-
Target
_857C1A06388DBA2B12F1ABD19D5F03EC.xlsx
-
Size
12KB
-
MD5
e435d92c38743762e1d4869bae6480c3
-
SHA1
c1797313d80e3baa75443163e5a376df6d81c0f9
-
SHA256
708d7bef6835c005b02aa54e22bd52d69d66298f856e9e1474eac2b18c5736f1
-
SHA512
a7c60fb316feb12f9f5232848c0cf560342b262ef689b7f366bcac69419192e11c0e535d2402c6cff1b1c842fc15911dfd71f6b71ce9821fd6c2f2e8743d3edc
-
SSDEEP
192:ZsHZRA5gMRHJgGjGnockSBWgt9dt6Y6MfXvjuhjA85/tSH78ifX0LzIYM:mnAzRpgPdvtcY6Eahjd51SAifXr
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4088 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4088 EXCEL.EXE 4088 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\_857C1A06388DBA2B12F1ABD19D5F03EC.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4088