Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 05:26

General

  • Target

    关于公布第四届福建省学生规范汉字书写大赛评奖结果的通知/闽教语〔2012��.xls

  • Size

    177KB

  • MD5

    805fe34e59243792982b60666b659b85

  • SHA1

    c01a28323b9202d9ff3952e67c7122e9b728ca67

  • SHA256

    32a530c39b66376786e4921752321abca3ba5896f12d9e9089de1c41769472e0

  • SHA512

    e297ee1e1fe7c48f2091056f2c9c4afb9750bb113edc3af38b9fa5b6857d22d5946464eccc462af78b4db930789ec09420affdf1de86c850c794ab4a89a58087

  • SSDEEP

    3072:8oO1dom5Iab6FoRbvic6H4I2jcc0lbxOrB2AJtXwRGx:vCGFo1GF2

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\关于公布第四届福建省学生规范汉字书写大赛评奖结果的通知\闽教语〔2012��.xls
    1⤵
    • Modifies Internet Explorer settings
    PID:1684
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
      2⤵
      • Process spawned unexpected child process
      PID:2432
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
      2⤵
      • Process spawned unexpected child process
      PID:2516
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
      2⤵
      • Process spawned unexpected child process
      PID:1332
  • C:\Windows\SysWOW64\attrib.exe
    attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
    1⤵
    • Views/modifies file attributes
    PID:2016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1684-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1684-1-0x0000000072CED000-0x0000000072CF8000-memory.dmp

    Filesize

    44KB

  • memory/1684-25-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-76-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-78-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-75-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-126-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-170-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-192-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-218-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-252-0x0000000072CED000-0x0000000072CF8000-memory.dmp

    Filesize

    44KB

  • memory/1684-215-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-216-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-254-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-268-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-214-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-303-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-314-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-169-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-124-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-80-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-340-0x00000000063B0000-0x00000000064B0000-memory.dmp

    Filesize

    1024KB

  • memory/1684-344-0x0000000072CED000-0x0000000072CF8000-memory.dmp

    Filesize

    44KB